Skip to main content
Glama

Tyton

Record audit answers

record_audit_context
DestructiveIdempotent

Saves answers about one audited component to the audit. audit_scope records the customer's choice between continuing the investigation and a public-only audit; availability_expectation records whether unavailable controls are expected. Both must have source human_reported. Earlier topics are kept; a new answer replaces the same topic. A public-only choice allows a partial report without further access requests. Returns the updated audit decision and report link.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes
answersYes
audit_idNoaudit run ID returned by Tyton; each audit run has its own ID
revisionNolatest run revision; 0 for the first write of a new audit session, then the revision returned by the previous write
audit_keyNoprivate audit write capability returned by Tyton; a secret that authorizes changes to this audit only
request_idNoUUID identifying one mutation; a repeated request_id with identical content is treated as a retry

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes
kindYes
sourceYes
statusYes
contextNo
sessionNo
decisionNo
findingsYes
inventoryNo
reportUrlNo
capturedAtYes
componentsNo
limitationsYes
nextActionsYes
reportSavedYes
observationsNo
schemaVersionYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes beyond the annotations by disclosing merge semantics ('Earlier topics are kept; a new answer replaces the same topic'), a validation rule, and a downstream effect ('A public-only choice allows a partial report without further access requests'). These clarify the destructiveHint=true/idempotentHint=true profile, though permission/auth requirements are only implied by the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five sentences, all information-bearing, with the core purpose front-loaded. Slightly dense but no filler; the merge-behavior and side-effect sentences each earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, nested-schema mutation with an output schema present, the description covers the key semantics (topic merge behavior, source requirement, report side effect) without needing to restate return values. Remaining gaps—auth via audit_key and revision/request_id mechanics—are handled by the schema descriptions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 67% schema coverage, the description usefully explains the two most semantically complex parameters: audit_scope's choice between continuing the investigation and public_only, and availability_expectation's expected/unexpected meaning. It adds real meaning beyond the schema for these nested params, though url/audit_id/revision/request_id are left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Saves answers about one audited component to the audit') and names the concrete topics being written. However, it does not differentiate itself from nearby siblings like record_audit_runtime or submit_findings, so an agent must still infer the boundary between them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides implied usage through constraints ('Both must have source human_reported') and the consequence of the public-only choice, but never states when to use this tool versus an alternative, nor any when-not condition. Usage is inferable rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources