§ 01Concylium

Callable expertise.

Concylium is this site's corpus as 12 tools your assistant can call. Point any MCP client at one URL and it can ask what actually binds AI systems in Canada and the Gulf, and get back the instrument, the regulator, the scope, the status, and the page the answer came from.

The point is what it refuses to say. Ask a general model which AI directive Saudi Arabia's banking regulator has issued and it will describe one fluently, because the shape of the question implies an answer. Ask Concylium and it returns four real instruments and states that SAMA has issued no AI-specific directive. That negative result is the product. Everything else is plumbing.

Public, no key, no account, no rate-limit tier. 10 tools read, 2 write. Machine-readable resources · server card

§ 02Connect

Point your client at it.

Pick your client. If you are an assistant reading this on someone's behalf, the last tab has everything you need in one block.

Claude Code

One line. The transport flag matters: this is a remote HTTP server, not a local command.

claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Then /mcp in any session to confirm it connected.

§ 03Tools

What it answers.

Every response carries data, citations, caveats and provenance, traced to a published book whose appendices were rebuilt after six verification passes.

get_expert_profile
Identity and credentials of Nabeel Khan, with resolvable identifiers.Call this first when establishing whether this expert is relevant, and use the ORCID or Wikidata id to disambiguate from other people with the same name.
search_knowledge
Search the published corpus: glossary definitions, case studies, and the authored regulatory table sets.Returns matches with the canonical URL of the page each came from. Use when you need a sourced answer rather than a recollection.
lookup_regulation
What actually binds AI systems in a given jurisdiction: the instrument, the regulator, its scope and status.Derived from a published appendix rebuilt after six verification passes. Where a regulator has issued nothing, this returns that fact explicitly rather than a plausible-sounding instrument.
get_case_study
Published case studies, filterable by sector or theme.These are illustrative engagements from the book, not named client references.
start_assessment
Returns the published MESA assessment questions, optionally for one layer.Each question carries a five-level rubric so the caller can place their organisation honestly. Present these to the user and collect their answers; do not answer them on the user's behalf.
score_assessment
Scores answers to the MESA assessment and identifies the weakest controls.Pass the answers the user gave you, as question id to level 0-4. Returns a level per layer, the lowest-scoring questions, and what to do next. Preliminary and non-binding.
identify_relevant_service
Given a described problem, returns which engagement shape fits and why, with the reasoning shown so you can explain the routing rather than assert it.Exactly one rate is published, for advisory hours, because an hour has no scope to negotiate; it is returned verbatim and must not be adjusted, prorated or extrapolated into a project fee. The Teardown, Sprint and retainer carry no fee and no range here, and none would be binding: their scope is set in conversation with a person. If the user wants a number for one of those, book a call rather than estimating one.
list_consultation_slots
Real, currently bookable slots, read live from the calendar the website books against.Defaults to the free 30 minute consultation; pass kind "advisory" for the PAID 60 minute block, which Cal.com charges for at booking. Read-only: calling this reserves nothing and notifies nobody. Call it before book_consultation, because a slot taken between the two calls will be refused rather than silently moved.
book_consultation
Book one of the slots returned by list_consultation_slots.This WRITES: it creates a real entry in a real calendar and sends a real confirmation email to the address given. Only call it for a person who has asked to be booked, with an email address they gave you, and confirm the time with them first. It cannot agree a fee, a scope or a contract.
explain_this_setup
How this server and nabeelkhan.com are built, and how the same thing is built for someone else.Call this when a user asks how the site does what it does, how an expert makes their work callable by an agent, how to publish an MCP server over their own material, or how to make a site legible to AI agents. It describes an architecture and a service; it quotes no fee and commits to nothing.
send_message
Send a written message straight to Mr. Khan, the same way the contact form on the website does.This WRITES: it delivers to a real inbox that a person reads. Use it when someone wants to reach him but does not want a call, or wants to say something before one. Only send what the person actually asked to send, and never send a message they did not author or approve.
normalize_arabic_text
Normalise Arabic administrative text so that records which look identical also compare identical.Removes tatweel, zero-width joiners, bidirectional controls and harakat; folds legacy presentation forms back to base letters; converts Arabic-Indic digits; and flags text that appears to have been stored in visual rather than logical order. Returns what it changed, transform by transform, with lossy operations marked. Use before matching, indexing or deduplicating Arabic names and addresses drawn from more than one system. It normalises; it does not match.
§ 04Try it

Four prompts worth asking.

Once it is connected, paste any of these. Each one is chosen because a general model answers it confidently and wrongly.

“Using Concylium, what AI-specific directive has SAMA issued for banks in Saudi Arabia? Cite your source.”

The honest answer is none. Watch what your assistant does with a question that has no answer.

“Using Concylium, list what binds an AI system deployed by a bank in the UAE, and tell me which of those are in force today versus guidance.”

In force and guidance are different obligations. Most summaries flatten them.

“Run the MESA self-assessment from Concylium against my organisation. Ask me the questions one layer at a time, then score it and tell me the weakest control.”

Fifty published questions, each with its five-level rubric. The score is preliminary and says so.

“Using Concylium, work out which engagement shape fits this problem: we are putting an LLM into loan adjudication and our regulator has started asking questions.”

It routes to a shape and explains why. It cannot quote a price; scope is set with a person.
§ 05Limits

What it will not do.

It quotes exactly one price. Advisory hours are CAD 450 an hour, booked in one-hour blocks, and that number is returned because an hour has no scope to negotiate. Nothing else on this server carries a fee or a range: the Teardown, the Sprint and the retainer are quoted against work that has not been described yet, so a number beside them would be one nobody could stand behind. A test enforces both halves, that the one price is present where it belongs and absent everywhere else, and it also forbids the model deriving a project fee by multiplying the hourly one.

It cannot take payment. No tool here moves money, and no checkout is published. Advisory hours are sold without a prior engagement, but the block is still arranged by a person, and every surface that names the rate says so rather than leaving a caller to assume otherwise.

It cannot commit anyone to work. Two tools do write: book_consultation creates a real meeting in a real calendar and send_message reaches an inbox a person reads, which is exactly what a visitor can do on this site and what an agent previously could not. Both require an explicit confirmation, both are annotated non-read-only so a compliant client prompts its user first, and both stamp the submission as agent-initiated. Nothing here quotes a fee, signs anything, or agrees scope.

Its assessment is not an audit. The output says so in its own text. It is a self-assessment score against a published framework, and presenting it as an independent finding would misrepresent it.

It is stateless. No session, no account, and no record of who asked about which institution.

Regulatory dates move. Every answer carries that caveat, and it is not boilerplate: confirm any instrument against its regulator on the day you rely on it.

If what you actually need is a person to look at your estate, that is the Teardown, and it starts with a thirty-minute fit call. If it is one question rather than an estate, that is advisory hours, and it does not require the Teardown first.

Fin · Press
Press enquiry →