Tool reference

Research — the core loop — All tiers (Free +)

• search — Full-text search across in-scope sources, routed by jurisdiction, framework, sector, or source. Needs at least one scope. On Premium+ it automatically fans out into case law, preparatory works, and agency guidance.
• get_provision — One article, verbatim, by (jurisdiction, law, article) or canonical_ref — with source URL, publisher, license.
• validate_citation — Check a citation resolves and is still in force — a deterministic, non-model check.
• list_coverage — What's live: by jurisdiction, by domain ("which jurisdictions for NIS2?"), or by region.
• get_changes — Recorded changes to tracked instruments — what moved and when.
• diff — Compare two versions of a tracked provision.
• batch_search — Several scoped searches in one call — one quota draw per contained search.
• describe_capabilities / get_my_capabilities — Your tier's live tool list, sources, quotas, and limits. The authoritative answer to "what can I call?"

Vulnerability intelligence — All tiers (Free +)

• search_cve / get_cve_details — CVE search and detail from the live-synced CVE/NVD engine.
• get_epss_score / check_kev_status / get_exploits — Exploit-prediction score, CISA KEV membership, and known exploits for a CVE.
• search_by_product — CVEs affecting a product/vendor.
• get_data_freshness — Per-feed last-sync timestamps for the live data — how fresh the answer is.

Served by the CVE intelligence engine (daily-synced NVD, KEV, EPSS feeds), so answers carry sync timestamps rather than a static corpus date.

Legal evidence layer — Premium +

• search_guidance — Agency guidance from regulators, standalone (the guidance slice of the premium fan-out).
• get_decision — One court decision plus its cross-references — the case-law analog of get_provision.

Case law and preparatory works have no standalone search tool — they arrive inside search's automatic premium fan-out.

Your documents — Premium + (read) · Team + (library)

• get_document_segments / resolve_document_segment — Read uploaded documents at paragraph level and round-trip doc:// citations with content hashes (Premium+).
• list_my_documents / register_document_init / register_document_finalize / delete_my_document — The document library: list, upload (presigned PUT), and delete (Team+).

See the Cite your documents guide for the full loop.

Your standards — Premium +

• list_org_standards / get_org_standard_clause / search_org_standards — Query your organization's own uploaded standards and clause library the same way you query law.

Different surface from the SIS ISO standards add-on (licensed ISO text served by Ansvar) — see the ISO standards add-on guide under Guides.

Workflows — Premium + · document plane Team +

• list_workflow_types / start_workflow / resume_workflow / list_workflows / cancel_workflow — Discover and manage structured workflow runs. Premium includes 5 runs/month on a system you describe (STRIDE, LINDDUN, TARA); Team runs 20/seat/month including document-grounded types.
• get_current_step / submit_response / get_progress — Drive a run: what's needed next, answer it, track it.
• generate_report / get_workflow_threats — The final deliverable and (threat workflows) the structured threat list.
• register_document / unregister_document / list_workflow_evidence / get_review_context — The document plane (Team+): bind uploaded documents to a run as evidence, list the evidence register, read a review gate's context.
• create_dfd / recommend_subagents — Threat-modeling specialists: validate and render a data-flow diagram; plan parallel sub-analyses for a phase.

Effective risk — Team +

• effective_risk / effective_risk_inline / effective_risk_inline_batch — Context-aware CVSS rescoring of a CVE against your asset configuration — persistent-context or inline, single or batch.
• simulate_control_investment — Rank hypothetical control investments by how much effective risk each would remove across your scored findings — an analysis, never a served score.
• list_scoring_contexts / list_scoring_policies — Enumerate the asset contexts and rule sets the scorer can apply.
• record_review_decision / export_vex — Finalize an exploitability disposition and serialize it as an OpenVEX document.

Audit ledger — Company

• get_receipt / list_receipts / verify_receipt — Tamper-proof receipts: each query generates a cryptographic record of what was asked, what was returned, and when.
• export_audit_package / decrypt_receipt — Offline-verifiable audit bundle export; receipts decrypt client-side with your tenant's KMS key.