Skip to main content
Glama

Regulatory checks: what a policy covers

compliance_policy_register
Read-onlyIdempotent

Use this when a user asks which provisions of a regulation an evaluation actually checks and which it does not.

Shows which provisions are encoded and which are not: a pass on the encoded checks is not compliance with excluded provisions. Requires the compliance:read scope.

Input Schema

NameRequiredDescriptionDefault
idYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • removedInput schema / $schema
      Removed value: -"http://json-schema.org/draft-07/schema#"
    • removedInput schema / properties / id / description
      Removed value: -"Approved policy id from compliance_policies"
  2. First observed

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive behavior, but the description adds useful context beyond them: it requires the compliance:read scope and warns that a pass on encoded checks is not compliance with excluded provisions. It does not describe response shape or pagination, but those are less critical given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short paragraphs: the usage condition is front-loaded, followed by the key caveat and auth scope. There is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only lookup, the description covers purpose, an important limitation, and authorization scope. However, it leaves the only identifier undefined and does not say what the returned register contains beyond the general statement about encoded versus excluded provisions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the sole required uuid parameter 'id' is never explained in the description. An agent cannot tell from the definition whether this id identifies a policy, a regulation, or an evaluation, so the description adds essentially no parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific informational purpose: showing which regulation provisions an evaluation actually encodes and which it excludes, framed around a user question. It is distinguishable from evaluation siblings, though it never explicitly names the policy/register resource or what the lookup id represents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit when-to-use condition: when a user asks which provisions of a regulation an evaluation checks and which it does not. It does not name when to use a sibling such as compliance_evaluate or compliance_policy instead, nor does it state exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.