Aggrete
OfficialThis server exposes six MCP tools across HR, finance, and ops domains for querying workforce and planning data through an Aggrete-governed proxy.
hr__recent_joiners: List recent hires on a team (email, employee id, start date) within a configurable look-back window.
hr__leave_balance: Look up one person's remaining leave/absence balance by email (email redacted in results).
hr__start_here: Demo helper explaining the environment and suggesting governed actions to try.
finance__headcount_plan: Get aggregate headcount totals (approved, filled, open roles) per team without individual-level data.
finance__budget_roles: Get budget lines per role for a team, including backfill-only status and role owner email.
ops__oncall_draft: Draft a weekly on-call rotation for a team and quarter, with assigned persons' emails.
Provides a governed Google Drive connector with create folder tools, optional write allowance, and write fencing to the same folder scope as reads under proxy policy.
Integration with Salesforce as an upstream service behind the proxy, allowing policy enforcement, per-user accumulation, output redaction, and audit controls to apply to its tool calls and results.
Integration with Slack as an upstream service behind the proxy, allowing code-of-conduct policy, per-user state, and audit controls to apply to Slack tool calls and responses.
Aggrete
The open-source proxy. Product site: https://aggrete.com. This repo is the proxy and nothing else: engine, accumulator, ingest CLI, Helm chart.
An MCP proxy that enforces a code of conduct document across connectors, with state that accumulates per user.
Every MCP gateway on the market authorizes tool calls and logs them. None of them answer the question that actually matters once an assistant can reach Glean, Salesforce, Slack and Drive at once: is this call, combined with everything this person has already pulled today, something the code of conduct forbids?
Four individually-authorized questions can assemble a layoff list. No guardrail fires, because no single question was sensitive. This proxy is the missing layer.
Install
pip install aggrete # published on PyPI
# or with uv:
uv tool install aggrete # installs the aggrete CLI
uvx aggrete --demo # or run it without installing
aggrete --config proxy.config.yamlOr clone this repo to get the demo, sample policy and Helm chart.
Related MCP server: Blekline MCP Server
What the proxy does
Try it in one command:
aggrete --demo(ordocker run --rm ghcr.io/aggrete/aggrete --demo) runs the four-question walkthrough with no config, auth, or network.Refuses forbidden calls before the upstream is contacted, using a YAML policy and per-user memory that accumulates across calls and sessions.
Ask before you act: a built-in
checktool dry-runs a proposed sequence of calls and returns the decision, the rule, the clause and the remediation without fetching anything, andscenarioslists things to try. Both are answered by the proxy itself (disable withbuiltin_tools: false).Tamper-evident audit: every decision is one hash-chained JSON line. Verify with
aggrete-audit audit.jsonl(breaks are reported by line number). Optionally forward each row to a SIEM (Splunk/Elastic/Datadog over HTTP, or syslog) as it is written, off the hot path, withaudit_forward:.Selective tool exposure: walls and blocks in the policy hide tools from users who could never call them, so they are never listed.
Output redaction:
redact:masks emails, SSNs, card numbers, API keys and bearer tokens in results before they reach the model; hits are counted in the audit.Holds the upstream credentials itself and never forwards the caller's token to an upstream (confused-deputy safe).
Tool integrity: fingerprints every upstream tool the first time it is seen and flags any later change to its description or schema (a rug pull), and scans descriptions for hidden instructions (tool poisoning). Alert or block, per
tool_integrity:. Deterministic, no model in the path.Rate limiting: a per-user ceiling on tool calls per window (
rate_limit:), shared across replicas via Redis. A denial-of-wallet and abuse control.Inbound secret scanning: scans tool arguments for credential-shaped strings and blocks (or masks) them before they reach an upstream (
scan_inbound:), so a leaked key never leaves through a tool call.
Governing writes (egress). A tool that acts on the world (create, update,
upload, post, send, share) is classified as a write and governed as egress: any
write after a session has read untrusted content is refused (the prompt-injection
shield), and a rule can target writes only with applies: write. This is generic
across connectors, not Drive-specific. The Google Drive connector exposes governed
create_<folder> tools with --allow-write; writes are fenced to the folder like
reads. Classify your own connectors' write tools with write_tools: in the config.
See ROADMAP.md for what is shipped, in progress, and planned,
with the community requests behind each item.
Run it
python -m venv .venv && .venv/bin/pip install mcp pyyaml pytest
.venv/bin/python -m pytest tests -q # tests generated from coc.yaml
.venv/bin/python demo/run_demo.py # the four-prompt sequence, end to endIt first previews the plan with the built-in check tool, then runs it for real:
=== ask first: would this plan be allowed? ===
Plan check: REFUSED.
1. hr__recent_joiners [hr-personnel] -> allowed
2. finance__budget_roles [finance-comp] -> allowed
3. ops__oncall_draft [ops-rota] -> REFUSED COC-HR-004
Personnel records, compensation or budget records, and operational rosters
may not be combined to derive ... identifiable individuals.
Fix: request a purpose-bound session from HR Privacy ...
=== now run it for real ===
turn 1 finance__headcount_plan allowed
turn 2 finance__budget_roles allowed (owner emails redacted)
turn 3 hr__recent_joiners allowed (emails redacted)
turn 4 ops__oncall_draft DENIED COC-HR-004Turn 4 is denied before the upstream call, so the on-call data is never
fetched. The three domains overlap on the same people, and this call would
complete the forbidden set. check reached the same verdict without fetching
anything. Call aggrete__scenarios through the proxy for more to try: individual
pay (min_group), comparing colleagues (self_comparison), the prompt-injection
shield (flow), and tools hidden behind a wall or block.
The document is the source of truth
coc.yaml holds clause text written by the clause owner, its enforcement, and its
tests. Engineering owns the compiler, not the policy.
- rule_id: COC-HR-004
clause: >
Personnel records, compensation or budget records, and operational rosters
may not be combined to derive the employment status, performance, or
planned departure of identifiable individuals.
owner: hr-privacy@example.com
enforce:
- layer: accumulation
action: deny
type: domain_join
domains: [hr-personnel, finance-comp, ops-rota]
require_entity_overlap: true
scope: user
window: 4h
tests:
- {name: four_prompt_layoff_list, expect: deny, sequence: [...]}CI fails any rule without both an allow and a deny test. Clauses that compile to nothing are worth finding. Those are the parts of your code of conduct that were never enforceable.
aggrete-lint coc.yaml --config proxy.config.yaml catches the fail-open cases the
tests do not: a high-severity rule that only alerts, a wall whose until date has
passed, an enforce block missing a required field, and rules whose domains no tool
is mapped to (so the rule can never fire). It exits non-zero on errors, for CI.
Rule types: domain_join, entity_budget, domain_block, self_comparison,
min_group (a result about fewer than k people is one person's data; pay
transparency), wall (a domain open only to allowed_users, or closed to
blocked_users, optionally until a date; privilege, embargoes, investigation
subjects). domain_join and domain_block accept the same allowed_users,
blocked_users, since, until scoping (quiet periods). self_comparison
(the requester's own record plus colleagues' records in one domain. The
precondition for "how do I compare"; decided post-call, since the colleague
records have to be seen to be counted). Actions: deny, alert. Start everything at alert, tune against real traffic, then flip.
How it works
client ──MCP──▶ proxy ──MCP──▶ hr / finance / ops connectors
│
├─ pre_call deny before fetching where already decidable
├─ post_call extract entities, record, re-evaluate, redact
└─ audit what was handed over, not just what was askedaggrete/policy.py. Deterministic evaluation. No model in this path.aggrete/accumulator.py. Per-user state, TTL'd.MemoryStorefor tests,RedisStorefor deployment, because state must be shared across clients.aggrete/entities.py. Pulls stable person IDs out of tool results.proxy.config.yaml. Maps tool name patterns to the domains clauses refer to.
Remote connectors
Upstreams are either local stdio processes (command:) or remote MCP
servers over streamable HTTP (url:). The proxy holds the credential for the
upstream; header values may reference ${ENV_VARS} so tokens never sit in
the YAML. Because the end user never holds that token, the only path to the
connector is through the proxy.
upstreams:
ops:
url: https://mcp.example.com/ops/mcp
headers:
Authorization: "Bearer ${OPS_MCP_TOKEN}"tests/test_http_upstream.py runs the mock ops connector over HTTP
(demo/mock_server.py --transport streamable-http) behind the proxy end to end.
Architecture: where the proxy lives and how the pieces connect
people's assistants your network your systems
(Claude, Copilot, Cursor) | |
| mcp.example.com (this proxy) | HR system (Workday)
── HTTPS + OAuth ────────► | Starlette, streamable HTTP | ─► Finance (budget lines)
| identity from the token | ─► On-call rotations
| policy: coc.yaml | ─► Drive, Slack, CRM ...
| state: Redis (or memory) | (reachable only from the proxy)
| │ writes |
| ▼ |
| audit.jsonl ◄── read only ── Aggrete Console (live.example.com)
| coc.yaml HR / Legal / IT, behind SSO or basic authThree rules make this safe:
Only the proxy holds connector credentials. People sign in to the proxy (your IdP via
mode: jwt, or the built-in sign-in viamode: builtinwhen you have no IdP yet); the proxy signs in to the connectors. Fence the connectors so they accept traffic only from the proxy host.The console never touches the connectors. It reads two files the proxy writes,
audit.jsonlandcoc.yaml, on the same host or a shared volume, and it changes nothing the proxy enforces. Put it behind your SSO or, at minimum, HTTP basic auth; it shows who asked what.The assistants may only talk to the proxy. Managed client policy (Claude Code managed settings, Claude Enterprise connectors, Copilot and Cursor org policies) allow-lists
https://mcp.example.com/mcpand nothing else.
Connecting Claude (claude.ai): Settings → Connectors → Add custom connector →
URL https://mcp.example.com/mcp. Claude discovers the sign-in from the
proxy's OAuth metadata, registers itself, and sends you to /signin. From then
on every question Claude asks on your behalf passes the policy.
Sample handbook: samples/northwind-handbook.docx (synthetic, tailored to the
rule types); coc.yaml maps to its clauses 7.1 to 7.11 one to one (7.4 and
7.12 are not enforceable at a data proxy). aggrete-ingest samples/northwind-handbook.docx reproduces it. The samples/ directory also
has real public-domain examples (GSA/TTS code of conduct, Indiana state
employee handbook); see samples/README.md.
Serving it to a whole company: streamable HTTP + OAuth
stdio is for one laptop. For everyone else, run Aggrete as a service and let identity come from the token:
python -m aggrete.proxy --config proxy.config.yaml --transport streamable-http --host 0.0.0.0 --port 8080HTTP mode refuses to start without an auth: block. In jwt mode it validates
bearer JWTs from your IdP (issuer, audience, expiry, signature via JWKS,
required scopes) and derives the user from the email claim. Configurable
with identity_claim. Every request without a valid token is a 401 with an
RFC 9728 WWW-Authenticate pointer, and the user: line in the config is
ignored entirely. builtin mode is a small OAuth server inside the proxy (dynamic client
registration, a sign-in page, passcodes from the environment) for teams with
no IdP yet. static mode (fixed tokens) exists for development and the
test-suite. The accumulator keys state on the token identity, so the same
person hitting Aggrete from Claude Code, Claude.ai and Cursor shares one
history. Which is the point.
Register it in a client as a remote MCP server at https://<host>/mcp with
the bearer token your IdP issues; keep the connectors themselves reachable
only from the Aggrete host.
Inside a gateway you already run
If agentgateway, IBM ContextForge, Kong or your own gateway is already the control plane, don't add a second one. Embed Aggrete:
from aggrete.plugin import PolicyHook, AggreteMiddleware
hook = PolicyHook("coc.yaml", domains={"hr__*": "hr-personnel", "ops__*": "ops-rota"},
store=RedisStore(redis_client))
# as two calls from your plugin system
v = hook.before(user, tool) # v.allow, v.message (clause + remediation)
v = hook.after(user, tool, result_text) # records entities, re-evaluates
# or as ASGI middleware around any MCP server that answers in JSON
app = AggreteMiddleware(app, hook, identity=lambda scope: scope["state"]["user"])Identity is a callable over the request, so it composes with whatever auth the host performs. The middleware refuses at pre-call without forwarding and inspects JSON tools/call results for post-call recording.
Ways to deploy
Who | How |
One developer |
|
A team |
|
A company | Helm/Docker behind your IdP, then make |
Existing gateway |
|
Putting a real system behind the proxy: Google Drive
aggrete/connectors/drive.py is a Drive upstream the proxy runs itself. How
it is done, in the order you do it:
A service account, not a person. In Google Cloud: enable the Drive API, create a service account (say
aggrete-drive), download its JSON key. The proxy holds the key; nobody's personal Google login is involved, which is what makes the proxy the only road.Share the folders, read only. In Drive, create a root folder (say
Northwind) with one subfolder per kind of material (Restructuring plan,Legal hold,Team documents) and share the root with the service account email as Viewer. Service accounts own nothing; they only see what is shared with them.One tool pair per folder. The connector lists the root's subfolders and exposes
search_<folder>andread_<folder>for each, so the policy can name folders:upstreams: drive: {command: python3, args: [-m, aggrete.connectors.drive, --credentials, /opt/aggrete/drive-sa.json, --root, Northwind]} domains: "drive__*_restructuring_plan": restructuring-plan # clause 7.9: embargo until announced "drive__*_legal_hold": legal-hold # clause 7.3: never for assistants "drive__*": drive-generalResults name people. Every file comes back with
owner_emailandeditor_email, so the policy's tallies and joins work on Drive results like on HR records.Remove the direct road. Disable the assistant's native Drive connector for governed accounts (Claude Enterprise: managed connectors; personal accounts: remove it). Otherwise the assistant has two ways to Drive and the policy only sees one.
python -m aggrete.connectors.drive --credentials sa.json --root Northwind --list
prints the tools that will be exposed. If the root is not shared yet the
connector still starts and exposes a single status tool that says what is
missing, so the proxy never fails to boot because of Drive.
Building your own connector
Drive is the reference; the pattern is general. A connector is just an MCP server, and the proxy governs any MCP server, so putting a new system behind the proxy is: expose read tools, name write tools with a write verb, and map the tools to a policy domain.
aggrete/connectors/base.py removes the boilerplate:
from aggrete.connectors.base import Connector
c = Connector("crm")
@c.read("search_accounts", "Search CRM accounts by name.")
def search(query: str) -> str:
return my_crm.search(query) # a JSON string
@c.write("create_note", "Add a note to an account.")
def create_note(account_id: str, text: str) -> str:
return my_crm.add_note(account_id, text)
if __name__ == "__main__":
c.run()upstreams:
crm: {command: python3, args: [my_crm_connector.py]}
domains:
"crm__*": crm-accountsc.write(...) refuses a tool name with no write verb, because a mis-named write
would slip past egress governance. Full guide with the folder-fencing pattern
and a copy-paste template: docs/CONNECTORS.md and
examples/connectors/knowledgebase_connector.py.
For teams that would rather not build and maintain their own, Aggrete for teams is where supported, certified connectors live: maintained and covered by support, with Drive shipping and Slack, GitHub, Jira, Salesforce and Workday on the roadmap. The proxy and this SDK stay Apache-2.0.
Starting from the document you already have
aggrete/ingest.py turns a code-of-conduct document into a draft coc.yaml:
python -m aggrete.ingest handbook.pdf --domains proxy.config.yaml -o coc.draft.yamlPDFs go to the model as native document blocks; DOCX, Markdown and text as
text. The model proposes rules in the exact coc.yaml schema with clause text
verbatim, every action forced to alert, and each rule's own tests are run
through the real Engine before the file is written. A draft that fails its
tests is rejected. Clauses no data proxy can enforce (tone, harassment,
expenses) are listed separately with the reason. Model set by AGGRETE_INGEST_MODEL. Needs ANTHROPIC_API_KEY
or an ant auth login profile.
Purpose binding
A permanent block gets routed around. engine.grant_purpose(user, rule_id, purpose, ttl_s) opens a scoped window and stamps every retrieval made under it
with the stated purpose. Wire it to an approval workflow owned by the clause
owner named in the rule.
Honest limitations
Entity extraction is the weak point.
entities.pyworks on stable IDs and emails. TuneIDENTIFIER_KEYSagainst your own connectors before trusting any threshold, or Layer 4 will either never fire or fire constantly.Post-call denial redacts, it does not un-fetch. The data left the upstream. Prefer rules that can be decided pre-call.
stdio identity is advisory. The user is whoever launched the process and the config is user-editable. Real enforcement needs streamable HTTP with OAuth, the subject taken from the token, and IdP-level blocking of direct connector grants so this proxy is the only path.
Aggregation cannot be solved, only narrowed. A user who spaces requests beyond the window, or paraphrases across systems this proxy doesn't front, gets through. This raises the cost and creates the audit trail; it is not a ceiling.
Not a gateway. No multi-tenancy, no token vault, no HA. For production, port this policy engine onto agentgateway or IBM ContextForge as a plugin rather than running it as your control plane.
Available Tools
12 toolsaggrete__checkCheck a plan against the code of conductA
Ask whether a sequence of tool calls would be allowed before running any of them. Returns the decision (allowed, allowed-with-alert, or refused), the rule that applies, its clause, and the remediation. Nothing is fetched. Use this to answer 'can I do X?' questions: translate the request into the tool calls it would take, then pass them as tools in order.
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes | The tool calls you are considering, in order, by their exact names on this server, e.g. ["hr__recent_joiners", "finance__budget_roles", "hr__leave_balance"]. | |
| entities | No | Optional. The people the plan concerns, as p:<email> ids, applied to each read. Omit to evaluate assuming the calls concern the same people (you and a colleague). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It explicitly states 'Nothing is fetched,' implying no data access or side effects, and explains what the tool returns. It could go further on edge cases like what triggers 'allowed-with-alert,' but it is transparent about the core behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. It front-loads the core purpose, then gives return details and a concrete usage pattern. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description covers the essential context: purpose, side effects, return values, and how to invoke it. The optional entities parameter is fully documented in the schema, so no critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the input schema already documents both parameters thoroughly. The description reinforces the idea of passing tool calls in order and translating a request into calls, but it adds limited new parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: ask whether a sequence of tool calls would be allowed, before running any of them. It also names the return values (decision, rule, clause, remediation), which makes the tool's function unmistakable and distinguishes it from sibling tools like aggrete__scenarios.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly says when to use it: before running any tool calls, and to answer 'can I do X?' questions by translating the request into tool calls. It lacks explicit when-not-to-use guidance or named alternatives, but the usage context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
aggrete__scenariosThings to try in this demoA
List concrete things to try here, each showing a different kind of policy decision (redaction, refusing a combination, individual pay, comparing colleagues, the prompt-injection shield, hidden tools). Takes no arguments. Start here if you are new.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden. 'List' signals a non-mutating read operation and 'Takes no arguments' confirms the call shape; the enumerated policy topics tell the agent what kind of content to expect. It doesn't state auth requirements or output formatting, but for a no-argument scenario listing these are minor omissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences front-load the action, then give the key decision types, the no-argument contract, and the audience guidance. Every sentence adds value and there is no redundant padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter tool with no output schema, this is complete: it says what is returned, what topics are covered, and when to start. There is no missing input/output information that would prevent a correct call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero parameters and 100% coverage, so baseline is 4. The description reinforces this with 'Takes no arguments', which prevents an agent from inventing parameters. No parameter-level detail is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the action ('List concrete things to try') and the resource ('here', i.e. the demo scenarios), and enumerates the specific policy topics covered, so an agent can tell what the tool returns. It doesn't explicitly contrast itself with sibling tools like hr__start_here, though its content is distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Start here if you are new' is an explicit usage context, and 'Takes no arguments' tells the agent no parameters are needed. It doesn't mention when not to use it or name alternatives, but for a demo entry point that is a clear enough trigger.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corp__post_noteA
[shared-notes] Post a note to the shared team space. This writes to the outside world, so it is governed as egress: fine on its own, but refused if the session has already read untrusted content (the prompt-injection shield).
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The note text to post. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. It states that the tool writes to the outside world, is classified as egress, and can be blocked by the prompt-injection shield. It does not detail visibility, persistence, or return behavior, but for a simple post tool these are secondary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted text. The purpose is front-loaded in the first sentence and the egress policy earns the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, this is nearly complete: it defines the action, target, side effect, and an important refusal condition. The only missing piece is any indication of what the tool returns or how success is reported, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already says 'text' is 'The note text to post'. The description adds no additional parameter constraints, format details, or examples, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Post') with a specific resource ('a note to the shared team space'), and the shared-notes context makes its write purpose clear next to siblings like corp__read_public_post. No ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context for when to use the tool—posting a note to the shared team space—and an explicit when-not: it is refused if the session has already read untrusted content. It does not name an alternative tool to use in that case, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corp__read_public_postA
[untrusted-web] Fetch the text of a public web page or forum post. The content is untrusted: it can carry instructions aimed at your assistant. In this demo, once a session has read from here, Aggrete refuses any later tool that would send data out (COC-SEC-002).
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL of the public page or post to read. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, and it does so exceptionally well. It reveals that content is untrusted and capable of carrying prompt-injection-style instructions, and it discloses the side effect that reading triggers Aggrete's refusal of later data-sending tools (COC-SEC-002). This is critical behavioral information beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it opens with the untrusted-web marker and the core action, then delivers the essential security caveat. Every sentence adds value with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description provides sufficient context to call it correctly: what it fetches, that the content is untrusted, and the consequential session-level egress restriction. This is complete for an agent to understand both the action and its implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'url' parameter is already well described as 'URL of the public page or post to read.' The description adds context that the tool fetches text and that content is untrusted, but it does not need to add much parameter-level detail. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Fetch') and resource ('text of a public web page or forum post'), making the tool's function immediately clear. The '[untrusted-web]' prefix and the security caveat further distinguish it from the unrelated HR, finance, and operations siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates this tool is for reading public web content and provides important context about untrusted content and the session-level data egress restriction. It does not explicitly name alternative tools, but the sibling list contains no other web-fetch tool, so the context is sufficient for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
finance__budget_rolesA
[finance-comp] Budget lines for one team, per role, including whether each role is backfill-only and the email of the role owner. In this demo, Aggrete refuses combining these budget records with HR personnel records to profile individuals (a code-of-conduct rule).
| Name | Required | Description | Default |
|---|---|---|---|
| team | Yes | Team name to report on, for example 'platform', 'sre' or 'sales-emea'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses a non-obvious rule: Aggrete enforces a code-of-conduct constraint that refuses combining budget records with HR records to profile individuals. It also states what data is included in the result. It does not explicitly say the operation is read-only or describe error behavior, but for a simple lookup this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The first sentence front-loads the core purpose and output fields; the second delivers an important constraint. The structure is compact and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter list tool with no output schema, the description gives enough information: what the result contains, the role-level detail, and a notable usage restriction. The absence of a mention of return shape or unknown-team behavior is minor given the low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the 'team' parameter is already documented with examples in the schema. The description adds only the general context of 'one team, per role,' which does not materially enrich parameter semantics beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource — budget lines for one team per role — and names the key fields returned (backfill-only flag, role owner email). It does not use an explicit verb like 'list' or 'get', and it does not clearly differentiate from the sibling finance__headcount_plan, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: the tool reports budget lines for one team, per role. It also provides an explicit when-not-to-use instruction: Aggrete refuses combining these records with HR personnel records for individual profiling, which is relevant to the hr__ sibling tools. It could be stronger by naming which tool to use instead of this one in other finance scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
finance__headcount_planA
[finance-planning] Aggregate headcount plan for one team: approved, filled and open role counts. Returns totals only, never individual people. Use it to see how many roles a team is budgeted for and how many are still open.
| Name | Required | Description | Default |
|---|---|---|---|
| team | Yes | Team name to report on, for example 'platform', 'sre' or 'sales-emea'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the key behavioral traits upfront: results are totals only, never individual people, and the scope is exactly one team. It does not cover error handling or data freshness, but for a read-only aggregate tool the main privacy and aggregation behaviors are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: the first states function and core constraint, the second gives a user-oriented purpose. There is no filler, and the most important facts are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one required parameter and no nested objects, and the description covers scope, output nature, and intended use. It lacks an output schema and does not spell out behavior for unknown team names, so it is complete but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers the only parameter, team, at 100% with a clear description and examples ('platform', 'sre', 'sales-emea'). The tool description adds no parameter-level detail beyond restating 'one team', so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the specific verb 'Aggregate' and a clear resource: headcount plan for one team, enumerating approved, filled, and open role counts. It also clarifies scope with 'one team' and 'Returns totals only, never individual people.' It stops short of a 5 because it does not explicitly differentiate from the sibling finance__budget_roles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states a concrete use case: 'Use it to see how many roles a team is budgeted for and how many are still open.' This is clear contextual guidance, but it does not name alternatives like finance__budget_roles or state when not to use the tool, so it earns 4 rather than 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
finance__pay_bandA
[pay-aggregates] Average pay for a category of workers. Pay may be shared only as averages for large enough groups: a category describing fewer than ten people resolves to individual pay and Aggrete refuses it (COC-HR-031). A broad category (a job family or location) is fine.
| Name | Required | Description | Default |
|---|---|---|---|
| category | Yes | Worker category to average, for example 'engineering' or 'sales-emea'. Small categories like 'executives' or 'legal' describe only a few people. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so well by disclosing that small categories resolve to individual pay and are refused under policy COC-HR-031. This reveals an important failure behavior and privacy constraint that an agent would not otherwise know.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences with no filler. The purpose is front-loaded, and the constraint is stated efficiently with a policy reference rather than unnecessary explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no annotations, the description provides the core purpose, the key boundary condition, and a refusal behavior. It does not describe the exact return format or currency, but the meaning of 'average pay' is clear enough to make a correct call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the single 'category' parameter at 100% coverage, so the baseline is 3. The description adds real value by defining the ten-person threshold and clarifying that broad categories are appropriate, which helps the agent choose a safe input value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Average pay for a category of workers', which names the specific operation, resource, and scope. It also clearly distinguishes this tool from the sibling tools, which cover on-call, timecards, posts, budget roles, and headcount planning rather than pay aggregation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete guidance on when the tool can and cannot be used: categories with fewer than ten people are refused, while broad categories such as job family or location are acceptable. It does not name alternative tools, but the when/when-not guidance is explicit enough for the simple parameter set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hr__leave_balanceA
[hr-personnel] Look up the remaining leave and absence balance for one person by email. In this demo, Aggrete redacts the email in the result before it reaches the model.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | Email address of the person whose leave balance to look up, for example 'alice.n@example.com'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does disclose a notable behavior: Aggrete redacts the email from the result before it reaches the model. This goes beyond the basic purpose and gives the agent useful expectations about output privacy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, front-loaded with the core purpose, and the demo redaction note is the only extra information. Every sentence adds value and there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter lookup with no output schema, the description plus schema is adequate: purpose, input, and a relevant behavioral note are all present. It does not detail error cases or exact response structure, but those are not essential for this tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the email parameter already has a clear description with an example. The tool description adds 'by email' but does not materially improve on the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Look up') and a specific resource ('remaining leave and absence balance') scoped to one person by email. This clearly distinguishes the tool from sibling tools like hr__recent_joiners, which operate on groups or lists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates this is for a single-person lookup identified by email, which provides enough context to avoid confusion with the sibling HR tools. It does not explicitly name alternatives or state when not to use the tool, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hr__recent_joinersA
[hr-personnel] List the people who joined a team within the last N months, with each person's email, employee id and start date. Use it to find recent hires on a team.
| Name | Required | Description | Default |
|---|---|---|---|
| team | Yes | Team name to report on, for example 'platform', 'sre' or 'sales-emea'. | |
| months | No | Look-back window in months (1 to 60). Defaults to 18. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does disclose that this is a listing operation and names the returned fields, which is useful. It does not mention ordering, pagination, whether 'joined' refers to team membership vs hire date, or any access/authorization considerations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The primary action and resource are front-loaded, and the use-case sentence earns its place by guiding selection.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with two parameters and no output schema, the description is largely sufficient: it states inputs, purpose, and expected output fields. It could be slightly more complete by clarifying edge cases around the time window or result ordering, but nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented with examples and constraints. The description mostly restates the time-window concept ('within the last N months') and does not add significant new meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('people who joined a team within the last N months'), and clarifies the returned fields: email, employee id, and start date. It is clearly distinct from sibling tools by topic, though it does not explicitly contrast itself with any sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states a clear use case: 'Use it to find recent hires on a team.' This gives an agent a direct trigger condition for selecting the tool. It does not, however, list exclusions or explicitly contrast with nearby HR tools like hr__start_here or hr__leave_balance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hr__start_hereA
[hr-personnel] Start here. Explains what this demo is and points you at the guided menu. Takes no arguments.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It clearly states the tool 'takes no arguments' and describes its behavior as explaining and pointing, implying a read-only informational action. It does not discuss side effects or output format, but for such a simple tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: three short phrases, each earning its place. 'Start here' is front-loaded, followed by the tool's purpose and argument clarification. There is no filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-argument, no-output-schema orientation tool, this description is complete. It tells the agent what the tool does, that it requires no arguments, and how it guides the user. Nothing essential is missing for invoking it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already shows zero properties, but the description reinforces this by explicitly stating 'Takes no arguments.' Since there are no parameters, the description adds the needed semantic confirmation beyond the schema, warranting the baseline 4 for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose: it is an entry point that 'Explains what this demo is and points you at the guided menu.' This uses a specific verb/resource combination and clearly distinguishes the tool from the sibling HR, finance, ops, and corp tools, which are all operational rather than orientation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Start here' is an explicit directive to invoke this tool first, which is strong usage guidance for an entry-point tool. It does not name alternatives or specify when not to use it, but given the tool's simple orientation role and zero arguments, the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hr__timecardA
[timesheets] Timecard for one person by email: hours logged per week this month. In this demo, putting your own timecard next to a colleague's to compare is refused (COC-HR-021); reviewing your team's cards is fine.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | Email of the person whose timecard to read, for example your own or a colleague's. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses an important non-obvious guardrail: attempting to place your own timecard next to a colleague's for comparison is refused under COC-HR-021, while team review is allowed. This gives the agent actionable policy context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no wasted words. It front-loads the core operation and then adds the necessary policy exception. The category tag and policy code convey extra context efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description gives the input scope (one person by email), the output semantics (hours per week this month), and the key access restriction. Nothing essential is missing for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single email parameter has 100% schema description coverage, so the schema already documents its meaning. The description only repeats 'by email' without adding new format, default, or usage detail. The schema's own example ('your own or a colleague's') is more informative than the description's mention.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('timecard for one person by email') and the exact output ('hours logged per week this month'). This clearly distinguishes it from sibling HR tools like leave balance or recent joiners. The [timesheets] prefix adds useful category context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The first clause states when to use the tool: to read one person's timecard by email. The demo caveat explicitly marks a refused use case (comparing your own card with a colleague's) and an allowed one (reviewing your team's cards). It does not name an alternative tool, but no sibling appears to cover this exact function.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ops__oncall_draftA
[ops-rota] Draft an on-call rotation for one team and quarter: one shift per week with the assigned person's email. Use it to propose who is on call, week by week.
| Name | Required | Description | Default |
|---|---|---|---|
| team | Yes | Team name to report on, for example 'platform', 'sre' or 'sales-emea'. | |
| quarter | Yes | Quarter to draft, in the form 'YYYY-Qn', for example '2026-Q1'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the responsibility for behavioral disclosure. 'Draft' and 'propose' signal a non-committal, generated rotation rather than a final schedule, and the output content is stated. However, it does not disclose side effects, persistence, permissions, or whether anything is actually written to the rota.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler; the core action and scope are front-loaded in the first sentence. The second sentence clarifies the intended use without repeating the schema. It is efficient and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool, the schema covers the inputs and the description covers the output format (weekly shifts with the assigned person's email). No output schema exists, but an agent receives enough to invoke it correctly. It would benefit from stating what happens when no person is available, but that is a marginal gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are fully documented in the schema with format constraints and examples, so the schema does the heavy lifting. The description reinforces that team and quarter are the scope, but adds no parameter-level meaning beyond that. A baseline of 3 is appropriate given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with the specific action 'Draft an on-call rotation' and immediately scopes it to 'one team and quarter.' It adds output detail—'one shift per week with the assigned person's email'—which makes the tool's purpose concrete. No sibling tool covers this domain, so it is distinguishable from the listed HR/finance tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells the agent to use the tool 'to propose who is on call, week by week,' which establishes the primary use case. It also constrains use to a single team and quarter. There are no alternative on-call siblings, so no exclusion condition is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
- Added
aggrete__check - Added
aggrete__scenarios - Added
corp__post_note - Added
corp__read_public_post - Added
finance__pay_band - Added
hr__timecard
6 tool updates
v0.5.4- Changed
finance__budget_roles1 field changed- added
Input schema / properties / team / descriptionAdded value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
- Changed
finance__headcount_plan1 field changed- added
Input schema / properties / team / descriptionAdded value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
- Changed
hr__leave_balance1 field changed- added
Input schema / properties / email / descriptionAdded value: +"Email address of the person whose leave balance to look up, for example 'alice.n@example.com'."
- Changed
hr__recent_joiners4 fields changed- added
Input schema / properties / months / descriptionAdded value: +"Look-back window in months (1 to 60). Defaults to 18." - added
Input schema / properties / months / maximumAdded value: +60 - added
Input schema / properties / months / minimumAdded value: +1 - added
Input schema / properties / team / descriptionAdded value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
- Added
hr__start_here - Changed
ops__oncall_draft2 fields changed- added
Input schema / properties / quarter / descriptionAdded value: +"Quarter to draft, in the form 'YYYY-Qn', for example '2026-Q1'." - added
Input schema / properties / team / descriptionAdded value: +"Team name to report on, for example 'platform', 'sre' or 'sales-emea'."
5 tool updates
v0.5.2- First observed
finance__budget_roles - First observed
finance__headcount_plan - First observed
hr__leave_balance - First observed
hr__recent_joiners - First observed
ops__oncall_draft
TDQS
Most tools map cleanly to a distinct resource/action, but the two no-argument onboarding tools (hr__start_here and aggrete__scenarios) overlap in purpose and could mislead an agent. The rest of the set is clearly separated by domain prefix and output kind.
The double-underscore domain prefix (ops__, hr__, finance__, corp__, aggrete__) is consistent and helpful. However, suffixes mix resource nouns (timecard, pay_band, budget_roles) with action verbs (read_public_post, post_note, start_here), so the convention is not fully predictable.
12 tools is a well-scoped size for a multi-domain policy demo. Each tool appears to have a distinct role, and none feel redundant or like padding.
The set covers the policy scenarios it advertises: redaction, refusing combinations, individual pay, colleague comparison, prompt-injection egress, and onboarding. It is not a full CRUD API—there are no update/delete operations or read-back for posted notes—but those are minor gaps for a demo-oriented server.
Maintenance
Related MCP Connectors
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Related MCP Servers
- AlicenseAqualityAmaintenanceLocal zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.45Apache 2.0

Blekline MCP Serverofficial
AlicenseAqualityAmaintenanceProvides AI ingress governance by masking prompts, classifying risk, and enforcing tool policies before agent calls reach model providers or sandboxes.61AGPL 3.0- AlicenseBqualityAmaintenanceA governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.13MIT
- AlicenseNot gradedqualityBmaintenanceDeterministic policy enforcement for AI agent tool calls. It evaluates every tool call against user-defined rules before execution, with no LLM in the authorization path.3MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Aggrete/aggrete'
If you have feedback or need assistance with the MCP directory API, please join our Discord server