frag.hugo

de.fraghugo/frag.hugoVersion 1.0.0

GDPR platform: your assistant fills in VVT, TOMs, AVV and DSFA, your DSB reviews them.

Status

Responds270 msNov 14, 2026, 14:24 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:24 UTC
Latency: 270 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.fraghugo.de/mcpResponds270 msNov 14, 2026, 14:24 UTC

No sign-in

Claude Code

claude mcp add --transport http frag-hugo https://mcp.fraghugo.de/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: frag-hugo
Remote MCP server URL: https://mcp.fraghugo.de/mcp

Cursor

{
  "mcpServers": {
    "frag-hugo": {
      "url": "https://mcp.fraghugo.de/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"frag-hugo","type":"http","url":"https://mcp.fraghugo.de/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

14 tools

Tools of frag.hugo
	Description		Read-only	Idempotent	Open world
`check_email_security`Checks the public DNS records that protect a domain against e-mail spoofing: SPF, DKIM (common selectors), DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Returns an overall assessment, one finding per check and recommendations. Use it for a company domain, not for single mailboxes. Nothing is stored. Rate limited per connection.	Checks the public DNS records that protect a domain against e-mail spoofing: SPF, DKIM (common selectors), DMARC, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Returns an overall assessment, one finding per check and recommendations. Use it for a company domain, not for single mailboxes. Nothing is stored. Rate limited per connection.	No	Yes	Yes	Yes
`check_software_gdpr`Looks up whether frag.hugo has reviewed a software or cloud service for GDPR use in companies (contract partner, data processing agreement, subprocessors, data location, third-country transfer, AI training, certificates, admin controls, deletion, data subject rights). Returns the published verdict with evidence links, or, if the service has not been reviewed, the ten criteria to check yourself. It never estimates a verdict for unreviewed services.	Looks up whether frag.hugo has reviewed a software or cloud service for GDPR use in companies (contract partner, data processing agreement, subprocessors, data location, third-country transfer, AI training, certificates, admin controls, deletion, data subject rights). Returns the published verdict with evidence links, or, if the service has not been reviewed, the ten criteria to check yourself. It never estimates a verdict for unreviewed services.	No	Yes	Yes	No
`create_data_subject_request`Logs a data subject request (access, erasure, rectification, restriction, portability, objection) in the connected frag.hugo account and calculates the one-month deadline of Art. 12(3) GDPR. Step 1 (without `bestaetigung`): preview with the deadline, the possible extension, a note on identity verification and a reply draft from the frag.hugo templates, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the request; the data protection officer on file is notified. It does not send anything to the requesting person. Use only for requests addressed to the user’s own organisation.	Logs a data subject request (access, erasure, rectification, restriction, portability, objection) in the connected frag.hugo account and calculates the one-month deadline of Art. 12(3) GDPR. Step 1 (without `bestaetigung`): preview with the deadline, the possible extension, a note on identity verification and a reply draft from the frag.hugo templates, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the request; the data protection officer on file is notified. It does not send anything to the requesting person. Use only for requests addressed to the user’s own organisation.	Yes	No	Yes	No
`find_supervisory_authority`Finds the competent German data protection supervisory authority by federal state, postcode (PLZ) of the main establishment or authority ID, with competence, website, key figures from the latest activity report (with evidence links), focus topics and notes for SMEs. In Bavaria, public bodies are supervised by BayLfD, companies by BayLDA. If a postcode spans two states, it asks back. Not for authorities outside Germany.	Finds the competent German data protection supervisory authority by federal state, postcode (PLZ) of the main establishment or authority ID, with competence, website, key figures from the latest activity report (with evidence links), focus topics and notes for SMEs. In Bavaria, public bodies are supervised by BayLfD, companies by BayLDA. If a postcode spans two states, it asks back. Not for authorities outside Germany.	No	Yes	Yes	No
`get_compliance_deadlines`Lists dated compliance deadlines from the frag.hugo deadline calendar (GDPR, NIS2, AI Act, CRA, DORA, Data Act, accessibility act and more), each with legal provision, status, what to do and the official source. Without date filters it returns the next upcoming deadlines from today. Not for deadlines of an individual company (data breach, data subject request); those need an account.	Lists dated compliance deadlines from the frag.hugo deadline calendar (GDPR, NIS2, AI Act, CRA, DORA, Data Act, accessibility act and more), each with legal provision, status, what to do and the official source. Without date filters it returns the next upcoming deadlines from today. Not for deadlines of an individual company (data breach, data subject request); those need an account.	No	Yes	Yes	No
`get_cyber_threat_picture`Summarises how many organisations from Germany ransomware groups have named on their leak sites in the last 30 days or 12 months, by industry and group, with the frag.hugo monthly assessment and method. Counts are perpetrator claims from the RansomLook inventory (CIRCL, CC BY 4.0), not confirmed incidents. Not for looking up individual victims.	Summarises how many organisations from Germany ransomware groups have named on their leak sites in the last 30 days or 12 months, by industry and group, with the frag.hugo monthly assessment and method. Counts are perpetrator claims from the RansomLook inventory (CIRCL, CC BY 4.0), not confirmed incidents. Not for looking up individual victims.	No	Yes	Yes	No
`get_subprocessor_changes`Shows the subprocessor lists of 17 widely used cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce, HubSpot, Stripe and others) as monitored daily by frag.hugo: date of the last change, number of entries, names and links to the official list and the data processing agreement. Use it to check whether a provider changed its subprocessors since a given date. Not for providers outside these 17.	Shows the subprocessor lists of 17 widely used cloud providers (Microsoft 365, Google Workspace, AWS, Salesforce, HubSpot, Stripe and others) as monitored daily by frag.hugo: date of the last change, number of entries, names and links to the official list and the data processing agreement. Use it to check whether a provider changed its subprocessors since a given date. Not for providers outside these 17.	No	Yes	Yes	No
`get_website_check_result`Returns the result of a website check started with start_website_check: status per category and up to eight most important findings with explanation, or "still running". Only scans started through this connector within the last 24 hours can be fetched.	Returns the result of a website check started with start_website_check: status per category and up to eight most important findings with explanation, or "still running". Only scans started through this connector within the last 24 hours can be fetched.	No	Yes	Yes	Yes
`my_privacy_deadlines`Lists the open data protection deadlines of the organisation connected to this frag.hugo account: data breaches with their 72-hour reporting deadline (Art. 33 GDPR), data subject requests with their one-month deadline (Art. 12(3) GDPR, incl. extensions) and records of processing or processor agreements waiting for review by the data protection officer. Returns type, deadline, status and an app link per entry — no descriptions, names or contact details. Requires a connected frag.hugo account. Not for deadlines of laws in general (use get_compliance_deadlines).	Lists the open data protection deadlines of the organisation connected to this frag.hugo account: data breaches with their 72-hour reporting deadline (Art. 33 GDPR), data subject requests with their one-month deadline (Art. 12(3) GDPR, incl. extensions) and records of processing or processor agreements waiting for review by the data protection officer. Returns type, deadline, status and an app link per entry — no descriptions, names or contact details. Requires a connected frag.hugo account. Not for deadlines of laws in general (use get_compliance_deadlines).	No	Yes	Yes	No
`plan_software_introduction`Prepares the data protection paperwork for introducing a new software or cloud service in the connected frag.hugo account. Step 1 (without `bestaetigung`): preview with the frag.hugo GDPR test result for the service (if reviewed), the matching template for the record of processing activities (Verarbeitungsverzeichnis) and what will be created, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates a record of processing entry and a processor agreement (AVV) entry, both submitted for review by the data protection officer. It does not approve the software and does not contact the vendor.	Prepares the data protection paperwork for introducing a new software or cloud service in the connected frag.hugo account. Step 1 (without `bestaetigung`): preview with the frag.hugo GDPR test result for the service (if reviewed), the matching template for the record of processing activities (Verarbeitungsverzeichnis) and what will be created, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates a record of processing entry and a processor agreement (AVV) entry, both submitted for review by the data protection officer. It does not approve the software and does not contact the vendor.	Yes	No	Yes	No
`report_data_breach`Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without `bestaetigung`): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.	Records a personal data breach in the connected frag.hugo account and starts the 72-hour deadline of Art. 33 GDPR. Step 1 (without `bestaetigung`): returns a preview with the deadline, the competent supervisory authority of the organisation, missing mandatory details for that authority, a draft report in the order of the authority form and the reporting channel, plus a confirmation value valid for 15 minutes. Step 2 (same input plus `bestaetigung`): creates the breach as a draft in frag.hugo; the company admins and the data protection officer are notified. It does not submit anything to the authority and does not decide whether reporting is required. Use only when the user wants to record a breach of their own organisation.	Yes	No	Yes	No
`search_gdpr_fines`Searches the frag.hugo database of documented GDPR fines (Germany and Europe), each case with authority, amount, GDPR articles, a short summary and the official source. Use it for questions such as "which fines were imposed for Art. 32" or "fines against telecom companies in Germany". Not for legal advice in an individual case and not for fines under other laws. Results are sorted by date, newest first.	Searches the frag.hugo database of documented GDPR fines (Germany and Europe), each case with authority, amount, GDPR articles, a short summary and the official source. Use it for questions such as "which fines were imposed for Art. 32" or "fines against telecom companies in Germany". Not for legal advice in an individual case and not for fines under other laws. Results are sorted by date, newest first.	No	Yes	Yes	No
`start_website_check`Starts the free frag.hugo website check (Hugo Check) for a public URL: cookies and tracking before consent, consent banner, Google Fonts, privacy policy and imprint, TLS and security headers, e-mail records, accessibility and shop duties. Returns the result directly if it is ready within about 20 seconds, otherwise a scan_id for get_website_check_result. The same URL within one hour returns the same scan. Limited to 3 new checks per hour per connection. Not legal advice.	Starts the free frag.hugo website check (Hugo Check) for a public URL: cookies and tracking before consent, consent banner, Google Fonts, privacy policy and imprint, TLS and security headers, e-mail records, accessibility and shop duties. Returns the result directly if it is ready within about 20 seconds, otherwise a scan_id for get_website_check_result. The same URL within one hour returns the same scan. Limited to 3 new checks per hour per connection. Not legal advice.	No	No	Yes	Yes
`vendor_profile`Collects what frag.hugo publishes about a vendor for a due-diligence note: e-mail security of its domain, the GDPR review verdict if one exists, the subprocessor monitor entry, documented GDPR fines matched by company name, incidents published on fraghugo.de, and optionally a website check. It gives no overall grade and does not judge the vendor; each item carries its own source. Use the company name for better fine matching.	Collects what frag.hugo publishes about a vendor for a due-diligence note: e-mail security of its domain, the GDPR review verdict if one exists, the subprocessor monitor entry, documented GDPR fines matched by company name, incidents published on fraghugo.de, and optionally a website check. It gives no overall grade and does not judge the vendor; each item carries its own source. Use the company name for better fine matching.	No	No	Yes	Yes

Details

Registry status: Active
Published: Nov 8, 2026
Updated: Nov 8, 2026
Website: https://www.fraghugo.de/en/ai-assistant/⁠ (opens in a new tab)
Repository: https://github.com/Jens-KI-007/fraghugo-claude-plugin⁠ (opens in a new tab)
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing