Skip to main content
Glama

Server Details

What one compliance standard already evidences of another, with the reasoning and the rejections.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Unhealthy
Last Tested
Transport
Streamable HTTP
URL
Repository
GJB65/compliance-mcp-skill-example
GitHub Stars
0

Available Tools

27 tools
agent_buy_crosswalkAInspect

Get a checkout link for a crosswalk report

Returns a payment link for the crosswalk between two frameworks. Released pairs are delivered immediately on payment; any other pair is built to order at the same price.

This returns a LINK, it does not take payment. An agent hands the link to whoever it is acting for. No card details pass through the agent.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It clearly states that it returns a LINK and does NOT take payment, and that no card details pass through the agent. It also notes delivery timing for released vs. built-to-order pairs. However, it does not describe error responses or the exact structure of the returned link, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the purpose. It uses two short paragraphs plus a minimal responses section, with every sentence adding valuable information: the action, delivery terms, payment behavior, and confirmation of the response type. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 params, no output schema, no annotations), the description adequately covers the main aspects: what it returns, the payment process, and delivery. It could be more explicit about the exact format of the link or error handling, but for this simple tool the information is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, and the schema is empty with 100% coverage. Per the rubric, the baseline is 4 for 0 params. The description does not need to explain parameters and adds nothing about them, which is appropriate for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Get a checkout link for a crosswalk report' and explains it returns a payment link for a crosswalk between frameworks. This distinguishes it from sibling tools like agent_crosswalk_pair or agent_list_crosswalk_pairs, which are likely for generating or listing pairs, not buying them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (when an agent needs to obtain a checkout link for a crosswalk) but does not explicitly state when to use this tool versus alternatives. It mentions 'Released pairs are delivered immediately' but offers no comparison to other tools or exclusions, so guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_buy_reviewAInspect

Get a checkout link for a single document compliance review

Returns a payment link for a Single Document Compliance Review against one framework. On payment the buyer is emailed a single-use link that opens the same automated pipeline a Professional subscriber uses: upload one PDF or Word document, get back a gap analysis naming every control the document addresses and every one it does not, and a rewritten version drafted against those gaps.

This returns a LINK, it does not take payment. An agent hands the link to whoever it is acting for. No card details pass through the agent.

It produces draft policy language and a gap list. It does not make anyone compliant, and no tool can: that judgement is an assessor's.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and excels: it discloses that it returns a link (not a payment), that no card details pass through the agent, that the buyer gets a single-use link upon payment, and that the output is draft language and a gap list—not a compliance certification. This goes far beyond a basic action statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized: purpose, process, clarifications, and a response note. It's somewhat verbose but each sentence adds value. The '### Responses:' section is redundant and could be trimmed, but overall it's structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, no annotations, and no parameters, the description fully covers the tool's behavior, what it returns, what happens after payment, and its limitations. It's self-sufficient and answers likely agent questions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description doesn't need to explain any. It instead explains the purpose and flow. With 0 parameters, the baseline is 4, and the description adds no parameter-specific detail (unnecessary) but maintains clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb+resource: 'Get a checkout link for a single document compliance review.' This distinguishes it from siblings like crosswalk tools by focusing on a single document review. It also explains the outcome (link, not payment) unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states what the tool does and the context (buying a review against one framework). It notes it returns a link and does not take payment, which clarifies usage. However, it doesn't explicitly contrast with alternatives or state when not to use it, leaving some room for ambiguity among similar purchase tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_capital_by_functionBInspect

Capital by the business function it targets

Where the money went, classified by whose job it changes.

Sector labels describe the company; function labels describe the buyer. The second is the only one a reader can act on, which is why the classification is by function throughout.

Concentration is reported when one deal carries a bucket, because a total can be arithmetically true and still mislead: one $1B debt facility once accounted for 73% of a function and 38% of a whole week.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does disclose one notable behavior: concentration is reported when a single deal dominates a bucket, with a concrete illustrative example. However, it omits other useful behavioral traits such as time range, data granularity, or what the JSON response contains beyond a generic 200 note, so coverage is partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core statement, then adds a useful distinction between sector and function, and a concrete example explaining the concentration behavior. The example is somewhat elaborate but earns its place by illustrating why concentration matters. It is concise enough for a human or agent to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no parameters, so input-side requirements are minimal, but there is no output schema and the description gives only a bare '200: Successful Response' line. It explains the conceptual classification and concentration caveat but does not specify what fields, aggregation, or format the JSON response will have. Acceptable for a report-style tool, but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so there are no parameter semantics to clarify. The description's conceptual context is irrelevant to parameter meaning, and the zero-parameter baseline of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Capital by the business function it targets' and elaborates 'Where the money went, classified by whose job it changes.' This clearly identifies the resource (capital) and the classification dimension (business function), and distinguishes function labels from sector labels. It lacks an explicit verb like 'list' or 'report,' but the intent is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains why function-based classification is actionable and explains concentration reporting, but it never tells an agent when to pick this tool over any of the many siblings. There is no 'use this when' or 'instead of X' guidance, leaving the selection entirely to inference from the name and subject matter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_combined_coverageBInspect

What everything you already hold covers, together

Give the frameworks an organisation already holds and one it needs. Returns what they cover TOGETHER, what each one adds that the others do not, and what none of them reaches.

No organisation holds one certification, and the marginal number is the one worth knowing: a second and third certification often add far less than expected.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
holdsYes
targetYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses that the tool returns combined coverage, individual additions, and gaps, which is useful. However, it does not mention any side effects (likely none), authentication needs, or potential performance issues. For a read-like analysis tool, this is adequate but not rich. It gives a basic understanding of what the operation does.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a brief introductory line, a clear explanation of the output, and a contextual note about marginal value. The 'Responses' section adds nothing informative beyond the obvious 200 success, which is slightly wasteful but minimal. Overall, every sentence earns its place except the 'Responses' block, which is redundant, but the description is concise and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description must clarify return format and usage. It explains the output concept (coverage, additions, gaps) but not the exact structure or data types. The tool appears simple (two string params), but the meaning of 'holds' and 'target' could be more explicit. Given the complexity is moderate and the description covers the main idea, a 3 is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has two parameters, 'holds' and 'target', with 0% schema description coverage and no descriptions in the schema. The description refers to 'frameworks an organisation already holds and one it needs', which maps directly to 'holds' and 'target', but this is implicit. It does not specify the format (e.g., comma-separated list? JSON?) or expected values, and there is no enum. With low schema coverage, the description must compensate more, but it gives only vague hints, so it scores low.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool computes combined coverage of multiple certifications, highlighting what is covered, what each adds, and gaps. It uses a specific verb ('give') and resource ('frameworks'), though 'combined coverage' is already in the name. It distinguishes from siblings like coverage_crosswalk by emphasizing the combined effect of multiple frameworks, which is unique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: when an organization holds multiple certifications and needs to understand combined coverage, especially to identify diminishing returns. It does not explicitly say 'use this tool when...' or mention alternatives, but the context is clear. It doesn't provide exclusions or contrast with all siblings, so it earns a 3.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_controls_touched_byAInspect

Controls a funded capability actually touches

The join. A capability, and the controls whose own text concerns it.

Matched against the control's requirement text, never against its title alone: a title that reads like a familiar control is the most expensive kind of wrong match. Returns nothing rather than something strained when the capability finds no purchase, because a join that always finds something is worthless.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
min_hitsNoDistinctive terms a control must contain. 0 chooses for you.
frameworkNoRestrict to one framework by name
capabilityYesWhat is being funded, e.g. 'agents that act across systems'

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does provide meaningful behavioral detail: matching is against requirement text, not title; it intentionally returns nothing rather than strained matches. This is substantive non-obvious behavior. However, it stops short of describing permissions, output shape, or other operational traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly tight and front-loads the main idea. The 'The join.' fragment and the somewhat aphoristic warning about title matches add flavor but not much structural value; still, most sentences earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, yet the description only says a successful response is JSON and that the tool may return nothing. It does not describe the actual result shape, ordering, pagination, or how limit and min_hits shape the response, leaving a real gap for an agent trying to use the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so the schema already explains capability, min_hits, and framework. The description adds context that capability means 'funded capability' and that matching targets the control's requirement text, but it adds no detail about limit, min_hits behavior, or framework restriction beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific relation—controls that a funded capability actually touches—and clarifies the core matching mechanism (requirement text, not title). It is not a tautology and conveys enough to distinguish the tool from generic crosswalk/search siblings, though the phrase 'The join' is somewhat cryptic.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: when you have a capability and need the controls whose text genuinely concerns it. It does not state explicit when-not-to-use conditions or mention alternative sibling tools, so the guidance is mostly implicit rather than directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_courses_for_frameworksAInspect

Find courses covering several standards at once

Given two or more standards, returns courses that address ALL of them together, which is what an organisation running overlapping programmes actually needs.

Example: frameworks='SOC 2,ISO 27001' returns courses on running both from one evidence set, rather than one course per standard.

Falls back to reporting which standards have coverage if no single course spans them all. No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
frameworksYesComma-separated, e.g. 'SOC 2,ISO 27001'

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly states that no authentication is required, which is a helpful behavioral note. It also explains fallback behavior when no single course spans all standards. However, it does not disclose potential side effects or rate limits. For a read-only search tool, this is adequate, and a 4 is justified given the added context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences long, efficient and front-loaded with the core purpose. The example is helpful but could be integrated more tightly. Every sentence adds value, though the response section adds minimal new information beyond the schema. Still, it is well-structured and concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given two parameters, no output schema, and no annotations, the description covers the essential: what the tool does, how to use it (with example), fallback behavior, and authentication context. It could mention return format more explicitly, but the response 200 hint in the description partially covers that. The tool is relatively simple, so completeness is high.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, meaning one parameter (frameworks) has a description in the schema. The description compensates by providing an example ('SOC 2,ISO 27001') and explaining the semantics of the frameworks parameter. The limit parameter's default and constraints are already in the schema, so the description adds minimal extra meaning. Overall, the description adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb phrase 'Find courses covering several standards at once' and clearly identifies the resource (courses covering multiple frameworks). It distinguishes itself from sibling tools like agent_search_courses by emphasizing multi-standard coverage for organizations running overlapping programs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('when an organisation running overlapping programmes actually needs' courses addressing ALL standards together) and provides a clear example (frameworks='SOC 2,ISO 27001'). It also explains fallback behavior ('returns courses on running both from one evidence set, rather than one course per standard') and notes that no authentication is required. No explicit exclusion of alternatives, but the context and example guide usage well.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_coverage_crosswalkAInspect

What one framework already evidences of another

Given a framework you already hold and one you are working toward, returns which of the target's controls your existing evidence already covers, which remain as gaps, and the reasoning for every claim.

Example: source='SOC 2', target='ISO 27001:2022'.

Mappings are derived judgements, not text lifted from either standard, and each has survived an adversarial verification pass. Where no mappings exist between the pair, the response says so explicitly rather than reporting zero coverage, because an absence of data is not a coverage of zero.

