proofrelay.review_vendor_risk_profileReview public vendor or MCP server risk metadata for governance signals using hashes and declared boundaries only. This is not legal, security, or procurement certification.
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | Yes |
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the tool's scope (public metadata, hashes, declared boundaries) and its non-certification limitation, aligning with the read-only and non-destructive annotations. It could be more explicit about the exact output format, but it is transparent about its intent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and well-structured, conveying essential information without unnecessary detail. It avoids fluff and directly communicates the tool's purpose and limitations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives the tool's purpose and boundaries but does not specify the output structure, expected results, or any preconditions. While the core intent is clear, the lack of output context may leave the agent uncertain about what the tool actually returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not elaborate on the 'vendor' object parameters or their significance. The schema contains many fields (e.g., requires_payment, data_boundary) but the description adds no additional meaning, leaving the agent to infer usage from field names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool reviews public vendor or MCP server risk metadata for governance signals, with explicit constraints on using hashes and declared boundaries. It differentiates itself from certification tasks, making its purpose specific and distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use the tool (for governance signals) and explicitly notes what it is not (legal, security, or procurement certification). However, it does not directly mention alternative tools or specific scenarios beyond the core review purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
All 26 tools have distinct names that clearly indicate their purpose (e.g., adapt_agent_identity_evidence vs. build_audit_pack_manifest). No two tools have overlapping or ambiguous functions, even though some share similar verbs; the nouns and description contexts differentiate them effectively.
The tool names follow a uniform convention: all start with 'proofrelay.' and use lowercase verb_noun with underscores (e.g., proofrelay.build_bundle_draft, proofrelay.verify_signed_attestation). There is no mixing of camelCase, across the entire set.
The server exposes 26 tools, which exceeds the 'borderline' range of 16–25 and falls into the 'too many' category (>25). While the tools cover a broad domain (evidence verification, risk scanning, etc.), the large number might overwhelm agents and suggests that some tools could be merged or the scope narrowed.
The tool set covers a comprehensive range of operations—adapting, building, verifying, scanning, recommending, and summarizing—across multiple subdomains (identity, payment, audit, etc.). Minor gaps exist, such as missing tools for updating or deleting evidence, but overall the surface appears very complete for the described functionality.