Skip to main content
Glama

Server Details

TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsC

Average 2.7/5 across 14 of 17 tools scored. Lowest: 1.8/5.

Server CoherenceA
Disambiguation4/5

Most tools have distinct purposes, but potential confusion exists between 'auto_simulate' and 'generate_scenarios' (both involve scenario generation) and between 'health_check' and 'ping' (both test connectivity). Descriptions help mitigate but do not eliminate ambiguity.

Naming Consistency3/5

Tool names consistently use snake_case but mix verb-based (generate_scenarios, register_exercise) and noun-based (evidence_bundle, threat_profile) patterns. 'ping' is a single word, breaking the pattern. This inconsistency may confuse agents about whether a tool performs an action or represents a resource.

Tool Count5/5

17 tools cover the breadth of TLPT activities (scoping, simulation, findings, compliance) without being overwhelming. Each tool serves a distinct part of the workflow, making the count well-scoped for domain complexity.

Completeness4/5

The tool set covers major TLPT lifecycle phases: preparation (threat_profile), scenario generation (generate_scenarios, auto_simulate), execution mapping (attack_chain, mitre_map), findings (finding_register, remediation_plan), compliance (obligation_map, sync_to_ampel), and scheduling (test_calendar). Minor gaps like a dedicated reporting tool exist but can be worked around.

Available Tools

17 tools
attack_chainAInspect

Generate kill chain for a TIBER-EU scenario with MITRE mapping.

ParametersJSON Schema
NameRequiredDescriptionDefault
scenario_idYesTIBER-01 to TIBER-08
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for disclosing behavioral traits. It only states the action ('Generate kill chain') and context (TIBER-EU, MITRE mapping) but does not disclose what the output looks like, whether it's read-only, any performance implications, or potential side effects. This is a significant gap for a tool that likely produces a structured artifact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence that delivers the core purpose without unnecessary detail. Every word earns its place, and the structure is front-loaded with the main verb and object.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of one parameter and no output schema, the description is adequate but not rich. It does not explain what a kill chain entails, the format of MITRE mapping, or any return value structure. For a generation tool, more context on the output would improve completeness, but the basic purpose is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage for the single parameter, including the valid range (TIBER-01 to TIBER-08). The description does not add extra meaning beyond reinforcing that the scenario is TIBER-EU related, which is already implied. Baseline 3 applies because schema covers the parameter adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: generating a kill chain for a TIBER-EU scenario with MITRE mapping. This is specific, action-oriented, and distinguishes it from sibling tools like generate_scenarios (creates scenarios) and mitre_map (maps MITRE techniques) by focusing on the kill chain output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when a kill chain is needed for a TIBER-EU scenario, but provides no explicit guidance on when to choose it over alternatives like mitre_map or phase_tracker. There are no exclusions or alternative tool mentions, so usage is implied rather than clearly defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

auto_simulateBInspect

Autonomous TLPT simulation: generates TIBER-EU scenarios, maps MITRE ATT&CK, creates findings, rates detection. Art. 26.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_idYes
scenariosNoNumber of scenarios (default: 3)
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It lists the operations (generate, map, create, rate) but does not disclose any side effects, prerequisites, permission needs, or expected outcomes. The phrase 'creates findings' hints at persistence, but whether it mutates databases or requires specific setup is unknown.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the core purpose ('Autonomous TLPT simulation') and lists the key actions without filler. Every part contributes to understanding, and 'Art. 26' adds a regulatory reference without bloating the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex tool with no output schema and no annotations, but the description does not explain return values, expected outputs, or how the pieces relate. It also omits context about prerequisites or whether this is a long-running operation, making it incomplete for an agent that needs to know what to expect after invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% (the 'scenarios' parameter has a description, but 'entity_id' does not). The tool description adds no parameter-level information, leaving entity_id completely unexplained. With no description of what entity_id refers to or how scenarios count affects the simulation, parameter semantics are weak.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: it performs an autonomous TLPT simulation that generates TIBER-EU scenarios, maps MITRE ATT&CK, creates findings, and rates detection. This distinguishes it from siblings like generate_scenarios or mitre_map by emphasizing a full end-to-end automated process.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'Autonomous' implies usage for a full simulation run, but there is no explicit guidance on when to use this tool versus alternatives like generate_scenarios or finding_register. No exclusions or alternative comparisons are provided, so usage context remains implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evidence_bundleCInspect

Compile TLPT evidence for authority attestation.

