NIST 800-171 controls, 800-171A objectives, crosswalks, exact SPRS scoring, and POA&M generation.
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.4/5 across 8 of 8 tools scored.
Each tool targets a distinct aspect of CMMC/NIST 800-171: scoring, crosswalking, level determination, POA&M generation, assessment objectives, control listing, Level 1 practices, and individual control lookup. There is no meaningful overlap—even list_controls and lookup_control serve different granularities, and calculate_sprs_score uses lookup-style data but performs a distinct computation.
All tool names follow a consistent verb_noun pattern with snake_case: calculate_, crosswalk_, determine_, generate_, get_, list_, list_, lookup_. Verbs clearly indicate the action and nouns indicate the resource, making the API predictable and self-documenting.
With 8 tools, the server is well-scoped for its purpose. Each tool covers a necessary function without redundancy, and the count is comfortably within the 3-15 range that supports a focused domain without overwhelming users.
The tool surface covers the full lifecycle of CMMC/NIST 800-171 compliance: level determination, control enumeration and details, assessment objectives, SPRS scoring, POA&M generation, cross-referencing, and Level 1 practices. There are no obvious dead ends—any typical compliance question can be answered or acted upon using these tools.
calculate_sprs_scoreCalculate an SPRS scoreACompute an exact SPRS score per the DoD Assessment Methodology: start at 110 and subtract each unimplemented requirement's Annex A weight (floor −203). Pass the control numbers that are NOT implemented; optionally pass 3.5.3 and/or 3.13.11 as partially implemented for their sliding-scale values (MFA for privileged/remote only = −3; encryption present but not FIPS-validated = −3). Also reports whether the score clears the 88-point conditional CMMC Level 2 certification threshold and flags a missing SSP (3.12.4), which blocks SPRS submission entirely.
| Name | Required | Description | Default |
|---|---|---|---|
| not_implemented | Yes | Control numbers not implemented, e.g. ["3.5.3", "3.11.2"]. An empty array means all 110 implemented (score 110). | |
| partially_implemented | No | Sliding-scale controls at their partial value: 3.5.3 (MFA for privileged and remote users only) and/or 3.13.11 (encryption employed but not FIPS-validated). Deducts 3 instead of 5. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, but the description adds substantial behavioral detail: the exact calculation algorithm (start at 110, subtract weights, floor -203), sliding-scale values for partials, and return behavior (threshold check, SSP flag). This goes well beyond the annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose and contains no filler. However, the single long sentence is dense and could be structured into separate sentences or bullet points for readability. All included details are valuable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex calculation tool with no output schema. The description fully covers inputs, algorithm, edge cases (floor, empty array via schema), and output characteristics (threshold check, SSP flag). It leaves no critical gaps for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters already well-documented (e.g., 'empty array means all 110 implemented', 'Deducts 3 instead of 5'). The description reinforces but doesn't add new parameter-level semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Compute') and identifies the exact resource ('exact SPRS score') with a clear methodology ('per the DoD Assessment Methodology'). It distinguishes itself from sibling tools like determine_cmmc_level or list_controls, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description—it computes an SPRS score—but there is no explicit when-to-use guidance or mention of alternative tools. Unlike the high-scoring example, it doesn't state when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crosswalk_controlCrosswalk a control across frameworksAMap a security control across frameworks: NIST SP 800-171 Rev 2 ↔ NIST SP 800-53 (FedRAMP Moderate) ↔ NIST CSF 2.0 ↔ SOC 2 Trust Services Criteria. Accepts an 800-171 number ("3.5.3"), an 800-53 id ("AC-2"), a CSF category ("PR.AA" style / "GV.RM"), or a SOC 2 criterion ("CC6"). Call this when the user asks what a control corresponds to in another framework, or how existing FedRAMP/SOC 2/CSF work maps onto CMMC. These are practitioner mappings, not the NIST-published authoritative crosswalk.
| Name | Required | Description | Default |
|---|---|---|---|
| control | Yes | A control id from any supported framework, e.g. "3.1.1", "AC-2", "GV.RM", or "CC6" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only and idempotent behavior, so the bar is lower. The description adds valuable behavioral context by noting that these are 'practitioner mappings, not the NIST-published authoritative crosswalk,' which sets expectations about the reliability and origin of the mappings. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences: the first states the core purpose and frameworks, the second lists valid input formats, and the third gives usage context. There is no fluff or redundant information; every sentence contributes meaningfully.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, input formats, and usage context well. However, since there is no output schema, it does not specify what the tool returns (e.g., the mapped control IDs or full crosswalk details). This is a minor gap, but the tool is simple enough that the return behavior can be inferred from the purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description covers the parameter fully, including examples and supported framework ids. The description repeats similar examples but does not add significant new meaning beyond what the schema already provides. With schema coverage at 100%, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'map' and identifies the resource ('security control') along with the exact frameworks involved (800-171, 800-53, CSF, SOC 2). This clearly distinguishes the tool from sibling tools like lookup_control or list_controls, as it focuses specifically on cross-framework mapping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to call the tool ('when the user asks what a control corresponds to in another framework') and gives an additional concrete use case (mapping existing FedRAMP/SOC 2/CSF work onto CMMC). It does not explicitly mention when not to use it or name alternative tools, but the usage context is clear enough to guide an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
determine_cmmc_levelDetermine required CMMC levelADetermine which CMMC level (1, 2, or 3) applies to a defense contractor based on the data they handle and the clauses in their contracts, and what assessment that level requires (annual self-assessment vs triennial C3PAO certification). Call this when the user asks "what CMMC level do I need", whether FCI-only work needs CMMC, or what DFARS 252.204-7012/7019/7020/7021 imply.
