{
  "$schema": "https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",
  "version": "1.0",
  "protocolVersion": "2025-06-18",
  "serverInfo": {
    "name": "de.fraghugo/frag.hugo",
    "title": "frag.hugo",
    "version": "1.0.0"
  },
  "name": "frag.hugo",
  "description": "frag.hugo is a data protection platform with an external data protection officer (Datenschutzbeauftragter) from frag.hugo Informationssicherheit GmbH in Hamburg, Germany; customers connect Claude, ChatGPT or Microsoft Copilot and let their assistant fill in the records (VVT, TOMs, AVV, DSFA) that the data protection officer reviews.",
  "description_de": "frag.hugo ist eine Datenschutz-Plattform mit externem Datenschutzbeauftragten der frag.hugo Informationssicherheit GmbH aus Hamburg; Kunden verbinden Claude, ChatGPT oder Microsoft Copilot und lassen ihren Assistenten die Unterlagen ausfüllen, die der Datenschutzbeauftragte prüft.",
  "serverUrl": "https://mcp.fraghugo.de/mcp",
  "transport": {
    "type": "streamable-http",
    "endpoint": "https://mcp.fraghugo.de/mcp"
  },
  "endpoints": {
    "all": "https://mcp.fraghugo.de/mcp",
    "public": "https://mcp.fraghugo.de/mcp/offen",
    "account": "https://mcp.fraghugo.de/mcp/konto"
  },
  "authentication": {
    "required": false,
    "schemes": [
      "oauth2"
    ],
    "note": "Public tools work without an account. Account tools use OAuth 2.1 with the frag.hugo login and have the same rights as the person in the app.",
    "protectedResourceMetadata": "https://mcp.fraghugo.de/.well-known/oauth-protected-resource/mcp"
  },
  "capabilities": {
    "tools": {
      "listChanged": false
    },
    "prompts": {
      "listChanged": false
    }
  },
  "websiteUrl": "https://www.fraghugo.de/en/ai-assistant/",
  "documentationUrl": "https://docs.fraghugo.de",
  "repository": "https://github.com/Jens-KI-007/fraghugo-claude-plugin",
  "iconUrl": "https://www.fraghugo.de/apple-touch-icon.png",
  "publisher": {
    "name": "frag.hugo Informationssicherheit GmbH",
    "url": "https://www.fraghugo.de",
    "email": "info@fraghugo.de"
  },
  "privacyPolicyUrl": "https://www.fraghugo.de/datenschutz/",
  "languages": [
    "de",
    "en"
  ],
  "tools": [
    {
      "name": "search_gdpr_fines",
      "title": "Search GDPR fines (DSGVO-Bußgelder)",
      "description": "Searches the frag.hugo database of documented GDPR fines (Germany and Europe), each case with authority, amount, GDPR articles, a short summary and the official source. Use it for questions such as \"which fines were imposed for Art. 32\" or \"fines against telecom companies in Germany\". Not for legal advice in an individual case and not for fines under other laws. Results are sorted by date, newest first.",
      "requiresAuthentication": false
    },
    {
      "name": "get_compliance_deadlines",
      "title": "Compliance deadlines (Fristenkalender)",
      "description": "Lists dated compliance deadlines from the frag.hugo deadline calendar (GDPR, NIS2, AI Act, CRA, DORA, Data Act, accessibility act and more), each with legal provision, status, what to do and the official source. Without date filters it returns the next upcoming deadlines from today. Not for deadlines of an individual company (data breach, data subject request); those need an account.",
      "requiresAuthentication": false
    },
    {
      "name": "check_software_gdpr",
      "title": "Check software for GDPR fitness (DSGVO-Prüfstand)",
      "description": "Looks up whether frag.hugo has reviewed a software or cloud service for GDPR use in companies (contract partner, data processing agreement, subprocessors, data location, third-country transfer, AI training, certificates, admin controls, deletion, data subject rights). Returns the published verdict with evidence links, or, if the service has not been reviewed, the ten criteria to check yourself. It never estimates a verdict for unreviewed services.",
      "requiresAuthentication": false
    },
    {
      "name": "get_subprocessor_changes",
      "title": "Subprocessor changes (Subprozessor-Monitor)",
      "description": "Shows the subprocessor lists of 17 widely used cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce, HubSpot, Stripe and others) as monitored daily by frag.hugo: date of the last change, number of entries, names and links to the official list and the data processing agreement. Use it to check whether a provider changed its subprocessors since a given date. Not for providers outside these 17.",
      "requiresAuthentication": false
    },
    {
      "name": "find_supervisory_authority",
      "title": "Find data protection authority (Aufsichtsbehörde)",
      "description": "Finds the competent German data protection supervisory authority by federal state, postcode (PLZ) of the main establishment or authority ID, with competence, website, key figures from the latest activity report (with evidence links), focus topics and notes for SMEs. In Bavaria, public bodies are supervised by BayLfD, companies by BayLDA. If a postcode spans two states, it asks back. Not for authorities outside Germany.",
      "requiresAuthentication": false
    },
    {
      "name": "get_cyber_threat_picture",
      "title": "Ransomware situation Germany (Cyber-Lagebild)",
      "description": "Summarises how many organisations from Germany ransomware groups have named on their leak sites in the last 30 days or 12 months, by industry and group, with the frag.hugo monthly assessment and method. Counts are perpetrator claims from the RansomLook inventory (CIRCL, CC BY 4.0), not confirmed incidents. Not for looking up individual victims.",
      "requiresAuthentication": false
    },
    {
      "name": "check_email_security",
      "title": "Check email security of a domain (SPF, DKIM, DMARC)",
      "description": "Checks the public DNS records that protect a domain against e-mail spoofing: SPF, DKIM (common selectors), DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Returns an overall assessment, one finding per check and recommendations. Use it for a company domain, not for single mailboxes. Nothing is stored. Rate limited per connection.",
      "requiresAuthentication": false
    },
    {
      "name": "start_website_check",
      "title": "Start website privacy check (Hugo Check)",
      "description": "Starts the free frag.hugo website check (Hugo Check) for a public URL: cookies and tracking before consent, consent banner, Google Fonts, privacy policy and imprint, TLS and security headers, e-mail records, accessibility and shop duties. Returns the result directly if it is ready within about 20 seconds, otherwise a scan_id for get_website_check_result. The same URL within one hour returns the same scan. Limited to 3 new checks per hour per connection. Not legal advice.",
      "requiresAuthentication": false
    },
    {
      "name": "get_website_check_result",
      "title": "Get website check result (Hugo Check)",
      "description": "Returns the result of a website check started with start_website_check: status per category and up to eight most important findings with explanation, or \"still running\". Only scans started through this connector within the last 24 hours can be fetched.",
      "requiresAuthentication": false
    },
    {
      "name": "vendor_profile",
      "title": "Vendor due-diligence profile (Lieferanten-Steckbrief)",
      "description": "Collects what frag.hugo publishes about a vendor for a due-diligence note: e-mail security of its domain, the GDPR review verdict if one exists, the subprocessor monitor entry, documented GDPR fines matched by company name, incidents published on fraghugo.de, and optionally a website check. It gives no overall grade and does not judge the vendor; each item carries its own source. Use the company name for better fine matching.",
      "requiresAuthentication": false
    },
    {
      "name": "my_privacy_deadlines",
      "title": "My open privacy deadlines (Fristen meiner Firma)",
      "description": "Lists the open data protection deadlines of the organisation connected to this frag.hugo account: data breaches with their 72-hour reporting deadline (Art. 33 GDPR), data subject requests with their one-month deadline (Art. 12(3) GDPR, incl. extensions) and records of processing or processor agreements waiting for review by the data protection officer. Returns type, deadline, status and an app link per entry — no descriptions, names or contact details. Requires a connected frag.hugo account. Not for deadlines of laws in general (use get_compliance_deadlines).",
      "requiresAuthentication": true
    },
    {
      "name": "report_data_breach",
      "title": "Report a data breach (Datenpanne, Art. 33 GDPR)",
      "description": "Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without `bestaetigung`): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.",
      "requiresAuthentication": true
    },
    {
      "name": "create_data_subject_request",
      "title": "Log a data subject request (Betroffenenanfrage, Art. 15–22 GDPR)",
      "description": "Logs a data subject request (access, erasure, rectification, restriction, portability, objection) in the connected frag.hugo account and calculates the one-month deadline of Art. 12(3) GDPR. Step 1 (without `bestaetigung`): preview with the deadline, the possible extension, a note on identity verification and a reply draft from the frag.hugo templates, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the request; the data protection officer on file is notified. It does not send anything to the requesting person. Use only for requests addressed to the user’s own organisation.",
      "requiresAuthentication": true
    },
    {
      "name": "plan_software_introduction",
      "title": "Introduce new software (VVT entry and DPA review)",