ParametersJSON Schema
NameRequiredDescriptionDefault
exercise_idYes
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It states the intent ('compile evidence') but does not disclose whether this is a read-only operation, whether it creates or modifies data, or any required permissions. The behavior is ambiguous regarding whether it returns a bundle or persists one.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no filler words. It opens with the action verb and clearly presents the object and purpose. Every word contributes to the meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and no output schema or annotations, the description provides the basic purpose but lacks important behavioral context such as what the compiled evidence bundle looks like, whether it returns a file or report, or how the exercise_id is used. It is minimally adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not mention the 'exercise_id' parameter. While the parameter name is self-explanatory, the description adds no meaning such as the format, role, or how it contributes to the compilation task.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Compile' with a clear object 'TLPT evidence' and a purpose clause 'for authority attestation.' It identifies what the tool does and its intended context. It does not explicitly differentiate from sibling tools like finding_register or remediation_plan, but the focus on compiling evidence for attestation is a distinct purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The only implied use case is compiling evidence for authority attestation, but there are no explicit prerequisites, exclusions, or context about when it should be preferred over sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finding_registerCInspect

Log a pentest/TLPT finding.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYes
severityYes
attack_pathNo
exercise_idNo
recommendationNo
mitre_techniqueNo
system_affectedNo
detection_statusNo
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only states the action 'log' without explaining side effects, whether it creates a persistent record, requires an existing exercise, or if changes are reversible. This is insufficient for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words, but it is under-specified for a tool with 8 parameters. It is not a tautology, but it lacks necessary detail to be considered well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters, no annotations, no output schema, and a single-sentence description, the context is severely incomplete. It fails to explain how the finding relates to exercises, what happens after logging, or any dependencies. This is completely inadequate for the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for parameter semantics. It does not mention or explain any of the 8 parameters. Although property names like 'severity' and 'mitre_technique' are self-explanatory, the description adds no value in guiding the agent on how to populate fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Log a pentest/TLPT finding' uses a specific verb (log) and resource (finding), clearly distinguishing it from siblings like register_exercise and remediation_plan. It states exactly what the tool does without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. It does not mention prerequisites, when to avoid, or any context such as 'use during an engagement' or 'after identifying a vulnerability'. The usage is merely implied by the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_scenariosAInspect

List all 8 TIBER-EU scenarios available for autonomous simulation.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool lists scenarios, implying a read-only operation with no side effects. However, since no annotations are provided, the description carries the full burden for behavioral disclosure, and it does not explicitly state that it is non-destructive or that it does not trigger simulations. For a simple list operation, this level of disclosure appears adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that gets straight to the point. Every word earns its place, with no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description tells the agent exactly what output to expect (a list of 8 scenarios) and the domain (TIBER-EU), which is sufficient for a parameterless tool. However, it does not specify the output format or whether the scenarios are returned as names, IDs, or objects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema fully covers param semantics. The description adds contextual value by noting the scenarios are for autonomous simulation, but no parameter documentation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' and identifies the resource 'all 8 TIBER-EU scenarios available for autonomous simulation.' It clearly distinguishes the tool from siblings like 'auto_simulate' by positioning it as a listing operation. The clarity is slightly undermined by the tool name suggesting generation, but the description itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It does not mention any prerequisites, exclusions, or related tools. An agent would not know if this should be called before simulation or in place of another listing tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

health_checkBInspect

Server status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavioral traits. It only says 'Server status.' and does not mention what the output looks like, whether it is a read-only operation, or any potential errors. This is minimal and leaves the agent guessing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single phrase 'Server status.' with no unnecessary words. It is perfectly concise and front-loaded, earning every word it uses.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description should explain what 'server status' means or what the response contains. It does not—no mention of return values, format, or fields. This makes the tool under-specified for an agent to know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema already provides complete information (an empty object). The description adds nothing about parameters, but there is nothing to add. Baseline 4 applies due to zero parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Server status.' clearly indicates that the tool checks the health/status of the server. However, it lacks an explicit verb (e.g., 'get' or 'check') and does not distinguish it from the sibling 'ping' tool, which likely serves a similar purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. With a sibling named 'ping', the description provides no exclusions or context to help an agent choose between them. It simply states what it does without any usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mitre_mapBInspect

Map MITRE ATT&CK techniques to DORA TLPT. Filter by technique ID or tactic.

ParametersJSON Schema
NameRequiredDescriptionDefault
tacticNo
techniqueNo
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits, but it only states the mapping function and filters. It does not disclose whether the operation is read-only, what the output format is, or any side effects/limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that directly states the purpose and filter capability with no extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description does not fully cover the tool's behavior. It omits what the mapping output looks like and whether there are any constraints or additional usage context needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains that 'tactic' and 'technique' are filters, with 'technique' being a technique ID, adding meaning beyond the bare schema. However, it does not provide format examples or enumerate valid values, leaving some ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool's function: mapping MITRE ATT&CK techniques to DORA TLPT, and mentions filtering by technique ID or tactic. This clearly distinguishes it from siblings like attack_chain or obligation_map.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for mapping techniques and provides filter options, but it does not explicitly state when to use this tool versus alternatives like obligation_map or attack_chain. It gives some context for filtering but no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

obligation_mapCInspect

TLPT obligations DORA-TST-06 to TST-10.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description offers no behavioral details. It does not disclose whether this is a read-only retrieval, a generation, or a mutation. It also doesn't mention any side effects, return format, or limitations, leaving the agent completely in the dark about what happens when the tool is invoked.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with no wasted words. It front-loads the key reference (TLPT obligations) and specifies a concrete range (DORA-TST-06 to TST-10). While sparse, it earns its place by providing specific resource identifiers. However, it is so brief that it borders on under-specification, preventing a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema and no annotations, the description carries the full burden of explaining what the tool returns or does. The fragment 'TLPT obligations DORA-TST-06 to TST-10' is not a complete explanation of functionality, return behavior, or relation to context. It is inadequate for an agent to understand the tool's role in the workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0 parameters, the description does not need to explain parameter meanings. The baseline for 0 params is 4, and the description doesn't contradict or add confusion about parameters. It appropriately focuses on the tool's object of interest (DORA-TST-06 to TST-10) rather than inventing parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'TLPT obligations DORA-TST-06 to TST-10' is a noun phrase that restates the tool name without a clear verb. It indicates a specific set of obligations but does not say what the tool does with them (retrieve, display, map, update). It lacks a clear action and does not distinguish from sibling tools like tlpt_readiness or mitre_map.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided. There is no indication of when to use this tool versus alternatives, no context for when it is appropriate, and no mention of exclusions or prerequisites. The description gives zero guidance on selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

phase_trackerCInspect

Track TIBER-EU 8-phase lifecycle.

ParametersJSON Schema
NameRequiredDescriptionDefault
exercise_idYes
phase_statusNo
update_phaseNoPhase 1-8 to update
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. 'Track' does not disclose that the tool modifies phase status (phase_status) or advances a phase (update_phase). It fails to mention side effects, permissions, or return behavior, making the tool's operational nature unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded, with no unnecessary words. However, it is under-specified: a single vague sentence that states the topic but not the tool's actual function, so it lacks the substance needed for a usable definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations, no output schema, and a low schema description coverage, the description is far from complete. It doesn't explain what the tool does with the parameters, what a successful call returns, or what side effects occur, leaving critical gaps for agent invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no meaning to the three parameters (exercise_id, phase_status, update_phase). Schema description coverage is only 33% (only update_phase has a description), so the description needed to compensate but didn't, leaving agents without guidance on how to populate required fields like exercise_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a general purpose ('Track TIBER-EU 8-phase lifecycle') with a verb and resource, but 'track' is ambiguous—it could mean view or update. The schema reveals update capabilities (phase_status, update_phase), yet the description doesn't convey this. It also provides no differentiation from sibling tools like test_calendar or obligation_map.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, exclusions, or specific scenarios (e.g., 'use when updating phase status'), leaving the agent without context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pingCInspect

Connectivity test.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. 'Connectivity test' is extremely vague and does not disclose what kind of connectivity is tested, what actions are performed, or what the result indicates. It gives minimal insight into the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using only two words. For a simple tool like ping, this level of brevity is appropriate and avoids unnecessary filler. However, it is more of a fragment than a complete sentence, slightly reducing structure quality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no annotations, no output schema), the description is minimally adequate but lacks any detail about expected outcomes, side effects, or how it differs from similar tools like health_check. It is complete enough for a trivial tool but leaves room for ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool accepts zero parameters, so the schema is trivially complete. There is nothing for the description to add regarding parameters, and the baseline for zero-parameter tools is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Connectivity test.' indicates a basic purpose of testing connectivity. It is understandable but lacks a specific verb and resource, and does not distinguish itself from sibling tools like health_check, which could also involve connectivity checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as health_check. No context, prerequisites, or exclusions are provided, leaving the agent without direction on selecting this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

register_exerciseCInspect

Register a TLPT/pentest exercise.

ParametersJSON Schema
NameRequiredDescriptionDefault
notesNo
scopeNo
statusNo
test_typeNo
budget_eurNo
start_dateNo
exercise_idNo
ti_providerNo
exercise_nameYes
target_end_dateNo
red_team_providerNo
authority_notifiedNo
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It merely states 'Register' without describing side effects, idempotency, required permissions, or what happens on duplicate registration. The description adds no behavioral information beyond what the tool name already implies, failing to disclose anything about the operation's mechanics or consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short (one sentence) but not appropriately sized for the tool's complexity. While it is front-loaded with the key verb and object, it omits context and parameter guidance that are necessary for understanding. This is under-specification, not conciseness, as the single sentence does not earn its place by providing sufficient information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (12 parameters, no output schema, no annotations), the description is severely incomplete. It does not explain return values, execution behavior, or how to use the provided parameters. The description is inadequate for an agent to identify the correct usage, so a score of 1 is warranted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and there are 12 parameters. The description does not mention any of them, such as 'exercise_name', 'status', or 'test_type'. It fails to add any meaning beyond the input schema, leaving the purpose of all parameters undocumented. The description must compensate for the low coverage but does not, so a score of 1 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Register') and the resource ('a TLPT/pentest exercise'), which is specific and directly tied to the tool name. It distinguishes from sibling tools like 'finding_register' by specifying the object is an exercise, not findings. However, it does not elaborate on the scope or nuance beyond that.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, exclusions, or context such as whether this is the first step in an exercise workflow or how it relates to the listed sibling tools. The single sentence offers no usage context beyond the verb itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

remediation_planCInspect

Track remediation of TLPT findings. Set add=true to create.

ParametersJSON Schema
NameRequiredDescriptionDefault
addNo
ownerNo
actionNo
due_dateNo
finding_idNo
exercise_idNo
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full responsibility. It discloses only that add=true creates, but says nothing about what happens without add, side effects, permissions, or return values. This is insufficient for a tool with 6 parameters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with no fluff, front-loading the core purpose. However, the phrase 'Set add=true to create' is somewhat cryptic and could be clearer, preventing a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 6 parameters, no annotations, and no output schema. The description is far too brief for the complexity, lacking parameter explanations, behavior details, and return value information. It is severely inadequate for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate but only mentions 'add.' Other parameters like owner, action, due_date, finding_id, and exercise_id are left unexplained. While names are somewhat intuitive, the description adds minimal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Track remediation of TLPT findings' which clearly identifies the resource and action. The addition 'Set add=true to create' specifies a creation mode, distinguishing it from simply tracking. However, the ambiguity between track and create could be clearer, making it not a perfect 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage guidance is 'Set add=true to create,' which implies a conditional behavior but does not explain when to use this tool versus alternatives like finding_register or phase_tracker. No exclusions or contexts are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sync_to_ampelCInspect

Push TLPT results to AmpelOracle Art. 26 checks.

ParametersJSON Schema
NameRequiredDescriptionDefault
entity_idYes
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only states 'Push' without indicating whether the operation is idempotent, requires specific credentials, or has side effects like overwriting existing data. This is minimal behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no redundant words. It front-loads the core action and target, making it highly concise and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the tool has only one parameter and no output schema, the description is still incomplete: it does not explain what 'entity_id' represents, what 'TLPT results' entail, or any prerequisites for the operation. An agent would struggle to use this tool correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one required parameter 'entity_id' with no description, and the tool description does not mention this parameter at all. With schema description coverage at 0%, the description fails to provide any meaning for 'entity_id', leaving the agent without crucial information for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Push' with resource 'TLPT results' and destination 'AmpelOracle Art. 26 checks', distinguishing it from sibling tools like 'auto_simulate' or 'health_check'. The specific reference to Art. 26 checks adds domain context, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives, no prerequisites, or exclusion conditions. The only hint is the name and brief description, leaving the agent to infer usage from the domain context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

team_assignmentCInspect

Manage Red/Blue/White/Purple team assignments.

ParametersJSON Schema
NameRequiredDescriptionDefault
red_teamNo
blue_teamNo
white_teamNo
exercise_idYes
purple_teamNo
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. 'Manage' implies mutation but does not explain effects (e.g., whether existing assignments are overwritten, whether changes are reversible, or if authorization is needed). The description is too vague to set accurate expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant wording. It is easy to read and front-loads the key resource, though its brevity borders on under-specification rather than tight efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no annotations, and no output schema, the description is drastically incomplete. It does not explain the creation/update behavior, parameter semantics, expected inputs, or return values, making it inadequate for an agent to use reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 5 parameters with 0% coverage, and the description adds only a minimal hint that red_team, blue_team, white_team, and purple_team relate to team assignments. It does not explain the value format, whether these are identifiers or names, or how they relate to exercise_id. The description fails to compensate for the schema's lack of documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's focus on managing Red/Blue/White/Purple team assignments, which distinguishes it from sibling tools like attack_chain or threat_profile. However, the verb 'manage' is generic and does not specify whether it creates, updates, or deletes assignments, so it lacks the specificity of verbs like 'list' or 'create'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as register_exercise or auto_simulate. It neither states prerequisites nor exclusions, leaving the agent without context for appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

test_calendarDInspect

Annual testing schedule and compliance check.

ParametersJSON Schema
NameRequiredDescriptionDefault
yearNo
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It does not state whether the tool is read-only, mutates data, returns information, or requires authentication. The phrase is entirely ambiguous about side effects and operational characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short, which is concise, but it is under-specified to the point of being uninformative. There is no wasted prose, but the brevity does not compensate for the lack of actionable content. It is not a model of conciseness; it is simply minimal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter, no output schema), the description should at least clarify what the tool outputs or what operation it performs. It does not. The description is incomplete for an agent to correctly select and invoke the tool with confidence.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has a single optional 'year' parameter with 0% description coverage. The description's mention of 'annual' vaguely hints that the year parameter represents the calendar year, but it does not explain the expected format, constraints, or behavior when the parameter is omitted. The description adds minimal semantic value beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Annual testing schedule and compliance check' is a noun phrase that restates the tool name without a clear verb or action. It does not specify whether the tool retrieves, updates, or validates something, and it fails to distinguish this tool from siblings like health_check or ping.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description implies it is for annual testing schedules and compliance checks, but it does not mention any exclusions, prerequisites, or context when other tools would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

threat_profileDInspect

Define threat landscape for TLPT scoping.

ParametersJSON Schema
NameRequiredDescriptionDefault
sectorNo
geographyNo
exclusionsNo
exercise_idYes
crown_jewelsNo
threat_actorsNo
attack_scenariosNo
critical_systemsNo
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. The description 'Define threat landscape' gives no information about side effects, permissions, reversibility, or return values.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no unnecessary words, earning high marks for brevity. However, it is under-specified to the point of being minimally informative, which weakens its structural effectiveness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters, no annotations, and no output schema, this tool requires a rich description to fill gaps. The one-sentence description is far too sparse to provide adequate context for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 8 parameters with no descriptions (0% coverage). The description does not mention any of these parameters, leaving their semantics entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the tool's function as defining a threat landscape for TLPT scoping, which is a specific action. However, it lacks detail on what 'define' entails and does not differentiate from sibling tools like generate_scenarios, making it only partially clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The only contextual hint is 'for TLPT scoping', which implies usage during scoping phase but does not provide exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tlpt_readinessCInspect

Assess organizational readiness for a TLPT exercise.

ParametersJSON Schema
NameRequiredDescriptionDefault
scope_definedNo
budget_approvedNo
legal_frameworkNo
authority_engagedNo
red_team_selectedNo
white_team_formedNo
ti_provider_selectedNo
crown_jewels_identifiedNo
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral transparency. It only says 'assess' without disclosing whether the tool is read-only, what it returns, how it determines readiness, or whether it triggers side effects. The description gives no insight into the tool's behavior beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise, but it is under-specified. While it does not waste words, it also does not provide enough information to be useful. It is more of a stub than a well-structured description, so it earns a middling score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, no annotations, and no output schema, the description is far from complete. It does not explain what constitutes 'readiness', how the inputs are aggregated, what the output is, or how the result should be interpreted. The tool appears to be a checklist-based assessment, but the description leaves out all meaningful context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no meaning to any of the 8 boolean parameters. The parameter names (e.g., 'scope_defined', 'budget_approved') are self-explanatory but the description does not explain how they relate to the readiness assessment, their roles, or how they interact. The description fails to compensate for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to assess organizational readiness for a TLPT exercise. The verb 'assess' and the resource 'organizational readiness for a TLPT exercise' are specific and distinguishable from sibling tool names. However, it does not explicitly contrast with siblings like 'health_check' or 'register_exercise', but the purpose is still clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention whether it should be used before starting a TLPT, after certain prerequisites, or what to do with the results. There are no exclusions or alternative tool references, so the usage context is entirely implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Servers

  • A
    license
    -
    quality
    C
    maintenance
    AI-powered penetration testing through 36 MCP tools on a containerized Kali Linux, enabling automated reconnaissance, web testing, exploitation, and evidence collection.
    1
    MIT
  • A
    license
    C
    quality
    D
    maintenance
    An automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.
    27
    9
    7
    BSD 3-Clause
  • F
    license
    -
    quality
    D
    maintenance
    AI-powered autonomous penetration testing framework with 80+ professional security tools across reconnaissance, web application testing, exploitation, and forensics. Integrates with LM Studio for intelligent vulnerability assessment and automated security testing workflows.
    3

View all MCP Servers

Try in Browser

Your Connectors

Sign in to create a connector for this server.

Resources