No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYesFramework you already hold, e.g. 'SOC 2'
targetYesFramework you are working toward, e.g. 'ISO 27001:2022'
min_confidenceNohigh, medium or lowhigh

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals important traits: 'Mappings are derived judgements, not text lifted from either standard, and each has survived an adversarial verification pass.' This warns the agent that outputs are fallible interpretations. It also says 'No authentication required,' which is a clear behavioral detail. However, there are no annotations, so the description carries the full burden. It does not mention rate limits, data freshness, or whether the tool uses cached data or live analysis. For a 3-parameter, moderate-complexity tool, this is adequate but leaves some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line title summary, a clear first paragraph of purpose, an example, and two clarifying paragraphs on data origin and authentication. Every sentence adds value. It is front-loaded with the core purpose. Minor markdown formatting (###) inside the description is slightly noisy but not harmful. The 200 response snippet is unnecessary since there is no output schema to describe, but it does not detract much.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity (two required string params, one optional, no nested objects) and the lack of annotations or output schema, the description covers the essential usage: what it returns (covered controls, gaps, reasoning), edge cases (no mappings), authentication status, and a concrete example. It does not describe the exact response format or pagination limits, but the absence of output schema means the description is the sole guide, and it provides the core behavioral and usage context needed for an agent to decide to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains all three parameters. The description adds 'Example: source='SOC 2', target='ISO 27001:2022'' which reinforces the parameter roles but does not add new semantic meaning beyond the schema. The third parameter 'min_confidence' with default 'high' is covered by schema description. Baseline 3 is correct because the description does not significantly enhance the schema's explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a clear, specific verb-resource pair: 'returns which of the target's controls your existing evidence already covers, which remain as gaps, and the reasoning for every claim.' It involves two frameworks and synchronizes them. The title 'agent_coverage_crosswalk' and the header 'What one framework already evidences of another' immediately distinguishes this from siblings like 'agent_cross_framework_map' (likely a general mapping) and 'agent_coverage_report' (likely a broad report). The example SOC 2 → ISO 27001:2022 further clarifies the dual-framework, evidence-gap-analysis purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description strongly implies when to use: when you hold one framework and want to see coverage against another. It also clarifies a key non-use case with 'Where no mappings exist... the response says so explicitly rather than reporting zero coverage,' which prevents misinterpretation. However, it does not explicitly name sibling alternatives (e.g., 'use agent_cross_framework_map for general mapping, not evidence coverage'), missing the chance to contrast with the many siblings. The example and explicit behavior for no mappings are clear but not comparative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_coverage_reportAInspect

Get cross-framework coverage report for a framework

Returns a coverage analysis showing how many controls in the given framework map to controls in every other framework. Includes total controls, mapped control counts, and coverage percentages per target framework. Use this to understand which frameworks overlap most and plan multi-framework strategies.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It describes the return content correctly (analysis with counts and percentages) and implies a read-only operation. However, it does not mention any potentially expensive computation, pagination, or other behavioral traits like rate limits or data freshness. Given zero annotations, this is adequate but leaves some unknowns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one sentence for purpose, one for return content, and one for usage guidance. No wasted words, and the most critical information (what it does) is front-loaded. The response format example is unnecessary but does not harm conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is simple (1 required parameter, no output schema, no nested objects), the description covers the essential aspects: purpose, output content, and usage goal. The only minor gap is the lack of behavioral details (like whether this is real-time or cached), which is not critical for this kind of analytical report tool. The mention of a 200 response code is helpful but adds no real semantic value beyond that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 1 parameter (name) and 0% schema description coverage, the description does not explicitly clarify the parameter's semantics. However, the tool name and purpose strongly imply the 'name' is a framework identifier, and the context of sibling tools (e.g., agent_get_framework) reinforces this. The description clearly states the required parameter is a framework name, adding enough meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Get') and resource ('cross-framework coverage report for a framework'), explicitly distinguishing this from siblings like 'agent_get_framework_controls' or 'agent_cross_framework_map'. It details what the report includes (total controls, mapped counts, coverage percentages), leaving no ambiguity about purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'Use this to understand which frameworks overlap most and plan multi-framework strategies.' However, it does not mention any alternatives or cases when this tool should not be used (e.g., if a single-framework detail is needed, use agent_get_framework_controls). This is a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_cross_framework_mapAInspect

Map controls between two compliance frameworks

Returns the complete control-to-control mapping between a source and target framework. Each mapping shows which source control maps to which target control(s). This enables multi-framework compliance: satisfy one control to cover requirements in both frameworks. Use exact framework names as returned by agent_search_frameworks.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYesSource framework name (e.g. 'ISO 27001:2022')
targetYesTarget framework name (e.g. 'NIST Cybersecurity Framework 2.0')

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It states the tool returns mapping data, but does not disclose whether it is a read-only operation, any side effects, authentication requirements, rate limits, or error behavior. The brief 'Responses' section only lists a status code. Behavioral transparency is minimal but not contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core description is three concise sentences that cover purpose, functionality, and parameter usage. The appended 'Responses' section adds little value and could be omitted, but it does not detract significantly overall. The information is front-loaded and each sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema and no annotations, the description explains what the tool returns (control-to-control mapping) and how to use it (exact framework names). This is largely sufficient for a simple mapping query. However, it does not describe the response format (e.g., whether it is a list, JSON structure, pagination), which could leave an agent guessing about how to parse results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with descriptive parameter names and examples. The description adds value by instructing to use exact framework names from agent_search_frameworks, which provides practical semantic guidance beyond the schema's type and examples. This helps the agent select correct parameter values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Map controls' and the resource 'between two compliance frameworks'. It explains it returns a control-to-control mapping and enables multi-framework compliance. This distinguishes it from sibling tools like agent_get_framework_controls (single framework controls) and agent_coverage_report (coverage, not mapping).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance to 'Use exact framework names as returned by agent_search_frameworks', which helps with parameter input. It also implies the use case ('enables multi-framework compliance') but does not explicitly compare to alternatives or state when not to use this tool. The context is clear, but exclusions are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_crosswalk_pairDInspect

Everything about one crosswalk pair, including what was rejected

One framework pair in full: the coverage percentage and how it was arrived at, a sample of the claims that held with the reasoning behind each, and a sample of the claims that were proposed and refuted with the reason each failed.

The rejected claims are part of the answer, not an appendix. A coverage number quoted without them is a number nobody argued with.

Free, no authentication.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sourceYes
targetYes

TDQS

D1.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It reveals that the response includes both accepted and rejected claims and explains the coverage number's derivation, which is some transparency about the output content. However, it does not mention any side effects, authentication requirements, rate limits, or whether the operation is read-only, leaving significant behavioral aspects undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness1/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, repetitive, and poetic. Phrases like 'Everything about one crosswalk pair' and 'One framework pair in full: the coverage percentage...' convey the same idea redundantly. The unnecessary elaboration ('The rejected claims are part of the answer, not an appendix...') adds no value and obscures the core information, making it poorly structured and inefficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description provides some detail about the response content (including coverage percentage, accepted/refuted claims), it omits crucial context about the tool's purpose, parameters, and relationship to sibling tools. It is incomplete for an agent to understand the full scope and appropriate usage, especially given the absence of annotations and a clear schema explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention or explain any of the parameters (source, target, limit). It fails to define what 'source' and 'target' represent (likely framework identifiers) or how 'limit' affects the response. This leaves the agent without essential information to correctly invoke the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool returns 'everything about one crosswalk pair' and elaborates on coverage and claims, but it is vague and does not clearly specify the action (e.g., retrieve, fetch, get) or the exact nature of a 'crosswalk pair'. It fails to crisply define the tool's core function, leaving the reader with a general sense but not a precise purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like agent_crosswalk_provenance or agent_crosswalk_refuted. It does not mention any selection criteria, use cases, or distinctions from sibling tools, leaving the agent without context to choose appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_crosswalk_provenanceAInspect

How do you know this: the grounding behind a crosswalk's claims

For any released framework pair, return the reasoning and the provenance behind its mappings: what document each control was verified against, when, who judged the mapping, on what date, and whether it survived an adversarial pass that argued against it.

Free, no authentication. A claim you cannot check is worth nothing, so the checking is not the paid part.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sourceYes
targetYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full responsibility for disclosing behavior. It explicitly states the tool returns provenance details (verification document, date, judge, adversarial pass) and that it is free with no authentication. This covers the core read-only behavior effectively, though it omits details on rate limits, error handling, or pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the purpose with a clear statement and then details the output fields. The philosophical aside and 'Responses' section add minor fluff but do not obscure the main message. It is moderately concise and well structured for an AI agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema and annotations, the description adequately explains the return payload, listing specific provenance fields. However, it omits details on error cases, the meaning of the 'limit' parameter, and how to specify framework pair identifiers, which would enhance completeness. It is sufficient for a basic understanding but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, and the description does not explain 'source', 'target', or 'limit'. The phrase 'framework pair' hints that source and target are framework identifiers, but the 'limit' parameter is completely unexplained. This leaves the agent without critical usage details for the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'For any released framework pair, return the reasoning and the provenance behind its mappings.' It details specific output fields (document, date, judge, adversarial pass), which distinguishes it from sibling tools like agent_coverage_crosswalk or agent_cross_framework_map that focus on mappings rather than provenance. The opening question reinforces the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when provenance behind crosswalk mappings is needed, and notes 'Free, no authentication' as a condition. However, it does not explicitly instruct when to use this tool over alternatives or mention any exclusion criteria. No sibling tools are referenced, so guidance remains implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_crosswalk_refutedAInspect

What was claimed and did not hold, with the reason

The mappings that were proposed for a pair and then refuted, each with why it failed. Refuted mappings are kept in the graph rather than deleted, so what was rejected is as inspectable as what survived.

This is the check worth running on any coverage claim: a crosswalk that never rejects anything is not being judged.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sourceYes
targetYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses that refuted mappings are kept in the graph rather than deleted, indicating a read-only behavior that preserves history. It also mentions the response format (JSON via 200). No contradictions. It could add more about rate limits or required permissions, but it provides meaningful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core description is concise and front-loaded with purpose. However, the appended '### Responses:' section is redundant and low-value, essentially restating that a 200 returns JSON without adding structure or details. This wastes a bit of space but overall the description is short and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is the sole source. It explains the philosophical value of refuted mappings but omits practical details about parameters, expected input formats, and response structure (beyond 'JSON'). An agent would be unsure what to pass for source/target and what the result exactly contains, so it is incomplete for a 3-param tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has three parameters (limit, source, target) with no descriptions, and the tool description has 0% schema coverage. The description mentions 'pair' but does not explicitly define source and target (e.g., what identifiers are expected) or explain the limit parameter. This is insufficient for an agent to know how to fill the arguments correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns mappings that were proposed for a pair and later refuted, each with the reason for failure. It distinguishes from sibling tools by focusing on refuted mappings (vs. accepted) and emphasizes that these are kept for inspection. This is specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear usage context: 'This is the check worth running on any coverage claim' and explains that a crosswalk that never rejects anything is not being judged. While it doesn't explicitly name alternatives, it implicitly differentiates this from accepted-mapping tools and tells when it is valuable. It lacks explicit 'do not use when' but the intent is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_controlCInspect

Get detailed information about a specific control

Returns full details for a single control by its code identifier: title, description, domain, and framework. Control codes are framework-specific (e.g. 'A.5.1' for ISO 27001, 'AC-1' for NIST 800-53).

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only mentions a successful 200 response and fails to address error conditions (e.g., invalid code), authentication requirements, rate limits, or any side effects. The description is insufficient for an agent to fully anticipate the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, using a clear title line and a short paragraph. The inclusion of a 'Responses' section adds structure, though it is minimal (only 200). Overall, every sentence contributes value without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter, no output schema, and no annotations, the description covers the basic purpose and return fields. However, it omits error handling, response format details beyond 'Content-Type: application/json', and any prerequisites. For a simple retrieval tool, this is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It explains the 'code' parameter as a framework-specific identifier with examples ('A.5.1', 'AC-1'), which adds meaning beyond the bare schema. However, it does not specify valid formats, patterns, or how to obtain valid codes, leaving some ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves detailed information for a single control by its code identifier, listing the fields returned (title, description, domain, framework) and providing examples of framework-specific codes. While it distinguishes from sibling tools like agent_get_framework_controls (which lists multiple controls) by emphasizing a single control lookup, it does not explicitly delineate from all related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lacks any guidance on when to use this tool versus alternatives such as agent_get_framework_controls or agent_search. It does not specify prerequisites, when not to use it, or any context-dependent recommendations, leaving the agent to infer usage from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_control_cross_referencesBInspect

Get cross-framework mappings for a control

Returns all controls in other frameworks that map to the given control via MAPS_TO relationships. This is the core cross-framework mapping capability: use it to find equivalent controls across different compliance frameworks (e.g. NIST 800-53 equivalents of ISO 27001 controls).

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It describes the relationship type (MAPS_TO) and gives an example, but lacks information on pagination, potential large response size, error conditions (e.g., control not found), and whether the operation is read-only. The basic function is conveyed, but important behavioral details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core description is two sentences and an example, which is concise. However, the 'Responses' section is poorly formatted and adds noise ('200: Successful Response (Success Response)') without providing useful information. This detracts from the overall conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one parameter, no output schema), and the description explains the mapping concept and use case. However, it lacks explicit parameter documentation, behavioral details (pagination, errors), and does not leverage the sibling list to differentiate. It is minimally complete but has clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It implies that 'code' is the identifier of the control (e.g., from the example 'AC-1'), but it does not explicitly define the parameter's format, expected values, or provide an example. The description adds some meaning beyond the schema but is not fully explicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it 'Get cross-framework mappings for a control' and explains it returns controls mapped via MAPS_TO relationships. However, it does not differentiate from the sibling tool 'agent_cross_framework_map', which likely has a similar purpose. The example (NIST 800-53 equivalents of ISO 27001) adds concreteness.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'use it to find equivalent controls across different compliance frameworks' which implies the context of use. However, it does not specify when not to use it or mention alternatives, particularly the sibling 'agent_cross_framework_map'. The usage context is implied but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_courseAInspect

Get one course

Full detail for a single course by product id, including every standard it covers and its purchase URL. Use after agent_search_courses to justify a recommendation. No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
product_idYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must cover behavioral traits. It discloses the response includes specific fields, the HTTP status (200), and that no auth is needed. However, it omits potential error conditions, rate limits, or data freshness policies, which are relevant for a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short but includes minor redundancy (e.g., 'Get one course' echoes the name) and a blank line. The 'Responses' section adds minimal value. It front-loads the purpose effectively but wastes some space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter tool with no output schema, the description covers the core functionality, parameter usage, ordering relative to search, and response content. Missing error handling details, but overall it is sufficient for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter (product_id) has no schema description, so the description must add meaning. It does say 'by product id' linking the parameter to the resource, but fails to explain what constitutes a valid ID, where to find it, or any constraints beyond being an integer.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool retrieves a single course by product ID, listing included details (standards, purchase URL). This clearly distinguishes it from sibling tools like agent_get_control or agent_get_framework.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises using this tool after agent_search_courses to justify a recommendation, providing explicit context. It also notes no authentication required. However, it does not list when to avoid the tool or name specific alternatives beyond the suggested sequence.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_frameworkAInspect

Get detailed information about a compliance framework

Returns comprehensive details about a specific compliance framework: description, jurisdiction, version, domains with control counts, and cross-framework mapping statistics. Use the exact framework name as returned by agent_search_frameworks.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry full behavioral disclosure. It implies a read-only operation via 'Get' and lists the return fields. However, it does not explicitly confirm safety, mention authentication requirements, rate limits, or error behavior. This is adequate for a simple retrieval tool but lacks comprehensive transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise—one sentence for purpose, one for guidance, and a brief response note. It is front-loaded with the core verb and resource. Minor waste: the response section only mentions a 200 status without expanding on format, but this keeps it lean. Overall well-structured for its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one required parameter, no output schema, no nested objects), the description covers the return content sufficiently—listing the key fields (description, jurisdiction, version, domains, mapping stats). It does not address error cases or edge conditions, but for a get-by-name tool this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines a required 'name' string with no description (0% schema coverage). The description adds significant meaning: 'Use the exact framework name as returned by agent_search_frameworks.' This tells the agent where to source the value and emphasizes exactness, going well beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Get detailed information about a compliance framework' and lists specific attributes (description, jurisdiction, version, domains with control counts, cross-framework mapping statistics). This clearly distinguishes it from sibling tools like agent_get_framework_controls and agent_search_frameworks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a direct usage hint: 'Use the exact framework name as returned by agent_search_frameworks.' This tells the agent how to obtain the correct parameter value. However, it does not explicitly compare when to use this tool versus alternative siblings like agent_get_framework_controls, leaving a minor gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_framework_controlsAInspect

Get all controls for a compliance framework

Returns all controls belonging to a framework, optionally filtered by domain. Each control includes: code, title, description, and domain. For large frameworks (e.g. NIST SP 800-53 Rev 5), use the domain filter to narrow results.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
domainNoFilter controls by domain name

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the structure of the response (each control includes code, title, description, domain), which is helpful. However, it does not mention any side effects, rate limits, or authorization requirements, leaving moderate gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (two well-structured sentences plus a list) and front-loads the purpose and key usage advice. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (2 parameters, one required, no output schema), the description adequately covers the purpose, usage hints, and response structure. It would benefit from mentioning whether the response is paginated or truncated for large frameworks, but it is largely complete for its scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: the description does not explain the 'name' parameter beyond the schema's requirement, but it does describe the result structure. The 'domain' parameter is already described in the schema ('Filter controls by domain name'), so the description adds little beyond that. Baseline 3 is appropriate given moderate coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pair ('Get all controls for a compliance framework') and clarifies the scope by mentioning optional domain filtering. It also distinguishes this from sibling tools like agent_get_control (single control) and agent_search_frameworks (search, not retrieval).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises using the domain filter for large frameworks (e.g., NIST SP 800-53 Rev 5), which helps an agent decide when and how to invoke the tool effectively. However, it does not explicitly state when NOT to use it or mention alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_get_framework_controls_by_nameAInspect

Get all controls for a framework, naming it as a query parameter

Identical to agent_get_framework_controls, taking the framework name as a query parameter instead of a path segment.

Use this whenever the framework name contains a forward slash. 84 of the frameworks in the graph do, including CCPA/CPRA, AML/CTF Act 2006 and BSA/AML, and the path form cannot reach any of them: the server decodes %2F back to a real separator before routing, so the request 404s no matter how it is encoded. This route has no such problem and works for every framework.

Free, no authentication.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact framework name, e.g. 'CCPA/CPRA'
domainNoFilter controls by domain name

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It discloses that the tool is 'Free, no authentication' and explains the routing behavior that makes it succeed where the sibling fails. However, it does not describe the response format beyond a brief '200: Successful Response', nor does it mention any potential pagination or limit on controls returned. Still, the important behavioral detail (the URL routing issue) is well explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise, with a clear front-loaded definition of the tool's purpose. It includes a substantial explanatory section about the routing issue that is relevant but slightly verbose. Overall, it is well-structured and each sentence contributes to understanding the tool's purpose and usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that the tool is a simple get operation with a small input schema and no output schema, the description is fairly complete. It explains the key nuance about forward slashes, authentication, and parameter placement. The only minor gap is the lack of detail about the response shape, but since there is no output schema and the tool's purpose is clear, the description is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already has 100% coverage with parameter descriptions, including an example for 'name' ('CCPA/CPRA') and a filter description for 'domain'. The tool description reinforces the key parameter semantics by explaining that 'name' is a query parameter and adding the context that it must be the exact framework name. While the description doesn't add more detail on 'domain', the schema already covers it, so the marginal value is decent but not maximal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: 'Get all controls for a framework, naming it as a query parameter'. It identifies the principal action (get controls) and the resource (framework) via a query parameter. It also explicitly distinguishes this tool from its sibling 'agent_get_framework_controls' by noting the different parameter placement and use case (for frameworks with forward slashes).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: 'Use this whenever the framework name contains a forward slash'. It also explains why the alternative path-based route fails (server decodes %2F, causing 404), and clarifies that this route 'works for every framework'. This provides clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_list_course_frameworksAInspect

List standards the catalogue covers

Every standard that has courses, with a course count each. Use this to discover valid values for the framework filter before searching. No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses 'No authentication required' and implies read-only behavior. However, it omits details like pagination, error responses, or whether data is live vs cached. More behavioral context would be helpful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core information is front-loaded in two sentences plus a brief authentication note. The 'Responses' section is slightly redundant but does not detract. It is concise without being under-specified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple parameterless listing tool, the description is largely sufficient. However, given the absence of an output schema, it could be more complete by describing the exact response fields beyond just 'course count'. The structure of the returned objects is not fully clarified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and schema description coverage is trivially 100%. According to rubric, zero parameters earn a baseline of 4. The description does not need to add parameter meaning, and it correctly focuses on purpose instead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'List standards the catalogue covers' and clarifies it returns each standard with a course count. It distinguishes the tool as a discovery mechanism for framework filter values, which differentiates it from sibling search/retrieval tools like agent_search_frameworks or agent_get_framework.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description directly says 'Use this to discover valid values for the framework filter before searching.' This gives clear when-to-use guidance. It does not explicitly exclude alternatives, but the positive usage context is strong and sufficient given the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_list_crosswalk_pairsAInspect

Framework pairs with a released coverage crosswalk

Lists the framework pairs that have a reviewed, signed-off coverage crosswalk, with the coverage figure for each. Call this before agent_coverage_crosswalk to find out which pairs return a number.

A pair that is not listed here has not been through review. Asking for it returns an honest 'not released' rather than an unreviewed percentage. Any pair across the any framework pair in the graph can be built to order, one pair being one unit of work.

No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses that no authentication is required, and that unreviewed pairs return an honest 'not released' rather than a percentage. It does not describe response format details, but the 200 response section hints at JSON. This is reasonable for a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a clear opening, usage context, behavior note, authentication statement, and response hint. The sentence about building pairs to order adds some extra context but is not excessive. It is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter list tool with no output schema, the description covers purpose, usage, behavior for missing pairs, and authentication. The only gap is a precise JSON response format, but the 'Responses' section and phrase 'coverage figure for each' give enough for a simple list. It is adequate and complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description adds no parameter details (none needed) but does clarify the output includes a coverage figure per pair, which is relevant context though not about inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Purpose is explicit: lists framework pairs with a reviewed, signed-off coverage crosswalk and the coverage figure for each. Clearly distinguishes from sibling tools by its focus on released crosswalks and the coverage value, and it names the associated tool agent_coverage_crosswalk.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs to call this before agent_coverage_crosswalk to identify which pairs return a number. Also states that pairs not listed are unreviewed and will return 'not released', giving clear when-to-use and exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_platform_statsAInspect

Get platform statistics

Returns current platform statistics: total framework count, control count, cross-framework mapping count, and domain count. No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description notes no authentication required, which is useful for behavioral expectations. However, with no annotations provided, there is no contradiction, but the description could add more detail about rate limits, data freshness, or whether the counts are cached. The current info is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two short sentences, no filler, and all information is front-loaded. Every sentence is necessary and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a simple, parameterless stats tool with no output schema, the description provides sufficient detail about what statistics are returned. It does not include potential response structure or edge cases, but for such a straightforward tool, it is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100% (no parameters to document). The description adds value by specifying the exact data returned (total framework count, control count, etc.), which goes beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns platform statistics and specifies the exact counts provided (framework count, control count, cross-framework mapping count, domain count). This distinguishes it from sibling tools that focus on specific frameworks, controls, or courses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states that no authentication is required, implying it's a low-risk, generally useful endpoint. It does not explicitly mention when to use it vs alternatives, but the purpose is clear enough to infer it's for a broad overview, while siblings are for specific resources.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_pricing_infoAInspect

Get API pricing and rate limit information

Returns current API pricing tiers, monthly call limits, and (if authenticated) your current month's usage. Use this to understand costs before making API calls.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It correctly indicates a read operation (returns data, no side effects) and notes conditional behavior based on authentication. However, it does not describe exactly what happens when unauthenticated or disclose other behavioral traits like latency or rate limits. It is adequate but lacks full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences and a response code header. It is front-loaded with the purpose and return content. The 'Responses' section adds minimal value but does not bloat the text. Every sentence serves a purpose, making it appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and zero parameters, the description explains what the tool returns and when to use it. However, it does not detail the structure of pricing tiers or call limits in the response, leaving the agent to infer the format. While sufficient for basic usage, a more complete description would outline the JSON fields returned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is trivially 100%. Per guidelines, the baseline is 4. The description does not need to add parameter details, and it does not attempt to, so a score of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'API pricing and rate limit information', specifying the returned data including pricing tiers, call limits, and optionally current usage. It distinguishes itself from all sibling tools, which focus on courses, frameworks, and controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Use this to understand costs before making API calls', which provides clear context for when to invoke the tool. It does not explicitly exclude scenarios or name alternatives, but given no sibling tool with overlapping purpose, this is acceptable and clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_search_coursesAInspect

Search the course catalogue

Find courses by need, framework, role or industry. Free-text search over the catalogue, optionally narrowed to a named standard.

Examples: q='soc 2 evidence collection', q='first 90 days as CISO', q='data governance healthcare', or q='audit preparation' with framework='ISO 27001'.

Returns up to 25 courses with a direct purchase URL. No authentication required.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
qYesWhat the buyer needs to do
limitNo
frameworkNoNarrow to a standard, e.g. 'SOC 2'

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses key behavioral traits: returns up to 25 courses, includes a direct purchase URL, and requires no authentication. It does not cover rate limits, error handling, or pagination, but the information given is sufficient for a read-only search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: a one-line summary, then context, examples, result details, and authentication status. Every sentence contributes useful information, and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers core functionality, parameters, and result limit, but lacks detail on the return format (beyond 'URL') and does not mention error responses. Given the absence of an output schema, the description should have elaborated on the course fields returned to achieve full completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (q and framework described, limit not). The description adds significant value by providing concrete examples for q ('soc 2 evidence collection') and framework ('ISO 27001'), and clarifies the limit parameter's maximum via 'Returns up to 25 courses'. This compensates for the missing schema description on limit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches the course catalogue via free-text, optionally narrowed by framework. The verb 'search' and resource 'course catalogue' are specific, and the option to narrow by framework distinguishes it from siblings like agent_get_course (specific course) and agent_search (general search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context for when to use the tool (searching courses by need, framework, role, or industry) but does not explicitly contrast it with siblings such as agent_courses_for_frameworks or agent_search. The usage is implied but lacks clear when-not-to-use or alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_search_frameworksAInspect

Search and list compliance frameworks

Search the compliance knowledge graph for frameworks by name, keyword, or jurisdiction. Returns framework metadata including name, description, jurisdiction, domain count, control count, and mapping-partner count. Without a query, returns all frameworks. Use this as the starting point to discover available frameworks.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
qNoSearch query to filter by name or keyword (e.g. 'ISO 27001', 'privacy', 'Australian')
limitNoMaximum frameworks to return
offsetNoHow many to skip, for paging through the whole catalogue. The limit caps at 200, so an agent that wants every framework pages with offset=0, 200, 400 until it gets fewer than it asked for.
jurisdictionNoFilter by jurisdiction (e.g. 'International', 'Australia', 'United States', 'European Union')

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosing behavior. It explains the return fields and the no-query behavior, which is useful. However, it does not address potential side effects, read-only guarantees, sorting, or error scenarios—though these are less critical for a search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core purpose. The 'Responses' section is somewhat redundant, but it is small and does not detract much. Overall, it is efficient and well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-style search tool with four well-documented parameters and a clear return description, the details provided are largely complete. The absence of an output schema is mitigated by the explicit list of returned metadata fields, but more detail about result ordering or filtering edge cases could add value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema itself provides detailed parameter descriptions including examples and pagination semantics. The description adds slight context by mentioning search dimensions (name, keyword, jurisdiction) and the no-query case, but it does not substantially go beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action ('Search and list compliance frameworks'), the resource ('compliance knowledge graph'), and the result (framework metadata). It also differentiates itself from sibling tools by presenting itself as the starting point for framework discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Use this as the starting point to discover available frameworks,' providing clear context for when to invoke it. It also explains the behavior when no query is supplied. It does not explicitly name alternatives or exclusion scenarios, but the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_signal_exposureDInspect

Where a framework meets where the money is going

A framework, a function, and the controls where the two meet.

This answers the question the brief cannot answer for a reader, because it does not know who they are: money is moving into this capability, and here is what my own standard already asks of me about it.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
functionNoYour function, e.g. 'AI and automation'
frameworkYesThe standard you are held to

TDQS

D1.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It discloses only that a 200 response is successful and returns JSON, but says nothing about side effects, read-only status, pagination, limits, or error behavior. This is effectively no meaningful behavioral guidance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short but not effective; it consists of cryptic promotional phrases rather than clear, instructive content. It is under-specified rather than concisely informative, and the opening line adds no operational value for an AI agent deciding to call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no output schema, no annotations, and a large sibling set, the description is severely incomplete. It does not explain what the tool returns, how to use the parameters, what the response represents, or when this tool is appropriate. An agent would have almost no basis for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions 'a framework, a function, and the controls,' which loosely echoes the framework and function parameters, but it adds no concrete meaning beyond the schema. The schema already documents framework and function; limit remains undocumented by the description. With schema coverage at only 67%, the description should compensate but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is vague and poetic ('Where a framework meets where the money is going') rather than stating a clear verb and resource. It never explicitly says what the tool does, such as retrieving, calculating, or exposing something. It does not distinguish itself from the many sibling tools or the name 'agent_signal_exposure'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus any alternative. The text refers to a 'brief' and 'money is moving into this capability,' but does not state conditions for use, exclusions, or preferred scenarios. A reader is left to infer the intended use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agent_signals_this_weekAInspect

Funded rounds in the current window, filtered

The genuine funded rounds, each with its source.

Rows are already filtered: rate decisions, analyst price targets, bond issues, buybacks, parked domains, rumoured rounds and figures that were actually valuations are all excluded. The count of what was rejected is returned alongside, so the filtering can be argued with.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
min_usdNoIgnore rounds smaller than this
functionNoBusiness function or sector, e.g. 'AI and automation'
instrumentNoequity, debt, grant, secondary or form_d

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it enumerates exclusions (rate decisions, price targets, bond issues, etc.) and states that a rejected count is returned alongside the rows. This gives the agent useful insight beyond a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and uses a clear structure with a short paragraph and bullet-style list of exclusions. The 'Responses' section is somewhat redundant but not bloated enough to hurt readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The filtering behavior and the returned rejected count are well covered, and the parameters are mostly self-explanatory from the schema. However, the exact meaning of 'current window' is undefined, there is no output schema, and no details about pagination or response structure beyond a 200 JSON response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes three of the four parameters with meaningful text, and the description adds little parameter-level detail beyond that. The undocumented 'limit' parameter is still understandable from its name, type, and min/max constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns genuine funded rounds in the current window with their sources. It uses a specific noun phrase and scope, but does not explicitly distinguish itself from sibling tools like agent_signal_exposure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when funded-round signals for the current window are needed and notes what is already filtered out. However, it provides no explicit when-to-use vs when-not-to-use guidance or references to alternative sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updates
    • Addedagent_capital_by_function
    • Addedagent_controls_touched_by
    • Addedagent_signal_exposure
    • Addedagent_signals_this_week
  2. 2 tool updates
    • Addedagent_buy_review
    • Changedagent_search_frameworks1 field changed
      • addedInput schema / properties / offset
        Added value: +{
        +  "default": 0,
        +  "description": "How many to skip, for paging through the whole catalogue. The limit caps at 200, so an agent that wants every framework pages with offset=0, 200, 400 until it gets fewer than it asked for.",
        +  "minimum": 0,
        +  "title": "offset",
        +  "type": "integer"
        +}
  3. 1 tool update
    • Addedagent_get_framework_controls_by_name
  4. 1 tool update
    • Addedagent_crosswalk_pair
  5. 3 tool updates
    • Addedagent_buy_crosswalk
    • Addedagent_combined_coverage
    • Addedagent_crosswalk_refuted
  6. 1 tool update
    • Addedagent_crosswalk_provenance
  7. 2 tool updates
    • Addedagent_coverage_crosswalk
    • Addedagent_list_crosswalk_pairs
  8. 14 tool updates
    • First observedagent_courses_for_frameworks
    • First observedagent_coverage_report
    • First observedagent_cross_framework_map
    • First observedagent_get_control
    • First observedagent_get_control_cross_references
    • First observedagent_get_course
    • First observedagent_get_framework
    • First observedagent_get_framework_controls
    • First observedagent_list_course_frameworks
    • First observedagent_platform_stats
    • First observedagent_pricing_info
    • First observedagent_search
    • First observedagent_search_courses
    • First observedagent_search_frameworks

Frequently Asked Questions

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Converts audit trails from AIops agents into framework-mapped, tamper-evident compliance evidence bundles for HIPAA, PCI-DSS, SOC 2, and GDPR.
    19
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Integrates authoritative security compliance frameworks (ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF) into AI-assisted development, offering control lookups, cross-framework mappings, build-time guardrails, and automated audit evidence generation.
    174
    3
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    An MCP-powered compliance copilot for SaaS stacks, enabling structured audit workflows including stack detection, module wiremapping, implementation directives, code verification, and security/infrastructure/legal readiness gates.
    -
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

C2.9/5.0
Disambiguation2/5

Multiple tools cover overlapping crosswalk and coverage territory: agent_coverage_crosswalk, agent_coverage_report, agent_cross_framework_map, agent_crosswalk_pair, and agent_combined_coverage could all be chosen for similar questions. The near-duplicate agent_get_framework_controls and agent_get_framework_controls_by_name also creates avoidable ambiguity.

Naming Consistency3/5

All tools share the agent_ prefix and snake_case style, but the grammatical pattern is mixed: many are verb_noun (agent_buy_crosswalk, agent_search_courses, agent_get_framework), while others are noun phrases or descriptive fragments (agent_capital_by_function, agent_combined_coverage, agent_controls_touched_by, agent_signals_this_week). The convention is readable but not uniform.

Tool Count2/5

27 tools is above the 25-tool threshold and the set feels heavier than necessary because several crosswalk/coverage tools could be consolidated into a smaller family. The broad domain justifies variety, but the count is bloated by overlapping query surfaces and at least one redundant route.

Completeness4/5

The domain is well covered for a read-only compliance intelligence platform: framework discovery, control lookup, crosswalk analysis, course search, funding-signal exploration, and purchase-link generation are all present. Minor gaps exist, such as no direct way to inspect full control lists for arbitrary domains or retrieve mappings for a specific target control, but agents can generally work around them.