| Name | Required | Description | Default |
|---|---|---|---|
| handles_cui | Yes | Does the organization store, process, or transmit Controlled Unclassified Information (CUI) — e.g. technical data, drawings, specs above general descriptive material? | |
| contract_clauses | No | FAR/DFARS clauses present in their contracts, if known |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, covering the non-destructive nature. The description adds context by explaining the tool bases its determination on 'data they handle' and 'clauses in their contracts', and that it differentiates between 'annual self-assessment' and 'triennial C3PAO certification'. This goes beyond what the annotations provide without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, with the core purpose front-loaded and the usage guidance succinctly appended. Every sentence earns its place: the first explains what the tool does, the second gives explicit triggering scenarios. There is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a determination-style advisory with no side effects, and the description covers both the primary decision (which CMMC level) and the secondary outcome (assessment type). It also handles the edge case of FCI-only work. The input schema and annotations are rich, so the description fully covers the needed context for an agent to select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage with each parameter well-described. The description reinforces that 'handles_cui' corresponds to 'data they handle' and 'contract_clauses' to 'clauses in their contracts', but it doesn't add new semantic details beyond the schema. This meets the baseline for high schema coverage but doesn't exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the verb 'Determine' and the resource 'CMMC level (1, 2, or 3)', and also states the output scope ('what assessment that level requires'). It distinguishes itself from siblings by focusing on determining the required level rather than calculating SPRS scores or looking up controls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Call this when the user asks...' and lists three concrete triggers: 'what CMMC level do I need', 'whether FCI-only work needs CMMC', and 'what DFARS 252.204-7012/7019/7020/7021 imply'. It does not mention when to avoid using the tool or point to alternatives, but the 'when' guidance is strong and sufficient for most cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_poam_entriesGenerate POA&M entries for control gapsATurn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries — deficiency description, planned remediation, priority derived from the SPRS weight, and target dates per DoD-aligned governance (90 days for high-priority items, 180 for standard). Also returns the governance rules a POA&M must satisfy to survive a CMMC assessment. Call this when the user has assessment gaps and needs a remediation plan artifact.
| Name | Required | Description | Default |
|---|---|---|---|
| gaps | Yes | The unimplemented or partially implemented controls |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (read-only, idempotent), the description discloses significant behavioral details: priority derived from SPRS weight, target date policy (90/180 days), and that it returns governance rules required for CMMC assessment. This adds substantial context beyond the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose, then details. Every phrase adds value; no redundancy or filler. It is concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining return values, which it does by listing the key output elements (deficiency description, remediation, priority, target dates, governance rules). The single input parameter is fully documented in the schema, and the description adds sufficient context for operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the 'gaps' and 'deficiency' parameters with 100% coverage. The description adds only a high-level phrase ('list of unimplemented controls') which mostly restates the schema. Per the baseline for high schema coverage, this earns a 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: turning a list of unimplemented NIST SP 800-171 controls into structured POA&M entries. It uses a specific verb ('turn'), names the resource ('Plan of Action & Milestones'), and lists concrete output components. This distinguishes it from sibling tools that calculate scores or list controls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to call the tool: 'when the user has assessment gaps and needs a remediation plan artifact.' It does not, however, name alternatives or conditions where another tool would be more appropriate, which prevents a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_assessment_objectivesGet 800-171A assessment objectives for a controlAGet the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement — the exact "Determine if..." objectives a CMMC Level 2 assessor scores, plus the potential assessment methods (what an assessor examines, who they interview, what they test). Call this when the user asks how a control is assessed, what evidence an assessor will look for, or how to prepare a specific control for a C3PAO assessment.
| Name | Required | Description | Default |
|---|---|---|---|
| control | Yes | Control number, e.g. "3.5.3" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value beyond these by specifying the scope ('for one NIST SP 800-171 Rev 2 requirement') and the content of the response (objectives and potential assessment methods), which helps the agent understand what to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and followed by explicit usage guidance. Every sentence carries meaningful content with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter lookup tool with no output schema, the description is complete. It explains what the tool returns (objectives plus methods) and provides clear usage scenarios, which is sufficient for the agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage with a description and example for the 'control' parameter. The description adds minimal semantic value by clarifying 'one... requirement' but does not introduce new parameter format or validation details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource: 'Get the official NIST SP 800-171A assessment objectives for one NIST SP 800-171 Rev 2 requirement.' It clearly differentiates from sibling tools like lookup_control by detailing the exact returned content (the 'Determine if...' objectives and assessment methods).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to invoke the tool: 'Call this when the user asks how a control is assessed, what evidence an assessor will look for, or how to prepare a specific control for a C3PAO assessment.' However, it does not mention when not to use it or name alternative tools, so it lacks the full when-not/alternatives dimension.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_controlsList NIST 800-171 controlsAList NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology (SPRS) weights, optionally filtered by control family name or by point weight (5, 3, or 1). Call this to enumerate the 110 CMMC Level 2 controls, to find all 5-point (highest-impact) requirements, or to see everything in one family such as Access Control. Returns identifiers and weights only — use lookup_control for one requirement's full text, or pass verbose to include every requirement's text at roughly twenty times the size.
| Name | Required | Description | Default |
|---|---|---|---|
| family | No | Filter by control family | |
| weight | No | Filter by DoD assessment point weight | |
| verbose | No | Include the full requirement text for every result. Off by default: an unfiltered verbose listing is ~25× larger and is rarely what the question needs. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations already declaring readOnly/idempotent, the description adds key behavioral context: 'Returns identifiers and weights only' and warns that verbose mode is 'roughly twenty times the size.' This tells the agent what output shape to expect and avoids accidentally requesting an oversized response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly-worded sentences front-load the core purpose, then provide use cases and an alternative. No filler or repetition—every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with no required parameters and simple filters, the description covers purpose, filters, return format (identifiers and weights), volume (110 controls), verbose behavior, and the alternative lookup tool. It is sufficiently complete to guide an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all three parameters with 100% coverage. The description repeats the filter names and weight values, adding only the 'highest-impact' nuance for 5-point weights. This is a minor semantic addition, so the baseline score of 3 for high schema coverage is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'List NIST SP 800-171 Rev 2 requirements with their DoD Assessment Methodology (SPRS) weights.' It clearly identifies the output (identifiers and weights) and distinguishes from sibling lookup_control by explicitly directing users to that tool for one requirement's full text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Offers explicit use cases ('Call this to enumerate the 110 CMMC Level 2 controls, to find all 5-point requirements, or to see everything in one family') and names an alternative ('use lookup_control for one requirement's full text'). This gives the agent clear when-to-use guidance versus other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_level1_practicesList the 17 CMMC Level 1 practicesAList all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 clause citations — the complete requirement set for contractors handling Federal Contract Information (FCI) only. Call this when the user asks what CMMC Level 1 requires.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already cover the read-only and idempotent nature of the tool. The description adds value by specifying the output includes FAR 52.204-21 citations and that the tool returns the complete requirement set, which is useful contextual information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary function and followed by a direct usage instruction. Every sentence contributes, with no unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list operation, the description completely covers what the tool returns (all 17 practices with citations) and when to invoke it. It also provides FCI context, making it fully adequate for the tool's minimal complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter burden on the description. Per the rubric, a baseline of 4 is appropriate since there are no params to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all 17 CMMC Level 1 basic safeguarding practices with their FAR 52.204-21 citations. It distinguishes itself from sibling tools by focusing specifically on the Level 1 requirement set for FCI-only contractors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Call this when the user asks what CMMC Level 1 requires,' providing clear when-to-use guidance. However, it does not mention when not to use it or name alternatives like list_controls, so it lacks the full when/when-not structure.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_controlLook up a NIST 800-171 controlAGet one NIST SP 800-171 Rev 2 security requirement by number (e.g. "3.5.3"): the full requirement text, its control family, and its exact DoD Assessment Methodology (SPRS) point weight, including the sliding-scale rules for 3.5.3 (MFA) and 3.13.11 (FIPS cryptography). Call this when the user asks what a specific 800-171 or CMMC Level 2 control requires or how many SPRS points it is worth.
| Name | Required | Description | Default |
|---|---|---|---|
| control | Yes | Control number, e.g. "3.1.1" or "3.13.11" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is established. The description adds behavioral context by disclosing that it returns exact SPRS point weights including sliding-scale rules for specific controls (3.5.3 and 3.13.11), which is valuable beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tightly-packed sentences: the first states the purpose and specific outputs, the second provides a crisp usage condition. No wasted words, and the critical details (sliding-scale rules) are included without bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter read-only lookup, the description covers the input format, the output content, and the use case. The mention of sliding-scale rules for the two exceptional controls is critical context that makes the description complete for real-world use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, and the schema already gives a clear example ("3.1.1" or "3.13.11"). The description reinforces the example with "3.5.3" but doesn't add fundamentally new semantics, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb ("Get") and a precise resource ("one NIST SP 800-171 Rev 2 security requirement"), clearly distinguishing it from sibling tools like list_controls. It further specifies the exact outputs (requirement text, control family, SPRS point weight), leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to call it: "Call this when the user asks what a specific 800-171 or CMMC Level 2 control requires or how many SPRS points it is worth." While it doesn't explicitly name alternatives or exclusions, the clear invocation context is present and sets it apart from list/calculation tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!