      "description": "Prepares the data protection paperwork for introducing a new software or cloud service in the connected frag.hugo account. Step 1 (without `bestaetigung`): preview with the frag.hugo GDPR test result for the service (if reviewed), the matching template for the record of processing activities (Verarbeitungsverzeichnis) and what will be created, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates a record of processing entry and a processor agreement (AVV) entry, both submitted for review by the data protection officer. It does not approve the software and does not contact the vendor.",
      "requiresAuthentication": true
    },
    {
      "name": "get_my_status",
      "title": "What's next (Ihr Weg)",
      "description": "Shows where the connected organisation stands in frag.hugo: the steps of its onboarding path \"Ihr Weg\" per area (data protection, team, website, AI, NIS2, ISMS, occupational safety, CRA) with status and app link, the one next step exactly as on the app start page, open tasks, open deadlines, entries waiting for review by the data protection officer (DSB), the onboarding questionnaire status (Bestandsaufnahme) and the booked areas. Usually the first call before filling anything in. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_company_profile",
      "title": "Company profile (Stammdaten)",
      "description": "Returns the master data of the connected organisation in frag.hugo: name, address, VAT ID, industry, number of employees, contact details, data protection officer details, EU representative, website, the responsible contact persons per area (Zuständigkeiten), the business profile (website, online sales to consumers, special categories of data, video surveillance), the competent data protection supervisory authority and which required details are still missing. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "search_templates",
      "title": "Search templates (Vorlagen)",
      "description": "Searches the template catalogues of frag.hugo — over 600 templates for records of processing (VVT), processors (AVV), TOMs, retention rules, DPIAs, policies and documents, training modules, safety instructions and phishing templates. Returns the same templates the app shows on its template pages and marks the ones the organisation already uses. Use it before creating entries, so they start from a reviewed template. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "list_entries",
      "title": "List entries (Einträge)",
      "description": "Lists the entries of one area of the connected organisation in frag.hugo — for example records of processing (VVT), processors (AVV), TOMs, privacy policies, retention rules, DPIAs, AI systems, tasks or documents — with title, status, DPO review status and last change. Use it to find an entry before reading it with get_entry. Paged (20 per page). Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_entry",
      "title": "Get entry details (Eintrag)",
      "description": "Returns one entry of the connected organisation in frag.hugo with all readable fields, the DPO review status, the comment of the data protection officer (if any), which required details are still missing and where files can be uploaded. Use list_entries first to find the ID. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "list_people",
      "title": "List employees (Mitarbeitende)",
      "description": "Lists the employees of the connected organisation in frag.hugo, as in the app's employee list: name, e-mail, department, invitation status (not invited, invited, active), language, open mandatory Hugo Learn trainings and open Hugo Safe safety briefings. Filter by department, status or a search text; paged. Use it before assigning trainings or inviting people. Never returns sign-in credentials. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_training_status",
      "title": "Training status (Schulungen und Unterweisungen)",
      "description": "Shows the training status of the connected organisation in frag.hugo: for Hugo Learn (security awareness trainings), Hugo Safe (occupational safety briefings, Unterweisungen) or the NIS2 management training — per module how many people it applies to, how many completed it, how many are overdue and the due date; optionally per person. Learn also returns the catalogue of modules that can be assigned. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_phishing_status",
      "title": "Phishing status (Phishing-Simulation)",
      "description": "Shows the phishing simulation of the connected organisation in frag.hugo: the Hugo Learn tier, whether a campaign can start and exactly what is still missing (sending domain, passed deliverability check within 90 days, at least 5 active recipients), the latest campaign waves with totals only (sent, clicked %, reported %) and the autopilot settings. Never returns results per person. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_onboarding_questions",
      "title": "Onboarding questionnaire (Bestandsaufnahme)",
      "description": "Returns the onboarding questionnaire (Bestandsaufnahme, initial audit) of the connected organisation in frag.hugo: its sections with progress, the questions that apply to this company (with type, options, help text, whether required, and the current answer), open follow-up questions from the data protection officer and uploaded files. By default only unanswered questions; filter by section letter. Answer with answer_onboarding_questions (pass `stand` to change an existing answer). Files are uploaded in the app (link included) or added as text with add_text_document. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "get_security_facts",
      "title": "Security facts (Sicherheitsprofil)",
      "description": "Lists the short, evidenced statements of the connected organisation's security profile in frag.hugo (Sicherheitsprofil): each with its source (e.g. TOMs, records of processing, certificates) and date, plus whether the profile page is published and its public link. Use it to answer supplier security questionnaires from facts already in frag.hugo. Read-only. Requires a connected frag.hugo account.",
      "requiresAuthentication": true
    },
    {
      "name": "save_task",
      "title": "Save task (Aufgabe)",
      "description": "Creates or changes a task (Aufgabe) in the task list of the connected organisation in frag.hugo: title, description, priority, status, due date, category and the responsible person. Use it when the user wants something on their to-do list or reports progress on a task (\"done\", \"in progress\"); pass id to change an existing task — only the fields you send are changed. Do not use it for the data protection documents themselves (those have their own tools). Assigning the task to someone else, or setting it to in_pruefung, emails that person: the call then returns a preview, and once the user agrees, the same call with bestaetigung carries it out. Every change is logged and can be undone for 90 days (undo_changes).",
      "requiresAuthentication": true
    },
    {
      "name": "update_company_profile",
      "title": "Update company profile (Stammdaten)",
      "description": "Changes the master data of the connected organisation in frag.hugo: name, address, VAT ID, industry, number of employees, website, contact details, data protection officer details, EU representative, the supervisory authority (only if chosen by hand), the responsible contact persons per area (Zuständigkeiten) and the four answers of the business profile (Betriebsprofil). Only the fields you send are changed; null clears a field. Use it when the user states company details; read them first with get_company_profile. Every change is logged and can be undone for 90 days (undo_changes). Requires the company administrator role in frag.hugo. Changing dsb_email takes two steps, because notifications go to that address: the first call returns a preview and a `bestaetigung` value and saves nothing; once the user agrees, send the same input with `bestaetigung`.",
      "requiresAuthentication": true
    },
    {
      "name": "save_processing_activity",
      "title": "Save processing activity (VVT-Eintrag)",
      "description": "Creates or changes one entry in the record of processing activities (Verarbeitungsverzeichnis, Art. 30 GDPR) of the connected organisation, like the entry form in the app: name, purpose, legal bases, data subjects, data categories, recipients, third-country transfer, retention period, measures, area, linked service providers. Optionally start from a template (vorlage_id from search_templates). To change an entry pass its id; only the fields you send change. If an entry with the same name or template exists, nothing is created and its ID is returned — change that one instead. Editing an entry the data protection officer had approved puts it back to draft. Logged and undoable for 90 days (undo_changes). Requires write access to the records of processing activities.",
      "requiresAuthentication": true
    },
    {
      "name": "import_from_templates",
      "title": "Import templates (Vorlagen übernehmen)",
      "description": "Adopts templates from the frag.hugo library into the organisation as draft entries, exactly like the template library in the app. Catalogues: vvt = records of processing activities (Verarbeitungsverzeichnis), avv = service providers (Auftragsverarbeiter), tom = technical and organisational measures (into the default TOM scope or tom_bereich_id), loeschkonzept = retention rules (Löschkonzept). Find the template IDs with search_templates (same katalog) first. Templates already adopted, or entries with the same name (TOMs: same title in the scope; retention rules: same type of data), are skipped and reported with their ID instead of being created twice. The answer lists which required details are still missing per entry. Every new entry is logged and can be undone for 90 days (undo_changes). Requires write access to the chosen catalogue in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_vendor",
      "title": "Save service provider (Auftragsverarbeiter/AVV)",
