← All skills
MCP Server

Rote MCP Server

The compliance skills are available as MCP tools. Connect any MCP-compatible client to run HIPAA gap analysis, BAA review, framework mapping, and more programmatically from Claude Code or any MCP-compatible agent environment.

View on GitHub Run a free Self-Check
You run it· free, Apache 2.0
Available Tools

MCP tool functions

assess_control()

Execute a single compliance control assessment using the Rote methodology.

Parameters
control_idstring: Framework control ID (e.g., 'CC1.1', '164.312(a)(1)')
evidence_textstring: Verbatim text from organizational documents
ReturnsStructured JSON with compliance status, reasoning, and risk impact
Example response 
{
  "control_id": "164.312(a)(1)",
  "status": "partial",
  "reasoning": "Access control policy exists but lacks emergency access procedures",
  "confidence": 0.78
}
extract_evidence()

Extract relevant evidence from a document you supply for a specific control.

Parameters
document_textstring: Verbatim text of the document, read from your own filesystem
control_descriptionstring: What evidence to look for
ReturnsVerbatim extracted evidence from the document
Example response 
{
  "evidence": "Section 4.2: All ePHI stored on company servers is encrypted using AES-256...",
  "source": "document-abc-123"
}
search_frameworks()

List or search supported compliance frameworks in the Rote knowledge base.

Parameters
querystring: Search term (e.g., 'HIPAA', 'SOC2', 'NIST')
typestring?: Optional framework type filter
ReturnsJSON list of matching frameworks with IDs and names
Example response 
[
  { "id": "hipaa-security", "name": "HIPAA Security Rule" },
  { "id": "hipaa-privacy", "name": "HIPAA Privacy Rule" }
]
check_baa_compliance()

Execute a clause-by-clause BAA analysis against HIPAA requirements.

Parameters
baa_textstring: Verbatim text of the business associate agreement to analyse
ReturnsStructured JSON of the BAA analysis results
Example response 
{
  "agreement": "vendor-xyz-baa.pdf",
  "overall_status": "deficient",
  "provisions_assessed": 9,
  "compliant": 5,
  "deficient": 3,
  "missing": 1
}
MCP Resources

Structured data access

Resources expose the reference data a skill carries with it: the frameworks and control specifications that travel inside the SKILL.md. They read from the server running on your machine. There is no Rote-side store, and no document you analyse leaves your environment.

compliance://frameworks/{framework_id}

Retrieve detailed specifications and control lists for a compliance framework

compliance://controls/{framework_id}/{control_code}

Retrieve detailed specification for a specific control within a framework

Work with the methodology

Run it against
your own documents.

The Self-Checks are the shorter way in: questions you answer in your browser that place your program on the maturity matrix. Free, no email gate, published at dangssolutions.com.

Run a free Self-Check How the practice runs them
Need it done, not explained

Need this done rather than explained? Dan Gonzalez runs Dang's Solutions, the practice that delivers it.

For healthtech teams