MacTech CMMC / NIST 800-171

Generate POA&M entries for control gaps

generate_poam_entries

Read-onlyIdempotent

Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries - deficiency description, planned remediation, priority derived from the SPRS weight, and target dates per DoD-aligned governance (90 days for high-priority items, 180 for standard). Also returns the governance rules a POA&M must satisfy to survive a CMMC assessment. Call this when the user has assessment gaps and needs a remediation plan artifact.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`gaps`	Yes	The unimplemented or partially implemented controls

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description is fully consistent with them, adding no contradiction. It adds rich behavioral context: priority derived from SPRS weight, 90/180-day target dates, and the fact that it also returns CMMC assessment governance rules.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exactly two sentences, front-loaded with the primary function and then key output details. Every sentence earns its place with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has a single parameter and no output schema, so the description needs to cover inputs, outputs, and key behavioral rules. It does so thoroughly: inputs (list of controls), outputs (structured entries and governance rules), and specific policy details (90/180 days, CMMC survival rules).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the single 'gaps' parameter with full descriptions and examples (e.g. control '3.5.3'), covering 100% of parameters. The description does not add any new parameter-level detail beyond what the schema provides, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb phrase 'Turn ... into structured POA&M entries' and identifies both the input (unimplemented NIST SP 800-171 controls) and output (structured entries plus governance rules). It is clearly distinct from sibling tools like calculate_sprs_score or determine_cmmc_level.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to call: 'Call this when the user has assessment gaps and needs a remediation plan artifact.' It does not mention when not to use it or name alternative tools, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All MacTech CMMC / NIST 800-171 tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0

Disambiguation5/5

Each tool targets a distinct aspect of CMMC/NIST 800-171: scoring, crosswalking, level determination, POA&M generation, assessment objectives, control listing, Level 1 practices, and individual control lookup. There is no meaningful overlap—even list_controls and lookup_control serve different granularities, and calculate_sprs_score uses lookup-style data but performs a distinct computation.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern with snake_case: calculate_, crosswalk_, determine_, generate_, get_, list_, list_, lookup_. Verbs clearly indicate the action and nouns indicate the resource, making the API predictable and self-documenting.

Tool Count5/5

With 8 tools, the server is well-scoped for its purpose. Each tool covers a necessary function without redundancy, and the count is comfortably within the 3-15 range that supports a focused domain without overwhelming users.

Completeness5/5

The tool surface covers the full lifecycle of CMMC/NIST 800-171 compliance: level determination, control enumeration and details, assessment objectives, SPRS scoring, POA&M generation, cross-referencing, and Level 1 practices. There are no obvious dead ends—any typical compliance question can be answered or acted upon using these tools.

Resources

Need Help?