Skip to main content
Glama

MacTech CMMC / NIST 800-171

Look up a FAR/DFARS cybersecurity clause

lookup_clause
Read-onlyIdempotent

Explain what a FAR or DFARS cybersecurity clause obliges a contractor to do: what triggers it, the concrete duties, the reporting deadlines, what it flows down to subcontractors, and which other clauses come with it. Covers 52.204-21, 252.204-7008, 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021, 252.239-7010. Call this when someone asks "my contract has 7012 in it, what do I have to do", which clauses require CMMC, what flows down to a subcontractor, or how long they have to report an incident. Does NOT reproduce clause text verbatim - the text is law, it gets amended, and quoting a stale copy into a contract dispute is worse than a citation; each answer links the authoritative text at acquisition.gov.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
clauseNoClause number - "7012", "252.204-7012", or "DFARS 252.204-7012" all work. Omit to list every clause covered.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds valuable behavioral context: it returns explanations and links to authoritative text rather than verbatim quotes, and explains why (law gets amended, stale quotes in disputes are harmful). This goes beyond the annotations and helps the agent set proper user expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose and then structured into coverage, use cases, and limitations. It's longer than average, but every sentence carries meaningful information—the clause list, call triggers, and the critical caveat about not quoting verbatim. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description must convey what the tool returns, and it does: a plain-language explanation of duties, triggers, deadlines, flowdown, related clauses, and links to authoritative text. It also lists all covered clauses and explains the non-verbatim behavior. No important aspect is missing for a lookup tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers the 'clause' parameter 100% with format examples and the omission behavior. The description adds the full list of supported clause numbers (52.204-21, etc.), which is not in the schema and gives the agent concrete valid values. This extra information elevates the score above the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Explain') and a clear resource ('a FAR/DFARS cybersecurity clause'), then enumerates exactly what aspects are covered: triggers, duties, deadlines, flowdown, and related clauses. It lists the specific clause numbers, which distinguishes it from siblings like lookup_control (which handles individual controls) and lookup_rev3_requirement (which likely targets revision requirements).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Call this when...' and provides concrete example queries ('my contract has 7012 in it...') and topics (CMMC requirements, flowdown, incident reporting). It also states what the tool does NOT do (reproduce verbatim text) and why, giving the agent clear boundaries. While it doesn't name alternative tools, the exclusions and use cases are sufficiently explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool targets a distinct aspect of CMMC/NIST 800-171: scoring, crosswalking, level determination, POA&M generation, assessment objectives, control listing, Level 1 practices, and individual control lookup. There is no meaningful overlap—even list_controls and lookup_control serve different granularities, and calculate_sprs_score uses lookup-style data but performs a distinct computation.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern with snake_case: calculate_, crosswalk_, determine_, generate_, get_, list_, list_, lookup_. Verbs clearly indicate the action and nouns indicate the resource, making the API predictable and self-documenting.

Tool Count5/5

With 8 tools, the server is well-scoped for its purpose. Each tool covers a necessary function without redundancy, and the count is comfortably within the 3-15 range that supports a focused domain without overwhelming users.

Completeness5/5

The tool surface covers the full lifecycle of CMMC/NIST 800-171 compliance: level determination, control enumeration and details, assessment objectives, SPRS scoring, POA&M generation, cross-referencing, and Level 1 practices. There are no obvious dead ends—any typical compliance question can be answered or acted upon using these tools.

Resources