ISMS Directory
Server Details
Read-only search of a curated directory of ISO 27001, SOC 2 and compliance services.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP ยท MCP 2025-11-25
- URL
TDQS
Scored across 4 tools
Each tool serves a distinct purpose: check_if_listed for existence checks, get_service_details for deep dives, list_categories for taxonomy discovery, and search_services for catalog queries. The descriptions clearly delineate their boundaries, and the explicit cross-references (e.g., 'Use list_categories first') reduce confusion.
All tool names follow a consistent verb_noun pattern (e.g., check_if_listed, get_service_details, list_categories, search_services), making them predictable and easy to understand.
Four well-scoped tools perfectly fit the directory's purpose: check listing status, retrieve details, list categories, and search. No tool feels redundant or missing, and the count is neither too thin nor too heavy.
The tool set covers essential operations for a directory: checking existence, retrieving details, exploring categories, and searching. Combined with the mentioned free submission URL for unlisted companies, this provides a complete lifecycle for users, leaving no obvious gaps.
Available Tools
4 toolscheck_if_listedCheck if a company is listedARead-onlyIdempotentInspect
Check whether a company is listed in the ISMS Directory. Returns the listing when found, close matches otherwise, and the free submission URL when it is not listed.
| Name | Required | Description | Default |
|---|---|---|---|
| company_name | Yes | Company or product name to look up. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, non-open-world, so the safety profile is covered. The description adds genuine value beyond that by disclosing the three possible outcome branches (listing, close matches, submission URL), which matters since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, purpose front-loaded and the return branches compactly stated. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, read-only lookup with no output schema, the description covers the essential behavior: the three possible responses. Combined with annotations that cover safety, nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a single well-documented parameter ('Company or product name to look up'), so the baseline of 3 applies. The description adds no syntax, format, or disambiguation detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Check whether') and resource ('a company is listed in the ISMS Directory'), which cleanly separates it from the service/category-oriented siblings (get_service_details, list_categories, search_services). An agent can tell what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies the usage context (verify listing status of a company), but there is no explicit when-to-use, when-not-to-use, or mention of an alternative such as search_services that could also surface company data. Guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_service_detailsGet service detailsARead-onlyIdempotentInspect
Full public profile of one listed service (description, frameworks, regions, industries, client sizes, languages, website, directory page). Matches the name case-insensitively, then by partial name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Service or company name as listed, e.g. 'ISMS Copilot'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world). The description adds genuinely non-obvious behavior: case-insensitive name matching and partial-name fallback, which affects how the agent should call it. It does not say what happens on ambiguity or no match, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two well-front-loaded sentences: first the payload, then the matching rule. No filler and nothing repeated from the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-param read tool with full annotations, the description is nearly complete: it covers output fields and lookup semantics. It only omits failure behavior (no match, multiple partial matches), a minor gap given no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds matching semantics (case-insensitive, then partial) beyond the schema's 'service or company name as listed', which is real added meaning for the sole parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (get) and resource (full public profile of one listed service), and enumerates the returned fields so the agent knows exactly what this returns versus sibling search_services or check_if_listed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'one listed service' implies a single-record lookup versus the list-based search_services, but no explicit when-to-use or when-not-to-use statement, and no sibling is named as an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_categoriesList catalog tagsARead-onlyIdempotentInspect
List every tag used in one catalog dimension with the number of listed services carrying it. Use the returned tags as exact filter values for search_services.
| Name | Required | Description | Default |
|---|---|---|---|
| dimension | Yes | Which dimension to list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and closed-world, so safety is covered. The description adds genuine behavioral context beyond them: the return payload is tag names paired with per-tag service counts, which matters for interpreting results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The core action and return shape come first, with the consumer guidance second.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, but the description partially compensates by describing the returned structure. It does not mention ordering, counts scope, or pagination, which are minor gaps for a simple one-parameter enumeration tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'dimension' parameter has a full enum listing all five values, so the schema does the heavy lifting. The description only reinforces the notion of 'one catalog dimension' without adding format or default detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('every tag used in one catalog dimension'), plus the returned payload ('the number of listed services carrying it'). This is distinguishable from search_services, which consumes the tags rather than enumerating them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent forward: 'Use the returned tags as exact filter values for search_services.' That is a clear use-case link, but it gives no when-not guidance or prerequisites (e.g., whether a catalog must be selected first).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_servicesSearch compliance servicesARead-onlyIdempotentInspect
Search the ISMS Directory catalog of ISO 27001, SOC 2, GDPR, DORA, NIS 2 and other compliance service providers (consultants, auditors, platforms, training). Filters are exact tags; several frameworks are combined with AND. Use list_categories first if you are unsure of a tag. Results are sorted by name, not ranked. Same data as GET https://ismsdirectory.com/api/search.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | Natural-language query mapped to filters, e.g. 'ISO 27001 consultants in Germany with DORA'. Ignored for a dimension when that dimension's explicit filter is set. | |
| limit | No | Maximum results (1-50). | |
| regions | No | Coverage regions or countries, e.g. ['Germany']. | |
| frameworks | No | Framework tags, e.g. ['ISO 27001', 'DORA']. AND across values. | |
| service_types | No | Service types, e.g. ['Consulting', 'Audit', 'Platform']. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds non-obvious behavior beyond that: filters are exact tags, multi-framework queries combine with AND, and results are sorted by name rather than ranked relevance. Not revealing, but genuinely additive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with what is searched, then the tag semantics, the routing hint, and the sort guarantee. No filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an openWorldHint=false read tool with a fully documented schema and no output schema, the description covers purpose, filter semantics, result ordering, and a routing hint to list_categories. It omits any mention of result shape or how q maps to matched dimensions, but the essentials for correct invocation are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, and the description earns above baseline by clarifying that all filters are exact tag matches and that frameworks are AND-combined โ semantics that are only partially echoed in the schema. It does not add per-parameter detail for q/limit/regions/service_types beyond what the schema already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb + resource and domain: 'Search the ISMS Directory catalog of ISO 27001, SOC 2, GDPR, DORA, NIS 2 ... compliance service providers (consultants, auditors, platforms, training).' It also names the sibling list_categories and its role, so an agent can separate this from the lookup tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes tag discovery to list_categories ('Use list_categories first if you are unsure of a tag') and warns filters are exact tags, which is real usage guidance. It does not state when NOT to use this tool versus get_service_details or check_if_listed, so it stops short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
- First observed
check_if_listed - First observed
get_service_details - First observed
list_categories - First observed
search_services
Related MCP Connectors
Search a directory of SOC 2 audit and compliance firms; read GRC migration guides. Read-only.
Search a curated directory of AI tools and MCP servers for law firms. Read-only, free, no auth.
Read-only directory of vetted AI implementation agencies from the Ashton & Forge marketplace.
Manage compliance controls, policies, and audit readiness for SOC 2, HIPAA, ISO 27001 and more.
Related MCP Servers
- AlicenseAqualityCmaintenanceRead-only search of a sourced directory of broker MCP servers, trading APIs and market data tools.4CC BY-4.0
- AlicenseNot gradedqualityCmaintenanceProvides read-only tools to search customers, orders, and business documents across PostgreSQL, JSON CRM, and Markdown sources, with tenant isolation, PII masking, and auditable access.Apache 2.0
- AlicenseBqualityDmaintenanceEnables read-only search over a curated, provenance-preserving corpus of EVM smart-contract security knowledge, providing tools for retrieving audit findings, document context, and source information.5MIT

trustlistsofficial
AlicenseNot gradedqualityAmaintenanceEnables searching and browsing public vendor trust center records, looking up vendors by domain, and auditing project dependencies against vendor security documentation.Apache 2.0
Glama MCP Gateway
Add one secure layer between your agents and this server.