Get enriched policy directives and living standards for one or more policy packs. Returns rules with governance context (CWE, MITRE, regulatory references) for inference time enforcement.
| Name | Required | Description | Default |
|---|---|---|---|
| packId | No | Policy pack ID or array of IDs (e.g. 'web', ['web', 'pci-dss-v1']). Defaults to 'web'. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It does disclose the output nature (rules with governance context) and the 'living standards' aspect, which is useful. However, it does not explicitly state that it is a read-only operation with no side effects, nor does it mention any auth requirements or rate limits. The verb 'Get' implies read-only, but an explicit statement would be clearer.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose and packs in relevant details (enriched directives, governance context, inference enforcement) without any filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description adequately explains what the tool returns and in what context it is used. It mentions the inclusion of governance references (CWE, MITRE, regulatory) which helps an agent understand the output. The only minor gap is lack of explicit note about the default packId behavior, but that is already in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of the parameter meaning, including the oneOf string/array type and the default value 'web'. The description merely confirms 'one or more policy packs', adding no additional semantics beyond what the schema provides. The baseline of 3 applies because the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'enriched policy directives and living standards', specifying the scope 'for one or more policy packs' and the return value 'rules with governance context'. This distinguishes it from sibling tools like list_packs, which likely lists available packs, and check_code, which analyzes code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: to retrieve policy directives for packs at inference time enforcement. It does not explicitly exclude alternatives or name sibling tools, but the context 'for inference time enforcement' provides clear usage context. Since list_packs presumably handles pack discovery, get_directives is appropriately positioned for fetching directives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools have clear, distinct purposes: check_code returns violations, generate_proof creates a signed bundle, get_directives retrieves rules, get_proof fetches a bundle, and list_packs enumerates packs. The only potential ambiguity is between check_code and generate_proof, both scan code against policies, but they produce different outputs (raw violations vs. proof bundle), making them distinguishable.
All five tool names follow a consistent verb_noun pattern (check_code, generate_proof, get_directives, get_proof, list_packs). The verbs are action-oriented and the nouns clearly indicate the resource or output, with no mixed conventions or vague naming.
Five tools is well-scoped for a code governance server. Each tool addresses a distinct aspect: checking, proof generation, policy retrieval, proof retrieval, and pack listing. This covers the core workflows without unnecessary redundancy or bloat.
The tool surface covers the primary governance operations: checking code, generating and retrieving proofs, and accessing policy directives and pack listings. Minor gaps exist, such as no direct method to view a single policy pack's full details or manage packs, but the core enforcement and proof lifecycle is complete.
