directory
Server Details
Search a directory of SOC 2 audit and compliance firms; read GRC migration guides. Read-only.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 3.9/5 across 5 of 5 tools scored.
Each tool has a clearly distinct purpose: get_firm retrieves a specific firm, get_introduction_path provides instructions for introductions, get_resource fetches a single resource, list_resources lists resources, and search_firms searches firms. No overlap.
All tool names follow a consistent verb_noun pattern using snake_case (get_firm, get_introduction_path, get_resource, list_resources, search_firms). No deviations.
Five tools is appropriate for a read-only directory server. Each tool covers a distinct operation, and the count is not excessive or insufficient.
The tool surface covers firm lookup/search, resource listing/retrieval, and introduction guidance. Missing a simple list all firms tool (only search is available), but this is a minor gap for a read-only directory.
Available Tools
5 toolsget_firmAInspect
Get one firm's public directory record by slug. Returns null for unknown or non-public (suppressed) firms.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | firm slug, e.g. "a-lign" |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden and discloses the key behavioral detail that unknown or suppressed firms return null. Additional context like auth requirements would improve it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence concisely states the purpose and behavioral note, with no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the description covers purpose, edge case behavior, and key constraint, though output structure is not mentioned (no output schema provided).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of the single parameter with a description and example. The tool description adds no extra parameter semantics beyond reinforcing the slug-based lookup.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a single firm's public directory record by slug, distinguishing it from sibling tools like search_firms that handle multiple results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus siblings like search_firms, but the description implies it is for retrieving a specific firm by slug.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_introduction_pathAInspect
Get the public directory URL and what an introduction to a firm requires. READ-ONLY: returns instructions only — it does not submit a request or create a lead.
| Name | Required | Description | Default |
|---|---|---|---|
| firm_slug | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Explicitly declares READ-ONLY and no side effects, but does not disclose behavior for invalid firm_slug or additional constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clear, front-loaded sentences with no extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose and safety, but omits return format or any details about the output; adequate for a simple tool but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description provides no information about the firm_slug parameter, which has 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Get' and resource 'public directory URL and what an introduction requires', distinguishing it from siblings like get_firm which return firm details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for retrieving introduction instructions, but does not explicitly compare to siblings or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_resourceAInspect
Get one guide, question page, or blog post by slug — its title, description, and content (blog body markdown, or the FAQ question/answer pairs for guides and question pages).
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It explains the output structure (title, description, content per resource type), but fails to mention error handling (e.g., missing slug), authentication requirements, or rate limits. This is minimally sufficient for a read-only tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the purpose and includes all critical details. No redundant or extraneous information; every part serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema, the description covers the main return fields. It could mention error behavior (e.g., 404 if slug not found) or auth prerequisites, but for a simple getter with clear output expectations, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the only parameter 'slug' is not described in the schema. The description adds context by stating the tool retrieves resources 'by slug', but does not explain what a slug is (e.g., URL format, required pattern). For a single required parameter, more detail would be beneficial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get), the resource objects (guide, question page, or blog post), the identifier (slug), and the returned fields (title, description, content). It distinguishes between different resource types and their content formats, leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when you need a specific resource by slug, but it does not explicitly exclude cases or compare to sibling tools (get_firm, get_introduction_path, list_resources, search_firms). No when-not-to-use guidance is provided, though the context is clear enough for a simple retrieval tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_resourcesAInspect
List GRC Migrate guides, question pages, and blog posts available to read (title, description, url, type). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states the tool is read-only, which is positive. However, with no annotations, it lacks disclosure on pagination, ordering, or whether all resources are returned. The behavioral transparency is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that conveys the essential purpose and scope without any unnecessary words. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description provides the main return fields (title, description, url, type), which is sufficient for basic understanding. Additional context like ordering or count is missing but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the description does not need to add meaning beyond the schema. The description correctly omits parameter details since none exist, earning a baseline of 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies that the tool lists GRC Migrate guides, question pages, and blog posts with their title, description, url, and type. It distinguishes from siblings like get_resource (single resource) and search_firms (firms vs resources).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for reading available resources but does not explicitly state when to use it over alternatives like get_resource or search_firms, nor does it provide usage restrictions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_firmsAInspect
Search the GRC Migrate directory of SOC 2 audit and compliance-readiness firms (facts compiled from public sources). Filter by framework, ecosystem, partner status, or category. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | e.g. "pen_test", "vciso_advisory" | |
| ecosystem | No | compliance platform ecosystem, e.g. "vanta" or "drata" | |
| framework | No | e.g. "SOC 2", "ISO 27001", "HIPAA" | |
| partner_status | No | only "listed" or "partner"; "suppressed" is never valid |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states 'Read-only,' which is a key behavioral trait, especially in the absence of annotations. It also mentions the data source. However, it does not disclose other behaviors like pagination, sorting, or result limits, which are relevant for a search tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two sentences that cover the core action, data source, filter options, and read-only nature. Every word adds value with no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 4 optional parameters and no output schema, the description adequately covers purpose, source, and safety (read-only). However, it lacks details on result format, ordering, or how to drill down (e.g., use get_firm for details). This leaves minor gaps in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, meaning each parameter already has a description. The tool's description reiterates the filter criteria without adding new semantics, examples, or constraints beyond what the schema provides. It neither enriches nor contradicts the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches a directory of SOC 2 audit and compliance-readiness firms and lists specific filter criteria. It distinguishes itself from siblings like get_firm (which likely retrieves a single firm) by focusing on listing/search behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for finding firms by framework, ecosystem, partner status, or category. However, it does not explicitly state when not to use this tool (e.g., when a single firm is needed, use get_firm) or provide explicit alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- Alicense-qualityDmaintenanceProvides read-only access to Microsoft 365 services including SharePoint, OneDrive, Outlook, Teams, and Calendar through the Microsoft Graph API, enabling users to search, browse, and retrieve content across their M365 suite.Last updated1MIT
- Alicense-qualityFmaintenanceProvides AI assistants with read-only access to Secureframe's compliance data, enabling querying of security controls, tests, users, vendors, and more across frameworks like SOC 2 and ISO 27001.Last updated8MIT
- AlicenseBqualityCmaintenanceEnables read-only search over a curated, provenance-preserving corpus of EVM smart-contract security knowledge, providing tools for retrieving audit findings, document context, and source information.Last updated5MIT
- Flicense-qualityCmaintenanceEnables AI assistants to inspect and audit Azure Landing Zones by inventorying resources, auditing tagging, evaluating policy compliance, and detecting infrastructure drift, all in read-only mode.Last updated