      "description": "Creates or changes one service provider that processes personal data on behalf of the organisation (Auftragsverarbeiter, Art. 28 GDPR), like the form \"Neuer Dienstleister\" in the app: name, website, kind of service, agreement status, link to the provider's agreement (DPA), third country, standard contractual clauses, last review (the next review is set one year later). Start from a template of search_templates katalog=avv to get the known details. To change an entry pass its id; only the fields you send change. If a provider with the same name or template exists, nothing is created and its ID is returned. Editing an entry the data protection officer had approved puts it back to draft. With vertrag_sichern the agreement behind the link is archived as PDF (repeating it for a web page stores another copy). Logged and undoable for 90 days (undo_changes). Requires write access to the service providers in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_toms",
      "title": "Save technical and organisational measures (TOMs)",
      "description": "Creates or changes technical and organisational measures (TOMs, Art. 32 GDPR) of the connected organisation, like the TOM page in the app: per measure title, control area, maturity, description, responsible person, evidence and review dates. Start from templates (vorlage_id from search_templates katalog=tom) or describe own measures. Measures belong to a TOM scope (e.g. a site); without bereich_id the default scope is used, with bereich a new scope is created. A measure with the same title in the same scope is not created twice. To change a measure pass its id; only the fields you send change. At most 50 measures per call. Logged and undoable for 90 days (undo_changes). Requires write access to the TOMs in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_privacy_policy",
      "title": "Save privacy policy (Datenschutzerklärung)",
      "description": "Creates a new version of the website privacy policy (Datenschutzerklärung) of the connected organisation with the generator of the app: the text is built from checked building blocks, not written by the assistant. Give the controller details, supervisory authority, hosting provider, the services used on the website (keys listed at dienste) and their options. Omitted details come from von_id (an earlier version) or from the company profile. Every call saves a new draft version (unless the latest version already has exactly this content); older versions stay unchanged. The answer lists missing required details — the app only exports a complete policy. To send it to the DPO use submit_for_review. Logged and undoable for 90 days (undo_changes). Requires write access to the privacy documents in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_retention_rules",
      "title": "Save retention rules (Löschkonzept)",
      "description": "Creates or changes rules of the deletion concept (Löschkonzept) of the connected organisation, like the form in the app: per type of data the retention period, legal basis, when the period starts, deletion method, responsible person and next deletion date. Start from templates (vorlage_id from search_templates katalog=loeschkonzept) or describe own rules. A rule with the same name and period is not created twice; the same name with a different period is reported and only created with trotzdem=true. To change a rule pass its id; only the fields you send change. At most 50 rules per call. Logged and undoable for 90 days (undo_changes). Requires write access to the deletion concept in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_dpia",
      "title": "Save DPIA (DSFA)",
      "description": "Creates or changes a data protection impact assessment (DPIA, Datenschutz-Folgenabschätzung, Art. 35 GDPR) of the connected organisation, like the DPIA wizard in the app: processing (purpose, data subjects, data categories, recipients), necessity, alternatives, legal basis and the risks with likelihood, impact, measures and residual risk (scales 1–4). Start from a template (vorlage_id, see search_templates katalog=dsfa), from a processing activity (vvt_id without template: name, purpose, data subjects, data categories, recipients incl. linked processors and legal basis are taken from it, like the app) or describe it yourself. Always saved as a draft; only drafts can be changed, and risiken replaces all risks. The DPO opinion is left to the DPO. To send it to the DPO use submit_for_review. Logged and undoable for 90 days (undo_changes). Requires the DPIA area in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "save_people",
      "title": "Save employees (Mitarbeitende, ohne Einladung)",
      "description": "Adds people to the employee list (Mitarbeitende) of the connected organisation in frag.hugo, or changes name, department, language or date of birth of existing ones (pass id from list_people). Sends NO e-mail — use invite_people afterwards to give them access. Use it when the user names colleagues or pastes a staff list. Existing e-mail addresses are reported as already there, not added twice. If the plan has fewer free seats than new people, nobody is added and the answer says how many seats are free. Every change can be undone for 90 days (undo_changes).",
      "requiresAuthentication": true
    },
    {
      "name": "invite_people",
      "title": "Invite employees (Mitarbeitende einladen)",
      "description": "Sends people from the employee list an e-mail invitation to frag.hugo, so they can do their data protection training or safety briefings. Use it after save_people, or when the user asks to (re-)invite colleagues. The first call returns a preview with every recipient; once the user agrees, the same call with bestaetigung carries it out. People who already use frag.hugo, are deactivated or have a user-name login are skipped and listed. With art nis2_gf the people are added to the NIS2 management training (only if booked; nobody is added if the seats are not enough). With art ohne_email_konten people get a login with user name and start password instead of an e-mail (new people via neue_konten, existing ones via personen_ids); passwords never appear in the answer — the answer links to the app, where the user prints them. E-mails cannot be taken back.",
      "requiresAuthentication": true
    },
    {
      "name": "assign_trainings",
      "title": "Assign trainings (Schulungen/Unterweisungen zuweisen)",
      "description": "Assigns Hugo Learn trainings or Hugo Safe safety briefings (Unterweisungen) in frag.hugo to everyone, to departments or to named people, with an optional due date; reminds people of open Learn trainings; or changes the due date of open safety briefings. Use it after save_people / invite_people, or when the user says who should do which training. Get module IDs from get_training_status or search_templates. Assigning and reminding sends e-mails: the first call returns a preview with the recipients; once the user agrees, the same call with bestaetigung carries it out. Changing a Safe due date sends no e-mail and runs at once. Modules your plan does not include are refused with the reason, as in the app.",
      "requiresAuthentication": true
    },
    {
      "name": "submit_for_review",
      "title": "Submit for review (zur Prüfung an den DSB)",
      "description": "Sends drafts to the data protection officer (Datenschutzbeauftragter) of the connected organisation for review — exactly like the button \"Zur Prüfung senden\" in the app: processing activities (vvt), processor agreements (avv), the privacy policy (dse), DPIAs (dsfa), TOM areas (tom) or the whole onboarding questionnaire (bestandsaufnahme — the preview lists missing required answers, unticked sections and open follow-up questions instead). The DPO is notified as with the button. Only drafts can be submitted; entries already under review or approved are skipped. Two steps: the first call returns a preview; once the user agrees, the same call with bestaetigung carries it out. Use it when the user says the entries are ready for the DPO.",
      "requiresAuthentication": true
    },
    {
      "name": "save_ai_system",
      "title": "Save AI system (KI-Register)",
      "description": "Creates or changes an entry in the AI register (KI-Register) of the connected organisation and classifies it under the EU AI Act like the classifier in the app: name, provider, purpose and the answers on prohibited practices (Art. 5), Annex III high-risk areas with the Art. 6(3) exceptions and transparency (Art. 50). The answer names the risk class, the role (deployer or provider), the reasons and the obligations with their legal reference. Optional: documentation fields (responsible person, oversight, informing employees) and a fundamental rights impact assessment (FRIA, Art. 27). Use it when the user wants to record or re-classify an AI tool; use list_entries bereich=ki_system to find existing entries. Unanswered classification questions keep their saved value. Logged and undoable for 90 days (undo_changes). Requires the AI register in frag.hugo (Hugo KI or DSB Pro/Premium).",
      "requiresAuthentication": true
    },
    {
      "name": "save_nis2",
      "title": "Save NIS2 assessment (NIS2-Betroffenheit)",
      "description": "Saves the NIS2 affectedness check (§ 28 BSIG) of the connected organisation like the check in the app: sector, employees, turnover, balance sheet total and special cases. The answer says whether the organisation is affected, as which entity class, why and with which legal reference. Optionally records the progress of the BSI registration (§ 33 BSIG): affectedness confirmed, sector, register number, contact point, completed steps and \"registered\" with date. Use it when the user wants to find out or document whether NIS2 applies, or tracks the BSI registration. Every check is saved as a new assessment, like in the app. Logged and undoable for 90 days (undo_changes). Requires NIS2 in frag.hugo (Hugo NIS2, ISMS or DSB Pro/Premium).",
      "requiresAuthentication": true
    },
    {
      "name": "save_cra_product",
      "title": "Save product (Hugo Hersteller/CRA)",
      "description": "Creates or changes a product with digital elements of the connected organisation for the Cyber Resilience Act (Hugo Hersteller), like the product pages in the app: name, kind, version, market date, support period, contact for vulnerability reports, product class, conformity assessment and CE marking. Use it when the user lists the software or devices they sell; use list_entries bereich=cra_produkt to find existing ones. A product with the same name is not created twice; when changing, only the fields you send change. Does not create vulnerability or incident reports — those run through the guided report in the app. Logged and undoable for 90 days (undo_changes). Requires Hugo Hersteller (CRA) in frag.hugo.",
      "requiresAuthentication": true
    },
    {
      "name": "create_document_from_template",
      "title": "Create document from template (Dokumentvorlage ausfüllen)",
      "description": "Fills in a document template of the connected organisation (policies, instructions, declarations such as a confidentiality undertaking) and saves it under Documents → My documents, exactly like \"fill in template\" in the app. Company data is pre-filled from the company profile; personal fields stay open and are filled per employee later. If required variables are missing, nothing is saved and the answer lists them — so they can be asked for and the call repeated. Find templates with search_templates katalog=dokument. To release the document to employees for acknowledgement or signature use send_document_to_employees. Logged and undoable for 90 days (undo_changes).",
      "requiresAuthentication": true
    },
    {
      "name": "send_document_to_employees",
      "title": "Send document to employees (Richtlinie zur Kenntnis)",
      "description": "Releases a document of the connected organisation (e.g. a policy created with create_document_from_template) to employees for acknowledgement or signature and e-mails them, like \"release to employees\" in the app. Two steps: the first call returns a preview with recipients and a `bestaetigung` value; once the user agrees, the same call with `bestaetigung` carries it out. Reminders run automatically (default after 7 and 14 days, and before the due date). The e-mails cannot be recalled; the release itself can be withdrawn in the app (Documents → Releases).",
      "requiresAuthentication": true
    },
    {
      "name": "add_text_document",
      "title": "Add text document (Dokument ablegen)",
      "description": "Saves a text (Markdown, up to 200,000 characters) as a .md file in the file storage (Dateiablage) of the connected organisation, like uploading a file in the app — e.g. meeting notes, an existing policy text or a list the user pasted. With ziel bestandsaufnahme the text goes to the documents of the onboarding questionnaire instead and is checked there like an upload. Binary files (PDF, Word, images) cannot be sent through the assistant: the user uploads them in the app (link in the answer). Logged and undoable for 90 days (undo_changes removes the entry).",
      "requiresAuthentication": true
    },
    {
      "name": "answer_onboarding_questions",
      "title": "Answer onboarding questions (Bestandsaufnahme)",
      "description": "Answers questions of the onboarding questionnaire (Bestandsaufnahme, initial audit) of the connected organisation in frag.hugo, exactly as the customer would in the app: up to 50 answers per call, optionally ticks sections as \"ausreichend beantwortet\" and answers follow-up questions of the data protection officer. Read the questions with get_onboarding_questions first and use their ids, answer shapes and `stand`. An answer someone changed in the meantime is never overwritten — it comes back as a conflict with the current value. Answers are logged and can be undone with undo_changes for 90 days while the questionnaire is not submitted; answers to follow-up questions go to the DPO immediately. Submitting is a separate step (submit_for_review art bestandsaufnahme).",
      "requiresAuthentication": true
    },
    {
      "name": "plan_phishing_campaign",
      "title": "Plan phishing campaign (Phishing-Simulation)",
      "description": "Plans or stops a phishing simulation wave, or sets up the autopilot (annual programme, Programm tier), for the connected organisation — like the campaign page in the app. Two steps: the first call returns a preview (who gets a practice e-mail, when, with which templates) and a `bestaetigung` value; once the user agrees, the same call with `bestaetigung` carries it out. If the organisation cannot send yet (sending domain, deliverability check, fewer than 5 recipients), the preview lists what is missing instead. Templates come from search_templates katalog=phishing (or save_phishing_template). Results per person are never available through the assistant. Requires Hugo Learn Standard.",
