annual_report
Annual ICT risk management report for board + NCA (Art. 6(5)). Auto-fills from AmpelOracle.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| year | No | ||
| entity_id | No |
Annual ICT risk management report for board + NCA (Art. 6(5)). Auto-fills from AmpelOracle.
| Name | Required | Description | Default |
|---|---|---|---|
| year | No | ||
| entity_id | No |
Changes observed during successful MCP inspections.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must fully disclose behavioral traits. It states that the report auto-fills from AmpelOracle, which is useful, but it does not explain whether the tool is read-only, whether it creates or updates records, what side effects occur, or what the output is. This is insufficient for a tool that may perform a generation or submission action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and easy to scan, but it is under-specified rather than efficiently concise. It conveys only a fragment of necessary information, so the brevity is not an asset; the sentence could earn its place by adding an action verb and parameter context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two simple parameters and no output schema, the tool is not highly complex, but the description fails to explain the tool's core behavior. It is unclear whether this tool creates, retrieves, or submits the report, and the relationship to sibling tools like get_report or report_templates is missing. This leaves the agent without enough context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has two parameters (year, entity_id) with no descriptions, and the schema description coverage is 0%. The description provides no explanation of what these parameters mean, how they should be formatted, or how they relate to the report. The tool description must compensate for the lack of schema documentation, but it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource as an 'Annual ICT risk management report' for board and NCA, referencing a specific regulatory article, which adds context. However, it lacks an explicit verb (e.g., generate, retrieve, submit), so it does not clearly state what action the tool performs beyond being a report, and it only weakly distinguishes from sibling tools like get_report or report_templates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The mention of 'Auto-fills from AmpelOracle' hints at a dependency but does not clarify prerequisites, exclusions, or appropriate scenarios. There is no comparison to sibling tools such as sync_from_ampel or get_report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.