Skip to main content
Glama
Sign In
Security Controls MCP Server

Security Controls MCP Server

by Ansvar-Systems
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

get_control

Retrieve a specific SCF control by its exact ID, with details like domain, description, criticality weight, and cross-framework mappings.

Instructions

Retrieve a specific SCF control by its exact ID. Returns the control's domain, description, weight (1-10 criticality), PPTDF classification, validation cadence, and optionally all framework mappings. Use this when you already know the control ID (e.g., GOV-01, IAC-05, CRY-01). If you don't know the ID, use search_controls first. Returns 'not found' for invalid IDs. With include_mappings=true (default), returns ~1000-3000 tokens depending on how many frameworks map to this control. Set include_mappings=false to reduce to ~200 tokens.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "control_id": "<control_id>"
    },
    "name": "get_control"
  }
}

Input Schema

NameRequiredDescriptionDefault
control_idYesSCF control ID in format DOMAIN-NN (e.g., GOV-01, IAC-05, CRY-01, NET-01). Use search_controls to discover valid IDs.
include_mappingsNoInclude cross-framework mappings in the response. Set to false to reduce token usage when you only need the control description. Default: true.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.1.1

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description fully covers behavioral traits: it discloses the return values (domain, description, etc.), warns about token sizes (~1000-3000 vs ~200 tokens), and explicitly states that invalid IDs return 'not found'. This is comprehensive transparency for a read-only retrieval tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with the main purpose first, followed by usage guidance, behavior notes, and parameter details. All sentences add value, though there is slight redundancy in mentioning token sizes twice. It is front-loaded and concise enough, but could be trimmed slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description adequately explains what the tool returns (domain, description, weight, etc.), covers error behavior ('not found'), and provides token size estimates. Combined with the schema's parameter descriptions, it gives a complete picture for an agent to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the input schema already provides descriptions for both parameters (control_id with pattern and include_mappings with default/description), the description adds significant meaning: it provides concrete ID examples, explains the token size implications of include_mappings, and reinforces the relationship with search_controls for discovering valid IDs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve a specific SCF control by its exact ID' and lists the returned fields (domain, description, weight, PPTDF classification, etc.), with explicit examples of control IDs. It distinguishes itself from sibling tool search_controls by specifying the precondition of knowing the ID.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool ('when you already know the control ID') and when not to ('If you don't know the ID, use search_controls first'). It also provides guidance on the include_mappings parameter, advising to set it to false to reduce token usage when only the control description is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools