Skip to main content
Glama

MacTech CMMC / NIST 800-171

Generate POA&M entries for control gaps

generate_poam_entries
Read-onlyIdempotent

Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries, and - the part that decides whether the plan is usable - sort them by eligibility under 32 CFR 170.21. Most gaps CANNOT go on a CMMC Level 2 POA&M: the rule bars every requirement worth more than 1 point (excepting 3.13.11 when encryption is employed but not FIPS-validated), bars six named 1-point requirements outright, and permits no POA&M at all below a score of 88. Returns per-entry eligibility with the reason, the requirements that must close before the assessment, and the single 180-day closeout window. Call this when the user has assessment gaps and needs a remediation plan artifact.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
gapsYesThe unimplemented or partially implemented controls
conditionalStatusDateNoConditional CMMC Status Date (YYYY-MM-DD), if one exists. The 180-day closeout window runs from this date - NOT from the day the plan is written - so without it no deadline can be computed.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • addedInput schema / properties / conditionalStatusDate
      Added value: +{
      +  "description": "Conditional CMMC Status Date (YYYY-MM-DD), if one exists. The 180-day closeout window runs from this date - NOT from the day the plan is written - so without it no deadline can be computed.",
      +  "type": "string"
      +}
    • addedInput schema / properties / gaps / items / properties / partial
      Added value: +{
      +  "description": "Only meaningful for the two sliding-scale requirements. 3.13.11: encryption IS employed but is not FIPS-validated (3 points) - this is the single state the rule lets you carry on a POA&M. 3.5.3: MFA on privileged and remote access only (3 points) - still NOT eligible.",
      +  "type": "boolean"
      +}
  2. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it safe (readOnlyHint=true, idempotentHint=true, destructiveHint=false), so the description carries a lower burden. It nonetheless adds substantial behavioral detail beyond annotations: the bars (requirements worth more than 1 point, excepting 3.13.11), the six named 1-point exclusions, the below-88 score prohibition, and the return contents (per-entry eligibility with reason, requirements to close, single 180-day closeout window tied to conditionalStatusDate). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the verb and resource and every sentence carries substantive content (purpose, eligibility rules, exclusions, return values, when-to-call). It is slightly verbose — the parenthetical aside 'the part that decides whether the plan is usable' and 'the single 180-day closeout window' could be tightened — but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex regulatory tool with no output schema, the description covers the key operational facts: the eligibility rule, the score floor, what each entry returns, and the deadline mechanism. It does not address edge behavior (e.g., what happens when conditionalStatusDate is absent beyond the schema note, or how the score-88 threshold is obtained), but the essentials for correct invocation are present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The schema already explains the 180-day window origin and the partial flag semantics for 3.13.11 and 3.5.3. The description adds framing (gaps as 'unimplemented controls', closeout window in the return set) but mostly reinforces, rather than extends, what the schema already documents, so it does not rise above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Turn a list of unimplemented NIST SP 800-171 controls into structured Plan of Action & Milestones (POA&M) entries.' The distinctive eligibility-sorting behavior ('sort them by eligibility under 32 CFR 170.21') separates it from siblings like calculate_sprs_score, crosswalk_control, and lookup_control, none of which generate POA&M artifacts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The closing sentence gives an explicit trigger: 'Call this when the user has assessment gaps and needs a remediation plan artifact.' This is clear context for when to invoke. However, it does not name alternative siblings or state when NOT to use this tool (e.g., when only a score or control crosswalk is needed), so it stops one step short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources