tlpt
Server Details
TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Available Tools
17 toolsattack_chainAInspect
Generate kill chain for a TIBER-EU scenario with MITRE mapping.
| Name | Required | Description | Default |
|---|---|---|---|
| scenario_id | Yes | TIBER-01 to TIBER-08 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden for disclosing behavioral traits. It only states the action ('Generate kill chain') and context (TIBER-EU, MITRE mapping) but does not disclose what the output looks like, whether it's read-only, any performance implications, or potential side effects. This is a significant gap for a tool that likely produces a structured artifact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence that delivers the core purpose without unnecessary detail. Every word earns its place, and the structure is front-loaded with the main verb and object.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of one parameter and no output schema, the description is adequate but not rich. It does not explain what a kill chain entails, the format of MITRE mapping, or any return value structure. For a generation tool, more context on the output would improve completeness, but the basic purpose is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single parameter, including the valid range (TIBER-01 to TIBER-08). The description does not add extra meaning beyond reinforcing that the scenario is TIBER-EU related, which is already implied. Baseline 3 applies because schema covers the parameter adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: generating a kill chain for a TIBER-EU scenario with MITRE mapping. This is specific, action-oriented, and distinguishes it from sibling tools like generate_scenarios (creates scenarios) and mitre_map (maps MITRE techniques) by focusing on the kill chain output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when a kill chain is needed for a TIBER-EU scenario, but provides no explicit guidance on when to choose it over alternatives like mitre_map or phase_tracker. There are no exclusions or alternative tool mentions, so usage is implied rather than clearly defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
auto_simulateBInspect
Autonomous TLPT simulation: generates TIBER-EU scenarios, maps MITRE ATT&CK, creates findings, rates detection. Art. 26.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_id | Yes | ||
| scenarios | No | Number of scenarios (default: 3) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It lists the operations (generate, map, create, rate) but does not disclose any side effects, prerequisites, permission needs, or expected outcomes. The phrase 'creates findings' hints at persistence, but whether it mutates databases or requires specific setup is unknown.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core purpose ('Autonomous TLPT simulation') and lists the key actions without filler. Every part contributes to understanding, and 'Art. 26' adds a regulatory reference without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with no output schema and no annotations, but the description does not explain return values, expected outputs, or how the pieces relate. It also omits context about prerequisites or whether this is a long-running operation, making it incomplete for an agent that needs to know what to expect after invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50% (the 'scenarios' parameter has a description, but 'entity_id' does not). The tool description adds no parameter-level information, leaving entity_id completely unexplained. With no description of what entity_id refers to or how scenarios count affects the simulation, parameter semantics are weak.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: it performs an autonomous TLPT simulation that generates TIBER-EU scenarios, maps MITRE ATT&CK, creates findings, and rates detection. This distinguishes it from siblings like generate_scenarios or mitre_map by emphasizing a full end-to-end automated process.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'Autonomous' implies usage for a full simulation run, but there is no explicit guidance on when to use this tool versus alternatives like generate_scenarios or finding_register. No exclusions or alternative comparisons are provided, so usage context remains implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evidence_bundleCInspect
Compile TLPT evidence for authority attestation.
| Name | Required | Description | Default |
|---|---|---|---|
| exercise_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It states the intent ('compile evidence') but does not disclose whether this is a read-only operation, whether it creates or modifies data, or any required permissions. The behavior is ambiguous regarding whether it returns a bundle or persists one.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no filler words. It opens with the action verb and clearly presents the object and purpose. Every word contributes to the meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one parameter and no output schema or annotations, the description provides the basic purpose but lacks important behavioral context such as what the compiled evidence bundle looks like, whether it returns a file or report, or how the exercise_id is used. It is minimally adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention the 'exercise_id' parameter. While the parameter name is self-explanatory, the description adds no meaning such as the format, role, or how it contributes to the compilation task.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Compile' with a clear object 'TLPT evidence' and a purpose clause 'for authority attestation.' It identifies what the tool does and its intended context. It does not explicitly differentiate from sibling tools like finding_register or remediation_plan, but the focus on compiling evidence for attestation is a distinct purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The only implied use case is compiling evidence for authority attestation, but there are no explicit prerequisites, exclusions, or context about when it should be preferred over sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
finding_registerCInspect
Log a pentest/TLPT finding.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| severity | Yes | ||
| attack_path | No | ||
| exercise_id | No | ||
| recommendation | No | ||
| mitre_technique | No | ||
| system_affected | No | ||
| detection_status | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only states the action 'log' without explaining side effects, whether it creates a persistent record, requires an existing exercise, or if changes are reversible. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words, but it is under-specified for a tool with 8 parameters. It is not a tautology, but it lacks necessary detail to be considered well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, no annotations, no output schema, and a single-sentence description, the context is severely incomplete. It fails to explain how the finding relates to exercises, what happens after logging, or any dependencies. This is completely inadequate for the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter semantics. It does not mention or explain any of the 8 parameters. Although property names like 'severity' and 'mitre_technique' are self-explanatory, the description adds no value in guiding the agent on how to populate fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Log a pentest/TLPT finding' uses a specific verb (log) and resource (finding), clearly distinguishing it from siblings like register_exercise and remediation_plan. It states exactly what the tool does without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. It does not mention prerequisites, when to avoid, or any context such as 'use during an engagement' or 'after identifying a vulnerability'. The usage is merely implied by the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_scenariosAInspect
List all 8 TIBER-EU scenarios available for autonomous simulation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool lists scenarios, implying a read-only operation with no side effects. However, since no annotations are provided, the description carries the full burden for behavioral disclosure, and it does not explicitly state that it is non-destructive or that it does not trigger simulations. For a simple list operation, this level of disclosure appears adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that gets straight to the point. Every word earns its place, with no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description tells the agent exactly what output to expect (a list of 8 scenarios) and the domain (TIBER-EU), which is sufficient for a parameterless tool. However, it does not specify the output format or whether the scenarios are returned as names, IDs, or objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema fully covers param semantics. The description adds contextual value by noting the scenarios are for autonomous simulation, but no parameter documentation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' and identifies the resource 'all 8 TIBER-EU scenarios available for autonomous simulation.' It clearly distinguishes the tool from siblings like 'auto_simulate' by positioning it as a listing operation. The clarity is slightly undermined by the tool name suggesting generation, but the description itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention any prerequisites, exclusions, or related tools. An agent would not know if this should be called before simulation or in place of another listing tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
health_checkBInspect
Server status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavioral traits. It only says 'Server status.' and does not mention what the output looks like, whether it is a read-only operation, or any potential errors. This is minimal and leaves the agent guessing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single phrase 'Server status.' with no unnecessary words. It is perfectly concise and front-loaded, earning every word it uses.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description should explain what 'server status' means or what the response contains. It does not—no mention of return values, format, or fields. This makes the tool under-specified for an agent to know what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema already provides complete information (an empty object). The description adds nothing about parameters, but there is nothing to add. Baseline 4 applies due to zero parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Server status.' clearly indicates that the tool checks the health/status of the server. However, it lacks an explicit verb (e.g., 'get' or 'check') and does not distinguish it from the sibling 'ping' tool, which likely serves a similar purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. With a sibling named 'ping', the description provides no exclusions or context to help an agent choose between them. It simply states what it does without any usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mitre_mapBInspect
Map MITRE ATT&CK techniques to DORA TLPT. Filter by technique ID or tactic.
| Name | Required | Description | Default |
|---|---|---|---|
| tactic | No | ||
| technique | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must convey behavioral traits, but it only states the mapping function and filters. It does not disclose whether the operation is read-only, what the output format is, or any side effects/limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that directly states the purpose and filter capability with no extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description does not fully cover the tool's behavior. It omits what the mapping output looks like and whether there are any constraints or additional usage context needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains that 'tactic' and 'technique' are filters, with 'technique' being a technique ID, adding meaning beyond the bare schema. However, it does not provide format examples or enumerate valid values, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's function: mapping MITRE ATT&CK techniques to DORA TLPT, and mentions filtering by technique ID or tactic. This clearly distinguishes it from siblings like attack_chain or obligation_map.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for mapping techniques and provides filter options, but it does not explicitly state when to use this tool versus alternatives like obligation_map or attack_chain. It gives some context for filtering but no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
obligation_mapCInspect
TLPT obligations DORA-TST-06 to TST-10.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description offers no behavioral details. It does not disclose whether this is a read-only retrieval, a generation, or a mutation. It also doesn't mention any side effects, return format, or limitations, leaving the agent completely in the dark about what happens when the tool is invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with no wasted words. It front-loads the key reference (TLPT obligations) and specifies a concrete range (DORA-TST-06 to TST-10). While sparse, it earns its place by providing specific resource identifiers. However, it is so brief that it borders on under-specification, preventing a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema and no annotations, the description carries the full burden of explaining what the tool returns or does. The fragment 'TLPT obligations DORA-TST-06 to TST-10' is not a complete explanation of functionality, return behavior, or relation to context. It is inadequate for an agent to understand the tool's role in the workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0 parameters, the description does not need to explain parameter meanings. The baseline for 0 params is 4, and the description doesn't contradict or add confusion about parameters. It appropriately focuses on the tool's object of interest (DORA-TST-06 to TST-10) rather than inventing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'TLPT obligations DORA-TST-06 to TST-10' is a noun phrase that restates the tool name without a clear verb. It indicates a specific set of obligations but does not say what the tool does with them (retrieve, display, map, update). It lacks a clear action and does not distinguish from sibling tools like tlpt_readiness or mitre_map.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. There is no indication of when to use this tool versus alternatives, no context for when it is appropriate, and no mention of exclusions or prerequisites. The description gives zero guidance on selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
phase_trackerCInspect
Track TIBER-EU 8-phase lifecycle.
| Name | Required | Description | Default |
|---|---|---|---|
| exercise_id | Yes | ||
| phase_status | No | ||
| update_phase | No | Phase 1-8 to update |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. 'Track' does not disclose that the tool modifies phase status (phase_status) or advances a phase (update_phase). It fails to mention side effects, permissions, or return behavior, making the tool's operational nature unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, with no unnecessary words. However, it is under-specified: a single vague sentence that states the topic but not the tool's actual function, so it lacks the substance needed for a usable definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of annotations, no output schema, and a low schema description coverage, the description is far from complete. It doesn't explain what the tool does with the parameters, what a successful call returns, or what side effects occur, leaving critical gaps for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning to the three parameters (exercise_id, phase_status, update_phase). Schema description coverage is only 33% (only update_phase has a description), so the description needed to compensate but didn't, leaving agents without guidance on how to populate required fields like exercise_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a general purpose ('Track TIBER-EU 8-phase lifecycle') with a verb and resource, but 'track' is ambiguous—it could mean view or update. The schema reveals update capabilities (phase_status, update_phase), yet the description doesn't convey this. It also provides no differentiation from sibling tools like test_calendar or obligation_map.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, exclusions, or specific scenarios (e.g., 'use when updating phase status'), leaving the agent without context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pingCInspect
Connectivity test.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. 'Connectivity test' is extremely vague and does not disclose what kind of connectivity is tested, what actions are performed, or what the result indicates. It gives minimal insight into the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using only two words. For a simple tool like ping, this level of brevity is appropriate and avoids unnecessary filler. However, it is more of a fragment than a complete sentence, slightly reducing structure quality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no annotations, no output schema), the description is minimally adequate but lacks any detail about expected outcomes, side effects, or how it differs from similar tools like health_check. It is complete enough for a trivial tool but leaves room for ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts zero parameters, so the schema is trivially complete. There is nothing for the description to add regarding parameters, and the baseline for zero-parameter tools is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Connectivity test.' indicates a basic purpose of testing connectivity. It is understandable but lacks a specific verb and resource, and does not distinguish itself from sibling tools like health_check, which could also involve connectivity checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as health_check. No context, prerequisites, or exclusions are provided, leaving the agent without direction on selecting this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
register_exerciseCInspect
Register a TLPT/pentest exercise.
| Name | Required | Description | Default |
|---|---|---|---|
| notes | No | ||
| scope | No | ||
| status | No | ||
| test_type | No | ||
| budget_eur | No | ||
| start_date | No | ||
| exercise_id | No | ||
| ti_provider | No | ||
| exercise_name | Yes | ||
| target_end_date | No | ||
| red_team_provider | No | ||
| authority_notified | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It merely states 'Register' without describing side effects, idempotency, required permissions, or what happens on duplicate registration. The description adds no behavioral information beyond what the tool name already implies, failing to disclose anything about the operation's mechanics or consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short (one sentence) but not appropriately sized for the tool's complexity. While it is front-loaded with the key verb and object, it omits context and parameter guidance that are necessary for understanding. This is under-specification, not conciseness, as the single sentence does not earn its place by providing sufficient information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters, no output schema, no annotations), the description is severely incomplete. It does not explain return values, execution behavior, or how to use the provided parameters. The description is inadequate for an agent to identify the correct usage, so a score of 1 is warranted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and there are 12 parameters. The description does not mention any of them, such as 'exercise_name', 'status', or 'test_type'. It fails to add any meaning beyond the input schema, leaving the purpose of all parameters undocumented. The description must compensate for the low coverage but does not, so a score of 1 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Register') and the resource ('a TLPT/pentest exercise'), which is specific and directly tied to the tool name. It distinguishes from sibling tools like 'finding_register' by specifying the object is an exercise, not findings. However, it does not elaborate on the scope or nuance beyond that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, exclusions, or context such as whether this is the first step in an exercise workflow or how it relates to the listed sibling tools. The single sentence offers no usage context beyond the verb itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
remediation_planCInspect
Track remediation of TLPT findings. Set add=true to create.
| Name | Required | Description | Default |
|---|---|---|---|
| add | No | ||
| owner | No | ||
| action | No | ||
| due_date | No | ||
| finding_id | No | ||
| exercise_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full responsibility. It discloses only that add=true creates, but says nothing about what happens without add, side effects, permissions, or return values. This is insufficient for a tool with 6 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with no fluff, front-loading the core purpose. However, the phrase 'Set add=true to create' is somewhat cryptic and could be clearer, preventing a perfect score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 6 parameters, no annotations, and no output schema. The description is far too brief for the complexity, lacking parameter explanations, behavior details, and return value information. It is severely inadequate for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate but only mentions 'add.' Other parameters like owner, action, due_date, finding_id, and exercise_id are left unexplained. While names are somewhat intuitive, the description adds minimal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Track remediation of TLPT findings' which clearly identifies the resource and action. The addition 'Set add=true to create' specifies a creation mode, distinguishing it from simply tracking. However, the ambiguity between track and create could be clearer, making it not a perfect 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage guidance is 'Set add=true to create,' which implies a conditional behavior but does not explain when to use this tool versus alternatives like finding_register or phase_tracker. No exclusions or contexts are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sync_to_ampelCInspect
Push TLPT results to AmpelOracle Art. 26 checks.
| Name | Required | Description | Default |
|---|---|---|---|
| entity_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only states 'Push' without indicating whether the operation is idempotent, requires specific credentials, or has side effects like overwriting existing data. This is minimal behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no redundant words. It front-loads the core action and target, making it highly concise and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool has only one parameter and no output schema, the description is still incomplete: it does not explain what 'entity_id' represents, what 'TLPT results' entail, or any prerequisites for the operation. An agent would struggle to use this tool correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one required parameter 'entity_id' with no description, and the tool description does not mention this parameter at all. With schema description coverage at 0%, the description fails to provide any meaning for 'entity_id', leaving the agent without crucial information for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Push' with resource 'TLPT results' and destination 'AmpelOracle Art. 26 checks', distinguishing it from sibling tools like 'auto_simulate' or 'health_check'. The specific reference to Art. 26 checks adds domain context, making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives, no prerequisites, or exclusion conditions. The only hint is the name and brief description, leaving the agent to infer usage from the domain context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
team_assignmentCInspect
Manage Red/Blue/White/Purple team assignments.
| Name | Required | Description | Default |
|---|---|---|---|
| red_team | No | ||
| blue_team | No | ||
| white_team | No | ||
| exercise_id | Yes | ||
| purple_team | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. 'Manage' implies mutation but does not explain effects (e.g., whether existing assignments are overwritten, whether changes are reversible, or if authorization is needed). The description is too vague to set accurate expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant wording. It is easy to read and front-loads the key resource, though its brevity borders on under-specification rather than tight efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no annotations, and no output schema, the description is drastically incomplete. It does not explain the creation/update behavior, parameter semantics, expected inputs, or return values, making it inadequate for an agent to use reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 5 parameters with 0% coverage, and the description adds only a minimal hint that red_team, blue_team, white_team, and purple_team relate to team assignments. It does not explain the value format, whether these are identifiers or names, or how they relate to exercise_id. The description fails to compensate for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's focus on managing Red/Blue/White/Purple team assignments, which distinguishes it from sibling tools like attack_chain or threat_profile. However, the verb 'manage' is generic and does not specify whether it creates, updates, or deletes assignments, so it lacks the specificity of verbs like 'list' or 'create'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as register_exercise or auto_simulate. It neither states prerequisites nor exclusions, leaving the agent without context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_calendarDInspect
Annual testing schedule and compliance check.
| Name | Required | Description | Default |
|---|---|---|---|
| year | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It does not state whether the tool is read-only, mutates data, returns information, or requires authentication. The phrase is entirely ambiguous about side effects and operational characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short, which is concise, but it is under-specified to the point of being uninformative. There is no wasted prose, but the brevity does not compensate for the lack of actionable content. It is not a model of conciseness; it is simply minimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema), the description should at least clarify what the tool outputs or what operation it performs. It does not. The description is incomplete for an agent to correctly select and invoke the tool with confidence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has a single optional 'year' parameter with 0% description coverage. The description's mention of 'annual' vaguely hints that the year parameter represents the calendar year, but it does not explain the expected format, constraints, or behavior when the parameter is omitted. The description adds minimal semantic value beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Annual testing schedule and compliance check' is a noun phrase that restates the tool name without a clear verb or action. It does not specify whether the tool retrieves, updates, or validates something, and it fails to distinguish this tool from siblings like health_check or ping.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description implies it is for annual testing schedules and compliance checks, but it does not mention any exclusions, prerequisites, or context when other tools would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
threat_profileDInspect
Define threat landscape for TLPT scoping.
| Name | Required | Description | Default |
|---|---|---|---|
| sector | No | ||
| geography | No | ||
| exclusions | No | ||
| exercise_id | Yes | ||
| crown_jewels | No | ||
| threat_actors | No | ||
| attack_scenarios | No | ||
| critical_systems | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The description 'Define threat landscape' gives no information about side effects, permissions, reversibility, or return values.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words, earning high marks for brevity. However, it is under-specified to the point of being minimally informative, which weakens its structural effectiveness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no annotations, and no output schema, this tool requires a rich description to fill gaps. The one-sentence description is far too sparse to provide adequate context for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 8 parameters with no descriptions (0% coverage). The description does not mention any of these parameters, leaving their semantics entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the tool's function as defining a threat landscape for TLPT scoping, which is a specific action. However, it lacks detail on what 'define' entails and does not differentiate from sibling tools like generate_scenarios, making it only partially clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The only contextual hint is 'for TLPT scoping', which implies usage during scoping phase but does not provide exclusions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tlpt_readinessCInspect
Assess organizational readiness for a TLPT exercise.
| Name | Required | Description | Default |
|---|---|---|---|
| scope_defined | No | ||
| budget_approved | No | ||
| legal_framework | No | ||
| authority_engaged | No | ||
| red_team_selected | No | ||
| white_team_formed | No | ||
| ti_provider_selected | No | ||
| crown_jewels_identified | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral transparency. It only says 'assess' without disclosing whether the tool is read-only, what it returns, how it determines readiness, or whether it triggers side effects. The description gives no insight into the tool's behavior beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it is under-specified. While it does not waste words, it also does not provide enough information to be useful. It is more of a stub than a well-structured description, so it earns a middling score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, no annotations, and no output schema, the description is far from complete. It does not explain what constitutes 'readiness', how the inputs are aggregated, what the output is, or how the result should be interpreted. The tool appears to be a checklist-based assessment, but the description leaves out all meaningful context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning to any of the 8 boolean parameters. The parameter names (e.g., 'scope_defined', 'budget_approved') are self-explanatory but the description does not explain how they relate to the readiness assessment, their roles, or how they interact. The description fails to compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to assess organizational readiness for a TLPT exercise. The verb 'assess' and the resource 'organizational readiness for a TLPT exercise' are specific and distinguishable from sibling tool names. However, it does not explicitly contrast with siblings like 'health_check' or 'register_exercise', but the purpose is still clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention whether it should be used before starting a TLPT, after certain prerequisites, or what to do with the results. There are no exclusions or alternative tool references, so the usage context is entirely implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
17 tool updates
- First observed
attack_chain - First observed
auto_simulate - First observed
evidence_bundle - First observed
finding_register - First observed
generate_scenarios - First observed
health_check - First observed
mitre_map - First observed
obligation_map - First observed
phase_tracker - First observed
ping - First observed
register_exercise - First observed
remediation_plan - First observed
sync_to_ampel - First observed
team_assignment - First observed
test_calendar - First observed
threat_profile - First observed
tlpt_readiness
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
CyberShield - 12 cybersecurity tools: NIS2 mapping, MITRE ATT&CK, vulns, threat intel.
DORAOracle — 15 tools for DORA Art.5-32: risk register, ICT incidents, TLPT, third-party.
DependencyOracle - 10 ICT dependency tools: SBOM, supply chain, third-party graph.
IncidentOracle - 12-tool incident management MCP: triage, BaFin DORA reporting, RCA.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceAI-powered penetration testing through 36 MCP tools on a containerized Kali Linux, enabling automated reconnaissance, web testing, exploitation, and evidence collection.1MIT
- AlicenseCqualityDmaintenanceAn automated penetration testing framework that enables intelligent security assessments through reconnaissance, vulnerability scanning, and controlled exploitation. Features AI-driven workflow management with comprehensive reporting for authorized security testing.252797BSD 3-Clause
- FlicenseNot gradedqualityDmaintenanceAutonomous penetration testing powered by a local LLM, automating tool chaining for recon, vulnerability scanning, exploit research, and reporting.1-
- FlicenseNot gradedqualityDmaintenanceAI-powered autonomous penetration testing framework with 80+ professional security tools across reconnaissance, web application testing, exploitation, and forensics. Integrates with LM Studio for intelligent vulnerability assessment and automated security testing workflows.3-
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
Most tools have distinct purposes, but potential confusion exists between 'auto_simulate' and 'generate_scenarios' (both involve scenario generation) and between 'health_check' and 'ping' (both test connectivity). Descriptions help mitigate but do not eliminate ambiguity.
Tool names consistently use snake_case but mix verb-based (generate_scenarios, register_exercise) and noun-based (evidence_bundle, threat_profile) patterns. 'ping' is a single word, breaking the pattern. This inconsistency may confuse agents about whether a tool performs an action or represents a resource.
17 tools cover the breadth of TLPT activities (scoping, simulation, findings, compliance) without being overwhelming. Each tool serves a distinct part of the workflow, making the count well-scoped for domain complexity.
The tool set covers major TLPT lifecycle phases: preparation (threat_profile), scenario generation (generate_scenarios, auto_simulate), execution mapping (attack_chain, mitre_map), findings (finding_register, remediation_plan), compliance (obligation_map, sync_to_ampel), and scheduling (test_calendar). Minor gaps like a dedicated reporting tool exist but can be worked around.