Run ALL 5 drift detections in one call (regulatory + evidence + cloud + control + ENTERPRISE). Enterprise dimension scans NIS2, LkSG, ISO 27001, Contracts, Tax, Healthcare via MEGA MCP oracles.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_id | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the burden of disclosing behavior. It details what detections are included and that the enterprise dimension scans specific frameworks via 'MEGA MCP oracles', adding useful behavioral context. However, it does not state whether the operation is read-only, potential performance implications, or any side effects, leaving gaps for a non-annotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and front-loads the core function in the first sentence. The second sentence adds specific detail about the enterprise dimension's scope, which is valuable. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should explain what the tool returns, but it does not. It also omits any guidance on the optional entity_id parameter, and does not mention potential limitations or environmental dependencies beyond the oracle reference. Given the tool's moderate complexity, the description is incomplete for accurate invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter, entity_id, with 0% schema description coverage. The tool description does not mention entity_id at all, so it provides no meaning beyond the parameter name/type. With low schema coverage, the description should compensate, but it fails entirely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Run ALL 5 drift detections in one call' and enumerates them (regulatory + evidence + cloud + control + ENTERPRISE). This distinguishes it from the individual sibling detect_* tools and gives a specific verb ('Run') + resource ('ALL 5 drift detections').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'in one call' conveys when to use this tool—when a comprehensive drift scan is needed, as opposed to individual detection tools. It does not explicitly mention alternatives or exclusions, but the context clearly implies the batch vs. individual choice. This qualifies as clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools have clearly distinct purposes, with detection tools differentiated by drift type. Minor overlap exists between health_check and ping, as well as control_drift and evidence_drift sharing degraded controls, but descriptions provide enough context to avoid confusion.
The naming pattern is mixed: detect_* tools consistently use verb_noun, but drift_history and drift_status follow noun_noun, and full_drift_scan is a compound noun. While readable, the inconsistency makes the set feel less cohesive.
15 tools is slightly above average but justified by the broad scope of drift detection and management. Each tool earns its place, covering detection, viewing, configuration, and remediation without obvious redundancy.
The tool set covers the full drift lifecycle: detection (multiple types), full scan, history, status, configuration, manual marking/resolving, and automated remediation. Minor gaps like lacking a single-event detail view are not critical for core workflows.