      "requiresAuthentication": true
    },
    {
      "name": "save_phishing_template",
      "title": "Save phishing template (eigene Übungsmail)",
      "description": "Saves an own practice phishing e-mail (template) of the connected organisation, like the template builder in the app; it can then be used in plan_phishing_campaign. Two steps: the first call returns the rendered e-mail with sample values and a `bestaetigung` value — it is meant to be shown to the user; once they agree, the same call with `bestaetigung` saves it. Own templates are approved immediately because the user has seen them. Sends no e-mail. Requires Hugo Learn Standard; QR codes and the fake login page need the Programm tier.",
      "requiresAuthentication": true
    },
    {
      "name": "save_security_fact",
      "title": "Add security fact (Sicherheitsprofil)",
      "description": "Adds a short, true statement to the security profile of the connected organisation in frag.hugo (Sicherheitsprofil), like \"Nachweis ergänzen\" in the app — e.g. \"All laptops are encrypted with BitLocker.\" Use it when a supplier questionnaire asks something frag.hugo does not know yet. The same `thema` replaces the earlier statement. Only statements that are actually true; the source is marked as added by hand. Remove it in the app if it was wrong.",
      "requiresAuthentication": true
    },
    {
      "name": "manage_website_monitoring",
      "title": "Website monitoring (Hugo Check)",
      "description": "Adds a website to the regular privacy check of the connected organisation in frag.hugo (Hugo Check monitoring) or switches it off, like on the monitoring page of the app. Adding respects the number of monitored websites included in the plan; removing switches monitoring off without deleting the scan history. Logged and undoable for 90 days (undo_changes).",
      "requiresAuthentication": true
    },
    {
      "name": "publish_security_profile",
      "title": "Publish security profile (Sicherheitsprofil veröffentlichen)",
      "description": "Publishes the security profile page of the connected organisation in frag.hugo (Sicherheitsprofil) or withdraws it, like the publish button in the app. Customers and auditors can then read the profile at a public address instead of sending questionnaires. Two steps: the first call returns a preview (address, visibility) and a `bestaetigung` value; once the user agrees, the same call with `bestaetigung` carries it out. Withdraw with veroeffentlichen=false.",
      "requiresAuthentication": true
    },
    {
      "name": "send_to_vendor",
      "title": "Send to vendor (Vertrag/Fragebogen an Dienstleister)",
      "description": "E-mails an external service provider from frag.hugo, like the app: with avv_online the prepared data processing agreement (AVV) goes to the provider for review and online signature; with lieferanten_fragebogen a supplier is invited to fill in the security questionnaire (supply chain). Two steps: the first call returns a preview with the recipient and a `bestaetigung` value; once the user agrees, the same call with `bestaetigung` carries it out. The e-mail cannot be recalled. The contract draft itself is prepared in the app.",
      "requiresAuthentication": true
    },
    {
      "name": "delete_entries",
      "title": "Delete entries (Einträge löschen)",
      "description": "Deletes entries of the connected organisation in frag.hugo — processing activities (vvt), processors (avv), TOMs, privacy policies, retention rules, DPIAs, AI systems, FRIAs, CRA products, tasks, responsibilities, monitored websites and the links between them — exactly like the delete button in the app. Use it only when the user clearly asks to delete something; to change an entry use its save_* tool instead. Two steps: the first call returns a preview of what is deleted (and what cannot come back); once the user agrees, the same call with bestaetigung carries it out. Deletions can be undone for 90 days with undo_changes. At most 50 entries per call and 200 per organisation and day.",
      "requiresAuthentication": true
    },
    {
      "name": "undo_changes",
      "title": "Undo changes (Rückgängig)",
      "description": "Takes back changes the assistant made in frag.hugo within the last 90 days: a created entry is removed, a changed entry gets its previous values back, a deleted entry comes back with the same id. Pass the aenderung_ids from earlier answers, or letzte_n for the last changes made through this connection. Sent emails, invitations and other actions cannot be taken back — the answer says so. If an entry was edited in the app since, it is left alone unless the user agrees to overwrite (erzwingen). Two steps: the first call returns a preview; once the user agrees, the same call with bestaetigung carries it out. The same list with an undo button is in the app under Settings → AI assistants.",
      "requiresAuthentication": true
    }
  ]
}