Start Workflow
start_workflowBegin a structured workflow selected from the live workflow registry. The registry covers threat and privacy modeling; enterprise, automotive, robot, rail, OT and UAS risk/TARA; DPIA and FRIA; regulatory, medical-device, drone and machinery gap analysis; tender review and audit; document review; SORA authorisation; vulnerability prioritisation; and deferral dossiers. Call list_workflow_types first: it is the authoritative source of exact ids, deliverables, required slots, variants, and availability for this caller. When a fresh registry snapshot is available, this tool's workflow_type input schema carries a caller-authorized enum; otherwise it remains a string rather than silently falling back to a stale catalog. The workflow engine guides the process step by step with quality gates. Each step's questions_for_user is advisory — answerable from context or uploaded documents; only steps returning requires_user_input=true carry the server-enforced human-input gate. Which types you can start is tier-fenced: free and solo include ten types (1 and 2 runs a month) — threat_model, gap_analysis with its gap_analysis_nis2, gap_analysis_dora, gap_analysis_cra, gap_analysis_ai_act, gap_analysis_zero_trust and gap_analysis_vulnerability_management variants, dpia and the CMMC Level 1 self-assessment cmmc_l1_self, each reported as JSON or as an html or pdf — at those tiers the framework argument accepts only nis2, dora, cra or eu_ai_act, the base gap_analysis needs one of them, and gap_analysis_zero_trust and gap_analysis_vulnerability_management take none (each binds its own control set); Premium adds the rest of the interview-grounded catalog — LINDDUN, the TARA families, FRIA and the jurisdictional DPIA and gap variants, SORA, the drone and OT types, machinery conformity, enterprise risk, adversary tabletop and the scoped threat delta — with 5 runs a month; document review, the tender family and the DORA ICT-contract and register-of-information variants require Team or Company. MiCA CASP and AMLR readiness are Premium workflows. A CMMC POA&M closeout (32 CFR 170.21) is started with the same CMMC type as the initial run and closeout_of set to its workflow_id. A start SPENDS a run from the monthly allowance, and on free and solo a cancel does not hand an unused one back — name the workflow_type you intend to the user and get their OK before calling this, and check get_my_capabilities for what is left.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"workflow_type": "<workflow_type>"
},
"name": "start_workflow"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| framework | No | Regulatory framework the run is scoped to, such as 'nis2', 'dora', 'cra', or 'eu_ai_act'. Free and solo accept only those four, the base gap_analysis type requires one of them, and gap_analysis_zero_trust and gap_analysis_vulnerability_management take none (each binds its own control set). Empty leaves the workflow's own default in place. | |
| closeout_of | No | CMMC self-assessment types only (cmmc_self_assessment, cmmc_l1_self, cmmc_l2_self): the workflow_id (a UUID) of your own earlier initial run of the same level that ended in a conditional status with a recorded status date. The new run is the 180-day POA&M closeout assessment under 32 CFR 170.21 and spends a run like any other start. The workflow service refuses a run that is not yours, not conditional, or has no recorded status date. Empty starts an initial assessment. | |
| jurisdictions | No | ISO-2 codes of the jurisdictions the assessment covers, such as ['SE', 'EU']. Empty leaves the workflow to ask for scope in a later step. | |
| parent_run_id | No | supplier_assurance_review only: the workflow_id of a completed run of the same type in your organisation that this run follows, for example after new evidence arrives once a decision is recorded. The parent run and its report are never changed. Empty starts an ordinary run. | |
| workflow_type | Yes | Exact workflow type id from list_workflow_types, such as 'threat_model' or 'gap_analysis_nis2'. When a fresh registry snapshot is available this argument carries an enum of the ids this caller may start; otherwise call list_workflow_types rather than guessing an id from an example. Starting a workflow spends a run from the monthly allowance. | |
| succession_reason | No | Required with parent_run_id: why this run follows its parent, for example 'new SOC 2 report after the decision'. | |
| baseline_report_id | No | Report id of an earlier run of the same workflow whose gaps this run is compared against (gap-analysis maturity cycles). Copy the report_id from generate_report. The workflow service requires the same organisation and framework and validates compatibility. Empty starts a run without a baseline. | |
| entity_description | No | Plain-language description of the organisation or system being assessed, used to ground the workflow's first steps — for example 'a Swedish payments SaaS processing card data for EU merchants'. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |