aribot

Many tools are clearly distinct, but several compliance/metrics retrieval tools overlap: compliance_status, get_cloud_compliance, get_framework_coverage, and run_ai_governance_audit all report compliance or audit posture. Similarly, get_diagram_summary, get_insights, and get_traceability all surface diagram-level security metrics. Descriptions help, but an agent may still misselect among these.

The set is predominantly snake_case with a predictable verb_noun pattern (get_*, list_*, apply_*, assign_*, file_*, sync_*). Minor deviations exist: code_review_scan, compliance_scan, and compliance_status lead with nouns. Overall the naming is readable and consistent enough for an agent to follow.

The server exposes 29 tools across a broad AI-security governance domain, which is heavy. While some tools serve distinct subdomains, the count exceeds 25 and increases the selection surface. This is too many for a well-scoped set according to the calibration.

Core workflows for scans, threat models, remediation, tickets, agent governance, and billing are present. However, there are no update/delete operations for diagrams, threat models, or agent identities, and threat management is mostly assign/file/verify rather than full lifecycle. These are notable gaps for a management platform.