Check a vendor before you sign: DPA coverage, subprocessors, certifications, data locations, AI use.
Scored across 4 tools
find_vendor (free catalogue search) vs get_vendor_profile (costs a lookup, full profile) vs check_portfolio (batch of up to 25, one profile each) are distinguishable, and the descriptions explicitly flag lookup costs to guide selection. The only mild overlap is check_portfolio and get_vendor_profile both returning vendor profiles, but batch vs single scope clarifies the boundary.
All four tools follow a clean verb_noun snake_case pattern (check_portfolio, find_vendor, get_vendor_profile, list_vendor_changes_since) with predictable action verbs (check/find/get/list). No mixed conventions or vague verbs.
Four tools is on the lean side but each earns its place: discovery, single lookup, batch lookup, and change monitoring cover the core workflow without redundancy. Slightly thin for a due-diligence domain but well-scoped rather than bloated.
Search, retrieval, batch checking, and change listing are covered, but there is no way to add or remove vendors from 'your VendorWatch portfolio' even though list_vendor_changes_since depends on that portfolio existing. Portfolio management is a notable gap that could dead-end agents.
Check a list of up to 25 vendors (names, domains or both) and get one profile each. Spends one lookup per vendor answered; a name that matches nothing costs nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| vendors | Yes | Up to 25 vendors, each with a name, a domain or both. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, destructiveHint=false), so the bar is lower. The description adds genuinely non-structured behavior: one lookup is spent per vendor that is answered, and unmatched names are free — billing/rate semantics an agent cannot infer from annotations. It is consistent with idempotentHint=false, since repeats would incur further cost.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with what the tool does, followed by the cost model. Every clause carries information; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with full schema coverage and annotations covering safety, the description plus schema is nearly sufficient; 'one profile each' hints at the return shape even without an output schema. A note on what happens when a name and domain disagree, or on ordering of results, would close the last gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both name and domain fields are already fully documented, including the maxLength and maxItems constraints. The description's 'names, domains or both' and 'up to 25' restate the schema rather than adding format or resolution rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (check) and resource (a list of vendors), plus the batch limit and the output (one profile each). It is clearly distinguishable from single-lookup siblings like find_vendor, though it never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The batch shape and the cost model imply this is the tool for checking many vendors at once, which is usable guidance. But it never says when to prefer it over find_vendor or get_vendor_profile, nor states prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Find a vendor in the VendorWatch catalogue by its exact name or website domain. Returns up to 5 candidates (slug, name, category). Free: no lookup is spent.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | The vendor's name, written in full (for example the name on its website). | |
| domain | No | The vendor's website domain, or any host under it (for example app.example.com). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, non-destructive, and closed-world. The description adds valuable behavioral facts beyond those: it returns up to 5 candidates with specific fields (slug, name, category) and that no lookup is spent. It does not state matching exactness or what happens on failure, but covers key operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and followed by return details and cost. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description appropriately summarizes return candidates and fields. It notes free operation. Minor gaps remain: no pagination or matching rules, but it is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both parameters fully documented in the schema, so the description's mention of name/domain adds little beyond the structured fields. Baseline is 3 when the schema carries parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (find) and resource (vendor in the VendorWatch catalogue) with the lookup keys (exact name or website domain). Clearly distinguishes itself from siblings like get_vendor_profile, which retrieves details rather than performing a lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies the lookup-by-identifier use case and notes it is free, but does not explicitly state when to choose this over alternatives such as get_vendor_profile. The return of multiple candidates signals a disambiguation step, which is helpful context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get one vendor's documentation profile: DPA coverage by law, number of subprocessors, certifications, data locations, transfer safeguards and AI use. Give the slug from find_vendor, or the vendor's name or domain. Spends one lookup.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | The vendor's name, written in full (for example the name on its website). | |
| slug | No | The vendor's VendorWatch identifier, as returned by find_vendor. | |
| domain | No | The vendor's website domain, or any host under it (for example app.example.com). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, destructiveHint=false), so the bar is lower, and the description adds a genuine cost signal with 'Spends one lookup' — consistent with idempotentHint=false. It does not describe failure behavior for an unknown or ambiguous vendor, which is the remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the payload contents, then the input form and the cost caveat. Nothing is redundant and no sentence fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly carries the return-value burden by enumerating the profile sections. It also implies at least one identifier is needed despite zero required parameters. Only the ambiguity/error-path behavior is left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter is documented with examples, so the baseline is 3. The description adds that the three identifiers are interchangeable lookup keys and anchors slug to find_vendor's output, which is meaning beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Get one vendor's documentation profile') and then enumerates exactly what the profile contains (DPA coverage, subprocessors, certifications, data locations, transfer safeguards, AI use). This clearly distinguishes it from find_vendor, which is named as the discovery step rather than the retrieval step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete entry conditions: pass the slug from find_vendor, or the vendor's name or domain, which establishes the find_vendor → get_vendor_profile workflow. It does not state when NOT to use it or how it relates to check_portfolio, so it stops short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the vendors in your VendorWatch portfolio whose record changed on or after a date (profile updated, DPA analysed, DPA document changed). Free: no lookup is spent. 50 vendors a page; read the new profile with get_vendor_profile.
| Name | Required | Description | Default |
|---|---|---|---|
| since | Yes | A date, YYYY-MM-DD. Changes on or after this date are listed. | |
| cursor | No | The `next` value from the previous page, to read the following page. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, destructiveHint=false, openWorldHint=false), so the description only needs to add context. It does: 'Free: no lookup is spent' discloses a cost/quota trait that annotations cannot express, and '50 vendors a page' discloses pagination granularity. It does not explain cursor semantics or ordering, keeping it out of the top band.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler, with the core verb/resource/filter front-loaded and the cost and pagination notes following in decreasing priority. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter list tool with no output schema, the description covers the filter semantics, the cost model, page size, and the natural next call, which is most of what an agent needs. It omits result ordering and what happens when the portfolio has no changes, minor gaps rather than blocking ones.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema; the description's 'on or after a date' merely restates the since parameter's own wording. The page-size note is useful context but does not clarify how cursor should be obtained or used. Baseline 3 applies when the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the vendors in your VendorWatch portfolio') with an explicit filter scope ('whose record changed on or after a date'), and enumerates what counts as a change (profile updated, DPA analysed, DPA document changed). This lets an agent distinguish it from get_vendor_profile (single record) and find_vendor (lookup) without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear usage context (free, no lookup is spent) and names the follow-on tool with its purpose ('read the new profile with get_vendor_profile'), which is real routing guidance. It stops short of stating when NOT to use this tool versus check_portfolio or find_vendor, so it falls below the explicit when/when-not bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
check_portfoliofind_vendorget_vendor_profilelist_vendor_changes_sinceRead-only record of AI vendor sub-processor lists, DPA notice windows and model retirements
Source-cited data-handling comparison of 11 AI vendors: training, retention, opt-out.
EU AI Act sovereignty scanning. Provider residency, registration status, audit trail support.
AI inventory and EU AI Act compliance. Find AI tools and use cases, check new AI uses before launch.
Add one secure layer between your agents and this server.
