Xither — AI vendor record
Server Details
Read-only record of AI vendor sub-processor lists, DPA notice windows and model retirements
- Status
- Healthy
- Uptime
- 100.0% over 19 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 4 tools
Each tool occupies a distinct role: per-vendor record (lookup_vendor), cross-vendor table (notice_windows, upcoming_model_retirements), and vendor discovery (search_vendors). There is intentional overlap since notice_windows and upcoming_model_retirements surface subsets of data also returned by lookup_vendor, but descriptions clearly mark the per-vendor vs. aggregate split, keeping boundaries mostly clear.
Two tools use verb_noun action names (lookup_vendor, search_vendors) and two use noun-phrase dataset names (notice_windows, upcoming_model_retirements), which reflects a coherent actions-vs-data-views convention rather than random mixing. Not a uniform verb_noun pattern, but readable and predictable within each class.
Four tools is lean but well-scoped for a read-only vendor-record lookup service; search, per-vendor retrieval, and two aggregate tables each cover a needed access pattern. Nothing feels redundant or padded, though the surface is on the minimal side.
The domain is read-only reference data, so absent create/update/delete is inherent rather than a gap. Search, single-record lookup, notice-window aggregation, and retirement aggregation cover the main queries, though there is no tool for browsing recent changes or listing all tracked vendors beyond the capped 10-match search.
Available Tools
4 toolslookup_vendorLook up one vendor's recordBRead-onlyIdempotentInspect
The Xither record for one vendor: where it publishes its sub-processor list and data processing agreement and when Xither last read each page (or why a page cannot be read), the notice window its agreement states for new sub-processors (quoted, with source URL and read date), its public changes to either document with permalinks, and model retirement dates it publishes for the next 365 days. One vendor per call; accepts a name, slug or domain. Changes appear 30 days after Xither records them; subscribers get them the same morning at www.xither.com/pricing.
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | Yes | A vendor name, slug or domain, for example "HubSpot", "hubspot" or "hubspot.com". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive behavior, and the description adds genuinely new operational context: pages may be unreadable ('or why a page cannot be read') and recorded changes surface on a 30-day delay. That staleness/error disclosure is valuable beyond the structured hints, though it stops short of describing pagination or caching behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence is a single dense clause stacking four different data categories, which hurts scanability. The final sentence about subscribers and pricing reads as promotional and buries the notable 30-day staleness fact, though that fact does earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden well by enumerating the record's sections (sub-processor list/DTA, notice window with source URL and read date, public changes with permalinks, retirement dates). An agent knows what to expect, though it lacks guidance on missing-vendor or ambiguous-name outcomes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single parameter is fully documented with examples, so the schema does the heavy lifting. The description's 'accepts a name, slug or domain' restates the schema rather than adding accepted-format edge cases (matching, disambiguation, partial names).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (the Xither record for one vendor) and enumerates the contents an agent will receive, so the purpose is unambiguous. It does not, however, explicitly distinguish itself from siblings like notice_windows or upcoming_model_retirements, even though it mentions those same data points, leaving some overlap unaddressed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage guidance is 'One vendor per call; accepts a name, slug or domain,' which hints at a bulk alternative but never names search_vendors. There is no explicit when-to-use, when-not-to-use, or routing to the sibling tools that cover notice windows and retirements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notice_windowsSub-processor notice windowsARead-onlyIdempotentInspect
Every sub-processor notice window Xither can quote: the number of days (business days where the clause says so) each vendor's own terms state for a new sub-processor, and what that number counts (basis: 'objection' = time to object once told, 'notice' = notice before the change, 'unstated' = the clause does not settle it), with the verbatim clause, its source URL and the date Xither read it. The same table as www.xither.com/notice-windows. A vendor not listed has no window Xither could quote.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, closed-world behavior, so the description's value-add is the data semantics: it defines the 'basis' values ('objection', 'notice', 'unstated'), discloses provenance (verbatim clause, source URL, date Xither read it), and notes the mirror site. It does not describe return shape or ordering, but the behavioral burden is well covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the resource and its contents, with the caveat last. The long parenthetical defining the basis values is dense but each element earns its place; the only cost is a slightly run-on first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so by enumerating the fields an agent will get back, plus the negative case for unlisted vendors. Missing only mechanical details such as result size or ordering, which are minor for a static quote table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. The description adds nothing about inputs because there are none to add, and it correctly implies a parameterless, whole-table read.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (sub-processor notice windows) and enumerates exactly what each record contains: day count, business-day qualifier, basis, verbatim clause, source URL, and read date. It is clearly distinguishable in substance from lookup_vendor or search_vendors, though it never names those siblings, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is largely implied: it is a zero-parameter full-table dump, and the closing line 'A vendor not listed has no window Xither could quote' sets a boundary on coverage. However, there is no explicit when-to-use guidance relative to lookup_vendor or search_vendors for an agent that wants one vendor's window.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_vendorsFind vendors by nameARead-onlyIdempotentInspect
Find vendors in the Xither record by name, slug or domain. Returns up to 10 matches, each with its name, slug and record URL, and no record data. Pass a slug to lookup_vendor for the record.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Part of a vendor name, a slug or a domain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), so the description's job is to add context, and it does: result cap of 10, the exact fields returned, and the explicit warning that no record data is included. It does not describe matching semantics (exact vs. partial) or empty-result behavior, so it falls just short of full disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with what is searched, then what is returned, then the follow-up routing. Nothing is redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter search with no output schema, the description supplies everything an agent needs: matching keys, result limit, returned fields, the absence of record data, and the next step. Safety is fully covered by annotations, so nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the query parameter already documents 'Part of a vendor name, a slug or a domain' with min/max length. The description's 'by name, slug or domain' largely restates that, adding only the observation that a slug can be fed to lookup_vendor. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Find vendors in the Xither record') plus the three matching keys (name, slug, domain). It also names the sibling lookup_vendor and what it is for, so an agent can separate the two without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: use this to find a vendor, then pass the returned slug to lookup_vendor to get the record. The alternative and the condition for using it are named. It stops short of stating when not to call this tool at all (e.g., if a slug is already known), so a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upcoming_model_retirementsUpcoming model retirementsARead-onlyIdempotentInspect
Model and API retirement dates from the retirement tables vendors publish, as Xither last read them, soonest first: model, date, the replacement the vendor names, the verbatim table row, source URL and read date. Optional vendor filter; within_days defaults to 90, maximum 365; at most 50 rows. Covers only vendors whose retirement tables Xither reads.
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | No | Optional vendor name, slug or domain. | |
| within_days | No | How many days ahead to look, from today. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, idempotent, non-destructive and closed-world behavior, so the bar is lower. The description adds genuinely useful traits beyond that: data freshness ('as Xither last read them'), the 50-row result cap, and inclusion of the source URL and read date so staleness is visible. It doesn't cover pagination or what happens when no rows match.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads what the tool returns, then constraints, then scope limitation. Dense and semicolon-heavy but every clause carries information; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description fully compensates by enumerating the returned fields (model, date, vendor-named replacement, verbatim table row, source URL, read date) plus ordering, limits and coverage caveats. An agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both parameters documented (vendor as name/slug/domain, within_days default 90, max 365), so the baseline is 3. The description largely restates those bounds; the only added element (at most 50 rows) is a result constraint rather than parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (model and API retirement dates from vendor-published retirement tables) with clear ordering (soonest first) and enumerates the returned fields. An agent can distinguish this from lookup_vendor, notice_windows and search_vendors without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operating context: optional vendor filter, within_days defaulting to 90 and capped at 365, and a hard 50-row limit. It also states a scope boundary ('Covers only vendors whose retirement tables Xither reads'), which functions as an implicit when-not, but it never names a sibling tool as an alternative for out-of-scope vendors.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
- First observed
lookup_vendor - First observed
notice_windows - First observed
search_vendors - First observed
upcoming_model_retirements
Related MCP Connectors
Run deterministic SaaS contract redlining, GDPR Art. 28 DPA & EU AI Act compliance audits.
Run deterministic SaaS contract redlining, GDPR Art. 28 DPA & EU AI Act compliance audits.
Check a vendor before you sign: DPA coverage, subprocessors, certifications, data locations, AI use.
Read-only MCP: free OpenAI security evidence ledger (55 fields) + SaaSDossier release register.
Related MCP Servers
- AlicenseBqualityDmaintenanceTracks AI regulations, deadlines, risk assessments, and policy updates across multiple global jurisdictions, helping users stay compliant with evolving AI laws.63 npmMIT
- FlicenseNot gradedqualityCmaintenanceEnables querying a source-cited index of AI vendors' data practices—training on inputs, retention, and opt-out options—with tools to get a cited verdict for one vendor or compare a field across all 11 products.-
- AlicenseAqualityDmaintenanceSource-verified regulatory and compliance intelligence: 10,000+ obligations across 39 pillars, each grounded in a primary legal source with a content hash. Covers the EU AI Act, GDPR, DORA, NIS2, HIPAA, Basel III and the MITRE ATT&CK/ATLAS families.251MIT
- AlicenseNot gradedqualityCmaintenanceEnables review-gated, local-first monitoring of AI legislation, regulations, litigation, sanctions, court rules, and ethics guidance by collecting and verifying leads from official sources, managing human review workflows, and generating digests and exports.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.