Skip to main content
Glama
Sign In

SignalTender B2B, GovCon & LegalTech MCP Server

by io.github.aarbchen
OverviewDiscussionsAdmin

DFARS 252.204-7012 (72-Hour DIBNet) & CIRCIA Cyber Incident Reporting Package

audit_cyber_incident_dfars_7012
Read-onlyIdempotent

Evaluate CUI/CDI security incidents against DFARS 252.204-7012, CISA CIRCIA, and FedRAMP incident SLAs, generating a structured 72-hour DoD DIBNet ICF report, 90-day forensic media preservation checklist, and subcontractor flow-down notifications. Returns a strictly validated Dfars7012IncidentResponse JSON object containing incident_reporting_determination, dibnet_72_hour_icf_report_fields, forensic_90_day_preservation_and_sla_clock, and dc3_damage_assessment_and_prime_flowdown_notices grounded in DFARS 252.204-7012(c)–(m) (72-Hour DoD DIBNet Reporting & 90-Day Image Preservation), CISA CIRCIA (6 U.S.C. § 681b), & NIST SP 800-61r2. This is a read-only, stateless, non-destructive GovCon compliance and capture analysis call (requires X-RapidAPI-Key or X-SignalTender-Key; security_incident_telemetry_and_affected_contracts_text accepts 15 to 45,000 characters, while regulatory_reporting_regimes and assurance_certificate_and_cloud_posture calibrate the regulatory regime and threshold assumptions). Use this tool when executing DFARS 252.204-7012 (72-Hour DIBNet) & CIRCIA Cyber Incident Reporting Package workflows; use scan_far_dfars_clauses instead for general FAR/DFARS clause flow-down audits, or generate_compliance_matrix for general Section L/M 'shall' requirement extraction.

Input Schema

NameRequiredDescriptionDefault
regulatory_reporting_regimesNoTarget regulatory regime, statutory authority, or evaluation framework (defaults to 'DFARS_252_204_7012_72Hr_DIBNet_Plus_CISA_CIRCIA_72Hr_And_FedRAMP_US_CERT').DFARS_252_204_7012_72Hr_DIBNet_Plus_CISA_CIRCIA_72Hr_And_FedRAMP_US_CERT
assurance_certificate_and_cloud_postureNoOperational context, threshold parameters, or compliance posture assumptions (defaults to 'DoD ECA Medium Token Assurance Certificate Active; Enclave Hosted on AWS GovCloud (US) FedRAMP High / IL5').DoD ECA Medium Token Assurance Certificate Active; Enclave Hosted on AWS GovCloud (US) FedRAMP High / IL5
security_incident_telemetry_and_affected_contracts_textYesPrimary solicitation text, clause excerpts, deliverable schedule, or technical/financial context for DFARS 252.204-7012 (72-Hour DIBNet) & CIRCIA Cyber Incident Reporting Package (15 to 45,000 characters).

Output Schema

NameRequiredDescriptionDefault
statusNoExecution status ('success').
dibnet_72_hour_icf_report_fieldsNoStructured line-by-line regulatory audit, classification, or quantitative schedule rows.
incident_reporting_determinationNoExecutive determination overview, regulatory citations, and readiness score.
forensic_90_day_preservation_and_sla_clockNoPaste-ready compliance narratives, control specifications, or submission sections.
dc3_damage_assessment_and_prime_flowdown_noticesNoStatutory governance protocol and actionable submission verification checklist.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive, and closed-world behavior, so the description's repetition of 'read-only, stateless, non-destructive' adds little. However, it does disclose the authentication requirement (X-RapidAPI-Key or X-SignalTender-Key) and stateless execution, which are useful beyond the annotations. It does not contradict any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and alternatives are front-loaded, but the description is dense and includes redundant return-field details and safety hints already covered by annotations and the output schema. Several phrases, especially the output field list, do not earn their place given the structured data available.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex compliance-analysis tool with an output schema and full annotation coverage, the description supplies sufficient context: statutory grounding, authentication needs, input bounds, and sibling alternatives. The remaining gaps are minor because the output schema and annotations already carry return structure and safety profile.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema. The description mentions the primary text's 15–45,000 character limit and that the other two parameters calibrate regulatory regime and threshold assumptions, but these details largely restate the schema rather than adding new semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: evaluate CUI/CDI security incidents against DFARS 252.204-7012, CISA CIRCIA, and FedRAMP incident SLAs. It explicitly distinguishes the tool from siblings like scan_far_dfars_clauses and generate_compliance_matrix, so an agent can select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states exactly when to use this tool—DFARS 72-hour DIBNet and CIRCIA cyber incident reporting workflows—and names two alternatives with their distinct use cases. The routing guidance is explicit and leaves little ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SignalTender B2B, GovCon & LegalTech MCP Server toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources