Skip to main content
Glama

Audit evidence check

wever_audit-evidence-check
Read-only

DiligenceOps: submit a counterparty’s audit or attestation report excerpt (SOC 2, SOC 1, ISO 27001, PCI DSS or similar), as text, fields (standard, report_type, auditor, period_start, period_end, as_of, opinion, exceptions, qualifications, scope) or both, with optional context (engagement_starts, and the summary the vendor gave you). The signed report states what the report covers, the standard and type, the auditor, the period or single date, the opinion, the exceptions and the scope, and names its limits plainly: a point-in-time report presented as period coverage, exceptions left out of the summary, a period that ended before the engagement starts, a qualified opinion, carved-out subservice organizations and controls left to the user entity. POST /api/audit-evidence-check. Reads only the material in the call: no page fetch, no account access, no merchant contact and no money movement. Paid URL: 0.10 USDC per call on Base via x402 exact, with the shared 10 signed-wallet free calls per rolling 30 days. Bind X-Wever-Wallet-Proof to the exact JSON arguments and the tool route. Returns a report with an Ed25519 signed receipt. The report matches words, figures, dates and named items between the submitted texts; it does not interpret meaning beyond that matching. Contract: /api/diligence-assurance-contract. Human page: https://weverlabs.com/diligence-checks/.

Input Schema

NameRequiredDescriptionDefault
labelNoOptional name for the material, recorded in the report.
fieldsNoThe same material as fields. A field given here takes precedence over the document for that element.
formatNohtml reduces the markup to readable text first. Defaults to html when the text starts with a tag, otherwise text.
reportNoThe audit or attestation report excerpt as text or HTML, up to 256 KB: the opinion, the description of the period or date, the testing results and any exceptions.
contextNoOptional: when the engagement starts and how the report was summarized to you.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, closed-world and non-destructive, and the description adds real value beyond them: no page fetch, no account access, no merchant contact, no money movement, plus the pricing model (0.10 USDC on Base via x402 exact, 10 signed-wallet free calls per rolling 30 days) and the X-Wever-Wallet-Proof binding to route and JSON arguments. It also discloses the matching-only semantics ('does not interpret meaning beyond that matching') and the Ed25519 signed receipt, which an agent needs before trusting output. The one gap is that failure modes and the response shape are only alluded to.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded, but the body is a dense run-on that packs submission mechanics, a field list, the defect taxonomy, transport, pricing, auth binding, return contract and two URLs into two long sentences. The field re-enumeration duplicates the schema and could be trimmed without losing agent-relevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with nested objects and no output schema, the description covers the required capability: inputs accepted, the evidential properties being matched, cost and auth requirements, and what comes back (a report plus an Ed25519 signed receipt). An agent has everything needed to decide to call it and to construct the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the field-level meaning of standard, report_type, auditor, period_start/end, as_of, opinion, exceptions, qualifications and scope is already documented. The description largely re-enumerates those same field names and adds only thin extra signal (an example of a vendor summary, the 'report, fields or both' combination rule). Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: submit a counterparty's audit or attestation report excerpt (SOC 2, SOC 1, ISO 27001, PCI DSS), as text, fields or both. The standards named and the report-defect list distinguish it clearly from adjacent siblings such as wever_certification-evidence-check and wever_security-disclosure-check without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies the use case strongly by enumerating what the check surfaces (point-in-time report presented as period coverage, exceptions omitted from summary, period ending before engagement start, qualified opinion, carved-out subservice orgs), which tells an agent when the tool is worth paying for. It stops short of naming when to use an alternative sibling or when the check is unnecessary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.