signaltender-mcp

Respond to SOC 2, FedRAMP, NIST 800-171 & CMMC Security Questionnaires

answer_security_questionnaire

Read-onlyIdempotent

Draft audit-ready responses to vendor security questionnaires (SOC 2, ISO 27001, FedRAMP Moderate/High, NIST SP 800-171 Rev 2/3, CMMC 2.0, CAIQ/SIG/HECVAT) with cross-framework control citations, an estimated DoD SPRS score (-203 to 110), required evidence artifacts, and POA&M remediation items for any control gaps. This is a read-only, stateless advisory responder (requires X-RapidAPI-Key; maps each question in questionnaire_text against the vendor's security_posture_summary, while target_framework selects 'auto_detect' [default] or locks control citations to a specific standard and flags any unsupported controls as 'Partially Met' or 'POA&M Required' rather than fabricating compliance). Use this tool when completing customer due-diligence questionnaires, SSP control tables, or DoD SPRS self-assessments; use scan_far_dfars_clauses instead to audit FAR/DFARS solicitation clauses, or generate_compliance_matrix for general RFP Section C/L/M requirements.

Input Schema

Name	Required	Description	Default
`target_framework`	No	Compliance control mapping mode: 'auto_detect' (default, infers framework from questionnaire text), 'soc2_iso27001' (AICPA TSC & ISO 27001 Annex A), 'nist_800_171_cmmc' (110 CMMC 2.0 Level 2 controls + DoD SPRS score calculation), 'fedramp_800_53' (NIST SP 800-53 Rev 5), or 'caiq_sig_hecvat'.	auto_detect
`questionnaire_text`	Yes	Numbered or bulleted security questionnaire items from an enterprise SIG/CAIQ/HECVAT sheet, customer infosec assessment, or Federal RFP / NIST 800-171 SSP checklist.
`security_posture_summary`	Yes	Required summary of the vendor's actual security stack, cloud hosting (e.g., AWS GovCloud), active certifications (SOC 2 Type II, ISO 27001, FedRAMP), encryption (FIPS 140-3, AES-256), MFA/IAM, and SIEM logging.

Output Schema

Name	Required	Description
`question_responses`	No	Question-by-question auditor-ready responses with cross-framework control citations and evidence artifacts.
`questionnaire_title`	No	Inferred security questionnaire title, buyer domain, and compliance scope.
`overall_readiness_score`	No	Overall security questionnaire readiness score (0-100) based on control alignment.
`poam_and_remediation_items`	No	Actionable Plan of Action & Milestones (POA&M) items or continuous improvement recommendations for any partial or open controls.
`sprs_and_framework_summary`	No	Summary of detected frameworks, estimated DoD SPRS / GRC maturity impact, and control counts.
`executive_compliance_attestation`	No	Executive CISO attestation paragraph summarizing the vendor's security architecture, certifications, and shared-responsibility model.

Schema Changelog

Changes observed during successful MCP inspections.

Changed9 schema fields changedOct 29, 2026

removedOutput schema / properties / detected_framework

Removed value: -{
-  "description": "Primary compliance standard applied to the responses.",
-  "type": "string"
-}

removedOutput schema / properties / estimated_dod_sprs_score

Removed value: -{
-  "description": "Calculated DoD SPRS score (-203 to 110) when NIST 800-171 / CMMC applies.",
-  "type": [
-    "integer",
-    "null"
-  ]
-}

addedOutput schema / properties / executive_compliance_attestation

Added value: +{
+  "description": "Executive CISO attestation paragraph summarizing the vendor's security architecture, certifications, and shared-responsibility model.",
+  "type": "string"
+}

addedOutput schema / properties / overall_readiness_score

Added value: +{
+  "description": "Overall security questionnaire readiness score (0-100) based on control alignment.",
+  "type": "integer"
+}

addedOutput schema / properties / poam_and_remediation_items

Added value: +{
+  "description": "Actionable Plan of Action & Milestones (POA&M) items or continuous improvement recommendations for any partial or open controls.",
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

removedOutput schema / properties / poam_remediation_items

Removed value: -{
-  "description": "Plan of Action and Milestones (POA&M) entries for partially met or unmet controls.",
-  "items": {
-    "type": "object"
-  },
-  "type": "array"
-}

changedOutput schema / properties / question_responses / description

Previous value: -"Audit-ready answers with compliance status, control citations, and verification evidence."New value: +"Question-by-question auditor-ready responses with cross-framework control citations and evidence artifacts."

addedOutput schema / properties / questionnaire_title

Added value: +{
+  "description": "Inferred security questionnaire title, buyer domain, and compliance scope.",
+  "type": "string"
+}

addedOutput schema / properties / sprs_and_framework_summary

Added value: +{
+  "description": "Summary of detected frameworks, estimated DoD SPRS / GRC maturity impact, and control counts.",
+  "type": "object"
+}

Changed8 schema fields changedOct 21, 2026

changedInput schema / properties / questionnaire_text / description

Previous value: -"Raw security questionnaire items from an enterprise SIG/CAIQ/HECVAT spreadsheet or Federal RFP / SSP checklist."New value: +"Numbered or bulleted security questionnaire items from an enterprise SIG/CAIQ/HECVAT sheet, customer infosec assessment, or Federal RFP / NIST 800-171 SSP checklist."

addedInput schema / properties / questionnaire_text / maxLength
```
Added value: +100000
```
addedInput schema / properties / questionnaire_text / minLength
```
Added value: +20
```

changedInput schema / properties / security_posture_summary / description

Previous value: -"Summary of the vendor's cloud stack, certifications (SOC 2, ISO 27001, FedRAMP, CMMC), encryption, IAM/MFA, and logging controls."New value: +"Required summary of the vendor's actual security stack, cloud hosting (e.g., AWS GovCloud), active certifications (SOC 2 Type II, ISO 27001, FedRAMP), encryption (FIPS 140-3, AES-256), MFA/IAM, and SIEM logging."

addedInput schema / properties / security_posture_summary / maxLength
```
Added value: +100000
```
addedInput schema / properties / security_posture_summary / minLength
```
Added value: +20
```

addedInput schema / properties / target_framework / description

Added value: +"Compliance control mapping mode: 'auto_detect' (default, infers framework from questionnaire text), 'soc2_iso27001' (AICPA TSC & ISO 27001 Annex A), 'nist_800_171_cmmc' (110 CMMC 2.0 Level 2 controls + DoD SPRS score calculation), 'fedramp_800_53' (NIST SP 800-53 Rev 5), or 'caiq_sig_hecvat'."

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "detected_framework": {
+      "description": "Primary compliance standard applied to the responses.",
+      "type": "string"
+    },
+    "estimated_dod_sprs_score": {
+      "description": "Calculated DoD SPRS score (-203 to 110) when NIST 800-171 / CMMC applies.",
+      "type": [
+        "integer",
+        "null"
+      ]
+    },
+    "poam_remediation_items": {
+      "description": "Plan of Action and Milestones (POA&M) entries for partially met or unmet controls.",
+      "items": {
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "question_responses": {
+      "description": "Audit-ready answers with compliance status, control citations, and verification evidence.",
+      "items": {
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "type": "object"
+}

AddedOct 20, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond annotations: stateless read-only advisory behavior, the required X-RapidAPI-Key auth prerequisite, and a non-fabrication guarantee that unsupported controls are downgraded to "Partially Met" or "POA&M Required". Annotations already declare readOnly/idempotent/destructive=false, so the remaining gap is minor (no mention of rate limits or handling of oversized questionnaires despite the 100k char cap).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and delivered in essentially three dense sentences with zero filler; the framework list is long but each item is load-bearing enumerations of coverage. Slightly reduced by heavy parenthetical packing, which makes the sentence harder to scan than it needs to be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists so return values needn't be restated, annotations carry the safety profile, and all three parameters are fully documented in schema plus elaborated in prose. The auth requirement and non-fabrication policy close the remaining behavioral questions an agent would have before calling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description goes further by explaining the behavioral consequence of target_framework — that 'auto_detect' is the default and that locking to a framework flags unsupported controls rather than inventing compliance. It also clarifies how questionnaire_text is matched against security_posture_summary, which is not obvious from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ("Draft audit-ready responses to vendor security questionnaires") and enumerates the exact frameworks and artifacts produced (control citations, SPRS score, evidence artifacts, POA&M items). An agent can distinguish it from every sibling named in the same paragraph without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit triggering conditions (customer due-diligence questionnaires, SSP control tables, DoD SPRS self-assessments) and explicitly routes away two named siblings: scan_far_dfars_clauses for FAR/DFARS clause auditing and generate_compliance_matrix for RFP Section C/L/M requirements. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All signaltender-mcp tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?