Skip to main content
Glama

ALM X++ MCP Server

by io.github.alimbenhelal-pro

trace_security_chain

Read-only

WHEN: security audit -- need the TECHNICAL chain from Role/Duty/Privilege to Entry Points and Table/Form permissions. Also handles BUSINESS-LANGUAGE role explanation when businessLanguage=true. Triggers (technical): 'sécurité de', 'who can access', 'security for', 'role duty privilege', 'droits sur', 'technical security chain', 'trace le rôle', 'what privileges does', 'what duties are assigned', 'which role allows', 'accès au formulaire', 'what roles have access', 'quel rôle donne accès'. Triggers (business language): 'what can a user with role X do', 'explain this role', 'what does this role give access to', 'quel accès donne ce rôle', 'droits du rôle', 'what licence does this role need', 'droits requis pour'. Traverses: Role -> Duties -> Privileges -> Entry Points -> Table/Form Permissions. Set businessLanguage=true for plain-language capability list (no Duty/Privilege IDs). NOT for licence cost inference per entry point -- use trace_role_license_tree for that.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
businessLanguageNoWhen true, explains the role in plain business language (capabilities list) instead of the technical Role->Duty->Privilege chain. Default: false.
securityObjectNameYesSecurity object name, e.g. 'SystemAdministrator', 'VendInvoiceApprovalConfig'

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description adds meaningful behavioral context beyond that: it traverses a specific chain, returns technical IDs or suppresses them in businessLanguage mode, and excludes licence-cost inference. It clarifies the exact output distinction between modes, which is valuable since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but well-structured: it opens with WHEN, then triggers, traversal, mode guidance, and an exclusion. Every section earns its place; the trigger list is verbose but functional for an agent deciding tool fit. It is front-loaded with the primary use case, which supports quick scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does a strong job conveying what the tool returns conceptually: a technical chain or a plain-language capability list, with IDs suppressed in the latter mode. It also covers the two supported modes, typical inputs, and the sibling exclusion. Minor gaps remain around exact response format and error cases, but for this tool complexity, it is substantially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters already have descriptive schema entries, so the baseline is 3. The description reinforces businessLanguage behavior ('plain-language capability list (no Duty/Privilege IDs)') but does not add substantial new meaning beyond the schema for securityObjectName. It adds marginal value, not significant compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('trace') and resource ('security chain'), plus a concrete traversal path: 'Role -> Duties -> Privileges -> Entry Points -> Table/Form Permissions'. It also explicitly distinguishes itself from the sibling trace_role_license_tree by stating what it is NOT for, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is explicitly gated by 'WHEN: security audit' and supported with extensive trigger phrases for both technical and business-language contexts. The description clearly states when to set businessLanguage=true and explicitly names the alternative tool for licence cost inference ('use trace_role_license_tree for that'), leaving no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ALM X++ MCP Server toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation4/5

Most tools have distinct purposes and clear triggers, reducing ambiguity. For example, PR-related tools are separated into analysis, listing, commenting, and dependency mapping. However, some overlap exists between find_references, find_extensions, and find_callers, which could confuse an agent without careful descriptions.

Naming Consistency4/5

Tool names follow a consistent snake_case pattern with verb_noun structure within subgroups (e.g., ado_*, find_*, search_*, generate_*). There is no mixing of camelCase or other styles, though the variety of prefixes slightly reduces predictability.

Tool Count3/5

With 38 tools, the server feels slightly over-scoped for its domain. While each tool has a specific function, the number is high compared to typical well-scoped servers (10-15 tools). Some tools like find_references and find_callers could be consolidated.

Completeness4/5

The tool set covers a broad range of D365 F&O development and DevOps tasks, including code search, analysis, security, performance, upgrades, and work item management. Minor gaps exist, such as the absence of direct object modification or batch job management, but the core workflows are well covered.

Resources