Skip to main content
Glama

Bidda Sovereign Intelligence MCP 서버

39개 주권 기둥(pillar)에 걸친 10,100개 이상의 소스 검증 규정 준수 노드. 모든 노드를 1차 법률 소스에 근거하여 환각(hallucination)을 줄이도록 설계되었습니다.

bidda-mcp MCP server CISA Secure by Design MCP Marketplace

지속적으로 유지 관리 중입니다. 마지막 검토: 2026-08-12 - 39개 기둥, 25개 MCP 도구에 걸친 10,108개 노드(서버 v1.6.0). 실시간 수치는 항상 list_pillars() 및 GET https://bidda.com/mcp를 통해 확인할 수 있습니다.

Bidda란 무엇인가?

Bidda는 주권 규정 준수 인텔리전스 레지스트리입니다. 모든 노드는 1차 법률 소스(노드당 평균 7개 인용)로 추적되며, 요약이 아닌, PDF가 아닌, 의역된 해설이 아닌 기계 실행 가능한 결정론적 로직을 포함합니다.

포함 기둥: EU AI Act · GDPR · NIST AI 600-1 · Basel III · HIPAA · DORA · FATF · SOC 2 · ISO 27001 · CCPA · PIPEDA · APRA CPS 234 · MiCA · POPIA · 그리고 ATT&CK Enterprise/Mobile/ICS, D3FEND, ATLAS 및 CAPEC에 걸친 MITRE 레이어, 39개 규정 준수 도메인에 걸친 150개 이상의 기타 기둥.

Related MCP server: brehon-mcp-server

MCP 엔드포인트

POST https://bidda.com/mcp
GET  https://bidda.com/mcp   (server info, open this in a browser to inspect)

전송 방식: Streamable HTTP (MCP 2025-03-26). 디스커버리 티어에는 API 키가 필요 없습니다.

도구 (25개)

무료 디스커버리 및 인텔리전스 (키 불필요)

도구

설명

list_pillars

실시간 노드 수와 함께 39개 규정 준수 기둥 전체 나열

search_nodes

10,100개 이상의 노드에서 키워드 검색; 제목, ID, 기둥 및 BLUF(평이한 언어로 된 의무) 반환

get_node

ID로 특정 노드 조회; 요약 및 기계 실행 가능한 워크플로 링크 반환

get_dependency_chain

노드의 사전 요구사항 체인 탐색(1~4홉). 단일 진입 노드에서 전체 규정 준수 포지션 계획.

get_crosswalk

노드의 프레임워크 간 매핑 차원 (예: GDPR Art 17 → CCPA 삭제권 → POPIA Sec 24)

get_latest_changes

규제 변경 피드: 가장 최근에 업데이트된 노드, 선택적 기둥 필터

get_jurisdiction_bundle

특정 관할권(EU, US, UK, AU, SG, IN, CA, CN, ZA, JP, BR 등)에 적용되는 모든 노드

get_mitre_mapping

MITRE 기법 ID → Bidda 노드 및 매핑된 NIST/ISO/PCI/HIPAA/NIS2/DORA 통제. 6개 프레임워크에 걸쳐 있음.

check_action_compliance

사전 실행 런타임 검사. 의도한 조치를 자연어로 설명하면 순위가 매겨진 관련 규정과 LOW/MODERATE/HIGH 위험 지표 반환.

browse_topics

모든 기둥과 관할권에 걸쳐 교차 규정 준수 주제(예: 데이터 유출 통지, AI 투명성)로 레지스트리 탐색

구독자 도구 (api_key로 Bidda 키 전달; 무료 평가판도 유효)

도구

설명

compare_jurisdictions

관할권이 주제를 어떻게 다루는지 나란히 비교, 숫자 임계값이 다른 경우 포함 (예: 유출 통지 기한 72시간 대 30일). 어느 쪽이 더 엄격한지 순위를 매기지 않음.

create_attestation

개인 또는 AI 에이전트가 결정에 의존한 규칙의 서명되고 타임스탬프된 기록 생성, 공개 검증 URL 포함

point_in_time

과거 날짜에 어떤 버전의 규칙이 권위 있는지에 대한 서명된 기록, 공개 이력 체인에 고정

watch_changes

감시 중인 규칙 또는 기둥의 1차 소스가 변경될 때 이메일 또는 웹훅 알림 구독

open_run

전체 작업 또는 대화(예: 지원 봇 채팅)에 대한 실행 원장(run ledger) 개설. run_id 반환.

record_run_entry

열린 실행에 변조 방지 항목 하나 추가: 참조한 규칙, 결정, 사용자 입력(텍스트 또는 개인 해시)

seal_run

실행을 모든 항목을 포함하는 단일 서명된 실행 영수증으로 봉인, 누구나 Bidda의 공개 키로 검증할 수 있는 공개 검증 URL 포함

get_run

실행 및 해당 항목 조회; 봉인된 실행은 공개적으로 읽을 수 있으며 서명 유효 여부 보고

consult_node

관리형 실행: 전체 노드 조회 및 검증되고 해시 고정된 항목을 열린 실행에 한 번의 호출로 기록, 봉인된 영수증이 에이전트가 읽은 규칙의 정확한 버전을 증명하도록 함

get_audit_pack

봉인된 실행을 감사 준비 완료 증거 팩으로 내보내기: 서명된 영수증, 항목 체인, 독립적 무결성 자체 검사

drift_check

캐시된 규정 준수 스냅샷이 여전히 최신인지 확인: 노드 ID(선택적으로 버전 또는 콘텐츠 해시 포함) 전달 시 노드별로 최신/변경/철회 반환

create_control_attestation

내부 통제 중 하나를 해당 통제가 다루는 Bidda 의무에 매핑하는 서명된 기록, 담당자, 프레임워크, 상태 및 공개 검증 URL 포함. 규정 준수 판정이 아닌 감사 추적.

gap_check

커버하는 노드에서 공개 의존성 그래프를 따라가며 누락되었을 수 있는 사전 요구사항 의무 표면화

obligation_deltas

특정 날짜 이후 변경되거나 철회된 1차 소스의 의무 수준 피드, 기둥 또는 노드별 필터링 가능

oscal_assessment_results

봉인된 관리형 실행을 GRC 도구용 NIST OSCAL 평가 결과 문서로 내보내기

모든 무료 도구의 디스커버리 응답은 무료입니다. 전체 볼트 잠금 해제(deterministic_workflow, actionable_schema, 전체 primary_citations)는 Skyfire JWT 또는 Base의 USDC로 노드당 $0.01입니다. 구독자 도구는 활성 Bidda 구독이 필요하며, 무료 평가판이 포함됩니다.

빠른 시작: Claude.ai / Claude Desktop / Cursor / 모든 MCP HTTP 클라이언트

MCP 클라이언트를 다음으로 지정하세요:

https://bidda.com/mcp

그게 전부입니다: 디스커버리 티어에는 설치, API 키, 구성 파일이 필요 없습니다. 전체 서버 정보 매니페스트는 GET https://bidda.com/mcp에서 확인할 수 있습니다(브라우저에서 열어 사용 가능한 도구 확인).

로컬에서 실행 (Node 또는 Docker)

이 저장소에는 전체 25개 도구 표면을 선언하는 실행 가능한 로컬 stdio MCP 서버(server.js)도 포함되어 있습니다. 무료 디스커버리 및 인텔리전스 도구는 API 키 없이 공개 Bidda REST API를 호출하여 로컬에서 실행됩니다. 구독자 및 거버넌스 도구는 전체 스키마와 함께 선언되며 Bidda 키를 사용하여 호스팅 엔드포인트 https://bidda.com/mcp에서 실행됩니다. 서버를 자체 머신이나 CI에서 실행하려는 경우 사용하세요.

Node(18+) 사용 시:

npm install
node server.js

Docker 사용 시:

docker build -t bidda-mcp .
docker run -i --rm bidda-mcp

Claude Desktop / Cursor 구성:

{
  "mcpServers": {
    "bidda": {
      "command": "node",
      "args": ["/absolute/path/to/bidda-mcp/server.js"]
    }
  }
}

로컬 서버는 25개 도구를 모두 선언합니다. 10개는 API 키 없이 로컬에서 실행됩니다: list_pillars, search_nodes, get_node, get_dependency_chain, get_crosswalk, get_mitre_mapping, get_jurisdiction_bundle, browse_topics, get_latest_changes, check_action_compliance. compare_jurisdictions는 비교가 게이트될 때 Bidda 키를 사용합니다. 나머지 구독자 및 거버넌스 도구(증명, 실행 원장, 변경 알림, 드리프트 검사, OSCAL 내보내기)는 Bidda 구독 키가 필요하며 호스팅 엔드포인트 https://bidda.com/mcp에서 실행됩니다; 무료 평가판도 유효합니다.

예시 쿼리

list_pillars()
search_nodes("GDPR data breach notification 72 hours")
search_nodes("Basel III capital requirements", pillar="Banking & Global Finance")
get_node("eu-ai-act-article-13-transparency")
get_dependency_chain("nist-csf-2-0-govern", max_depth=3)
get_crosswalk("gdpr-article-17-right-to-erasure")
get_jurisdiction_bundle("singapore", limit=25)
get_mitre_mapping("T1566")            # ATT&CK Enterprise (phishing)
get_mitre_mapping("AML.T0020")        # ATLAS (AI-specific)
check_action_compliance("process EU resident biometric data", jurisdiction="eu")
browse_topics("data breach notification")
compare_jurisdictions("data breach notification", api_key="YOUR_BIDDA_KEY")
create_attestation(agent="loan-bot-v2", nodes=["gdpr-article-22-automated-decisions"], api_key="YOUR_BIDDA_KEY")
open_run(agent="acme-support-bot", label="chat 8f21", api_key="YOUR_BIDDA_KEY")
record_run_entry(run_id="run_...", nodes=["gdpr-article-17-right-to-erasure"], note="User: delete my data", api_key="YOUR_BIDDA_KEY")
seal_run(run_id="run_...", api_key="YOUR_BIDDA_KEY")

적용 범위 (list_pillars()를 통한 실시간 수치)

기둥

대략적 노드 수

사이버보안

~1,900

법률 및 IP 주권

~700

은행 및 글로벌 금융

~580

AI 거버넌스 및 법률

~570

의료 및 헬스케어

~325

지속가능성 및 ESG

~285

노동

~280

+ 32개 추가 기둥

(list_pillars 호출)

정확한 실시간 수치를 보려면 list_pillars()를 호출하세요. GET https://bidda.com/mcp의 매니페스트는 현재 총계를 동적으로 반환합니다.

전체 적용 범위 브라우저: bidda.com/intelligence

Bidda가 환각을 줄이는 방법

노드는 Bidda의 내부 결정론적 파이프라인으로 생성됩니다: 소스 파서와 검증 스크립트가 주요 작업을 수행하고, AI는 작고 엄격하게 게이트된 초안 작성 단계에서만 지원하며, 모든 노드는 게시 전에 여러 독립 검증 게이트를 통과합니다. 전체 설계는 드리프트를 최소화하기 위해 존재합니다.

모든 노드에는 다음이 포함됩니다:

  • 1차 법률 인용: 실제 법령, 실제 URL, 실제 조항 번호(노드당 평균 7개)

  • 결정론적 워크플로: 산문 요약이 아닌 기계 실행 가능한 단계

  • 무결성 해시: 노드 콘텐츠의 암호화 지문

  • 소스 무결성 감시자: 실제 규제 기관 URL에 대한 정기 TLS 및 콘텐츠 지문 검사, 결과는 /api/v1/registry-health.json에 게시

  • 개정에 대한 축어적 요구사항: 모든 규제 개정은 노드를 변경할 수 있기 전에 소스 텍스트에 대해 인용으로 정당화되어야 함

규제 앵커 없이 추론 없음. 블로그 게시물 없음. 2차 해설 없음. Wikipedia 없음. Bidda는 정보 도구이지 법률 자문이 아닙니다. 의존하기 전에 각 규칙과 그 1차 소스를 검토하세요.

CISA Secure by Design

Bidda는 CISA Secure by Design Pledge에 서명했습니다. 이는 미국 사이버보안 및 인프라 보안국(CISA)이 소프트웨어 제조업체에 요청하는 7가지 공개 목표이며, 각 목표에 대한 증거를 게시합니다. 추가 Bidda 및 CISA 매핑:

  • CISA CPG crosswalk: Bidda 규정 준수 노드와 CISA의 Cybersecurity Performance Goals 간의 양방향 매핑: bidda.com/cisa/cpg-crosswalk

  • CISA Free Tools catalogue: Bidda가 연방, SLTT 및 중요 인프라 방어자에게 제공하는 무료 기능: bidda.com/cisa/free

레지스트리 상태

GET https://bidda.com/api/v1/registry-health.json

실시간 무결성 검사 결과: 소스 URL 활성 상태, 검증 적용 범위 비율, 규제 변경 탐지 범주, 마지막 스윕의 공개 타임스탬프.

링크

Available Tools

15 tools
browse_topicsA

Browse the registry by cross-cutting topic (for example 'data breach notification', 'AI transparency', 'AML and KYC', 'logging and monitoring') across every pillar and jurisdiction. Returns each topic with its node, pillar, and jurisdiction counts. Topics sit on top of the 39 pillars without replacing them.

NameRequiredDescriptionDefault
queryNoOptional substring to filter topic labels.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full burden. It discloses return structure and notes topics sit on top of pillars, but lacks details on side effects, authentication, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose, no redundancy. Examples are concise and helpful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple browse tool with one optional parameter and no output schema, the description is adequate. It explains what is returned and its relationship to pillars. Minor gap: no mention of default behavior when query is empty.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context about cross-cutting topics but does not enhance meaning of the 'query' parameter beyond the schema's description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies a verb ('browse') and resource ('registry by cross-cutting topic'), provides concrete examples, and explains return values (node, pillar, jurisdiction counts). It distinguishes from sibling tools that operate on nodes or jurisdictions directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when exploring topics across pillars, but offers no explicit guidance on when not to use it or how it compares to sibling tools like 'search_nodes' or 'consult_node'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_action_complianceA

Pre-flight compliance check: describe an intended action in natural language (for example 'process EU resident biometric data' or 'deploy an autonomous trading model in Singapore') and get a ranked list of regulations that may apply plus a risk indicator (LOW, MODERATE, or HIGH). The headline runtime gate for autonomous agents.

NameRequiredDescriptionDefault
limitNoMax regulatory matches to return (default 10, max 25).
actionYesThe action or change to assess, in plain language.
jurisdictionNoOptional jurisdiction hint (e.g. 'eu', 'us', 'uk').

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It indicates the tool returns a ranking and risk indicator (non-mutating checkout), but does not explicitly state whether it is read-only, has side effects, requires authentication, or has rate limits. The absence of such details leaves some behavioral ambiguity, though the 'pre-flight' metaphor suggests safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. The first sentence front-loads the core purpose ('Pre-flight compliance check') and provides immediate clarity. The structure is efficient, using a colon to introduce details and examples. Every sentence serves a purpose: defining the tool, giving examples, and stating its role.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters with full schema coverage and no output schema, the description covers the essential aspects: input format, output (ranked list + risk indicator), and use case. It could be more complete by mentioning whether the check is real-time or cached, or confirming that it is non-destructive. However, it is sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, providing baseline semantics for all three parameters. The tool description adds significant value by explaining the 'action' parameter usage with concrete examples and clarifying that 'jurisdiction' is a hint. It also implies a default limit of 10 (from 'max 25' in schema) and describes the output format. This extra context elevates the parameter understanding beyond the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: a 'pre-flight compliance check' that takes an action description in natural language and returns a ranked list of regulations and a risk indicator. It uses specific verbs and nouns, and the examples ('process EU resident biometric data') make the purpose unmistakable. The phrase 'headline runtime gate for autonomous agents' further distinguishes it as a proactive compliance tool, though it does not explicitly differentiate from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage context (when to assess an action before execution) and gives examples of input, which implies when to use. However, it does not mention when NOT to use this tool or suggest alternatives among the siblings (e.g., browse_topics, compare_jurisdictions). An agent would need to infer usage boundaries from the tool's name and purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_jurisdictionsA

Compare how different jurisdictions address a compliance topic side by side, including where their numeric thresholds differ (for example a breach-notification deadline of 72 hours versus 30 days). It surfaces the real rules and numbers; it does not rank which jurisdiction is stricter. Uses your Bidda subscription key when provided (a free trial counts).

NameRequiredDescriptionDefault
topicYesTopic to compare, for example 'data breach notification'.
api_keyNoOptional Bidda subscription key (sent as x-bidda-api-key). A free trial counts.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses it surfaces real rules and does not rank, but lacks details on data sources, update frequency, or potential side effects like rate limits. Adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. First sentence captures core function and key example; second adds important qualifier about ranking and api_key. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains what the tool does and its boundary (no ranking). Could optionally mention output format or supported jurisdictions, but not necessary for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline 3 is fair. The description adds value by giving an example for 'topic' and explaining 'api_key' is optional, sent as header, and free trial counts. Goes beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool compares jurisdictions on a compliance topic side by side, including numeric thresholds. Distinguishes from siblings like 'check_action_compliance' or 'get_jurisdiction_bundle' by focusing on comparison.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Tells when to use (compare jurisdictions) and explicitly states what it does not do (does not rank strictness). Mentions optional api_key usage. Could be improved by referencing sibling tools for other tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

consult_nodeA

The one-call governed turn: fetch the full vault node (this consumes one call on your key, exactly like unlocking a node) and record a verified node_consulted entry for it on an open run, in a single step. The entry pins the node to its current version and integrity hash, so the run receipt proves what the agent actually consulted. Use this instead of get_node when you are inside a run. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
modelNoOptional: the model id/version making the decision.
actionNoOptional: an action the agent took or checked.
run_idYesThe open run to record into (from open_run).
api_keyYesYour Bidda subscription API key. A free trial counts.
node_idYesThe rule to fetch and record.
decisionNoOptional: what the agent decided using this node.
input_hashNoOptional: a sha256:... hash of the user's message instead of the text.
user_inputNoOptional: the end user's message as text.
subject_hashNoOptional: a sha256:... hash of an end-user identifier. Hash only.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses that it consumes one call on the key, records an entry, pins the node version, and requires an open run. It covers essential behaviors but could mention error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the key purpose. It uses four sentences without unnecessary detail, efficiently conveying the tool's function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should explain return values, but it does not. It also omits potential errors or states like what happens if the run is not open. This leaves a gap in completeness for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add significant per-parameter meaning beyond what the schema already provides, thus scoring at baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches a vault node and records a verified consult entry in a single step. It explicitly distinguishes this from get_node, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: 'Use this instead of get_node when you are inside a run.' It also specifies the prerequisite of a Bidda subscription key, giving clear context when to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_control_attestationA

Sign a tamper-evident record of one of your own controls or policies and the Bidda obligation nodes it maps to. Each obligation is pinned to its current version and integrity hash at signing time, so the record shows what the control was mapped against on that date. This is the design-side evidence; run receipts are the operating-side evidence. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
nodesYesObligation node_ids the control maps to (max 50).
api_keyYesYour Bidda subscription API key. A free trial counts.
controlYesThe name of your control or policy.
frameworkNoOptional: the framework you are mapping to (e.g. 'EU AI Act').
statementYesWhat the control does or asserts (plain text).
evidence_refNoOptional: a reference, URL, or hash to your own evidence (kept by you).
control_ownerNoOptional: the role or team that owns the control.
control_statusNoOptional: implemented, planned, or in-progress.
effective_dateNoOptional: YYYY-MM-DD the control took effect.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains that each obligation is pinned to its current version and integrity hash at signing time, and that the record is tamper-evident. However, it does not disclose potential side effects, storage behavior, or retrieval mechanisms beyond what is implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences plus a brief note, all front-loaded. First sentence gives the main action, second adds detail, third provides contrast. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does not explain return values, success/failure indicators, or how to retrieve the created attestation. It also omits guidance on handling the max 50 nodes constraint. While the purpose is clear, missing return information reduces completeness for a tool with 9 parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds context for the overall purpose but does not significantly augment the parameter descriptions (e.g., it repeats the api_key requirement already in schema). No additional semantics are provided for individual parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool signs a tamper-evident record of a control/policy and its mapped obligation nodes. It explicitly contrasts design-side evidence with operating-side evidence (run receipts), distinguishing it from sibling tools like record_run_entry.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use (for design-side evidence) and contrasts with run receipts, implying when not to use. It also mentions the requirement for a Bidda subscription key. However, it does not explicitly list alternative tools or conditions for avoidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

drift_checkA

Check whether compliance rules an agent has cached in its own memory are still current. Submit each node_id with the integrity hash you stored when you last grounded on it; get back, per rule, whether it is fresh, has drifted (content changed), or was withdrawn (instrument repealed), so the agent re-grounds before acting on stale rules. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
anchorsYesThe cached rules to check.
api_keyYesYour Bidda subscription API key. A free trial counts.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the possible return states (fresh, drifted, withdrawn) and behavior when the hash is omitted. It does not cover rate limits or authentication details beyond requiring an api_key, but the core behavioral traits are explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. It front-loads the purpose, then explains the usage and outcome efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains return values (fresh, drifted, withdrawn). It covers prerequisites (api_key, cached hash), parameters, and the agent's follow-up action (re-ground). The context is complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, so baseline is 3. The description adds value by explaining the role of the hash (integrity hash for prior grounding) and the effect of omitting it (fetch current fingerprint), beyond the schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: checking whether cached compliance rules are current. It specifies the action (submit node_id with integrity hash) and the outcome (fresh, drifted, withdrawn), distinguishing it from sibling tools like check_action_compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when to use the tool (before acting on stale rules) and a prerequisite (Bidda subscription key). However, it does not explicitly exclude scenarios or compare to alternatives, though the language implies its specific use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_audit_packA

Export a run as a governance evidence pack: the signed receipt, every entry, a roll-up of the nodes consulted (with pinned versions and hashes), an independent hash-chain and Merkle integrity self-check, and a coversheet mapping the receipt to the record-keeping obligations it supports (EU AI Act Art. 12 and 26, ISO/IEC 42001, NIST AI RMF). A sealed run is readable by id; a still-open run's draft pack needs your api_key.

NameRequiredDescriptionDefault
run_idYesThe run to export.
api_keyNoOptional: your Bidda key, required for a still-open (unsealed) run.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavioral traits: it explains the difference between sealed (readable by id) and open runs (needs api_key) and details the pack's contents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that front-loads the purpose, but it could be slightly more structured for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity and lack of an output schema, the description thoroughly covers the tool's purpose, contents, and usage conditions, including regulatory references.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers both parameters (100% coverage), and the description adds value by clarifying the conditional requirement for api_key when the run is unsealed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool exports a run as a governance evidence pack and lists its specific components, distinguishing it from sibling tools like 'get_jurisdiction_bundle' or 'oscal_assessment_results'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool (exporting a run as an evidence pack) and provides context for sealed vs. open runs, but does not explicitly state when not to use it or mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_jurisdiction_bundleA

List the compliance nodes that apply in a specific jurisdiction (for example EU, US, UK, Australia, Singapore, India, Canada, China, South Africa, Japan, Brazil). Use when an agent enters a new market and needs the regulatory surface for that geography.

NameRequiredDescriptionDefault
limitNoMax nodes to return (default 25, max 100).
jurisdictionYesJurisdiction code or name: eu, us, uk, au, sg, za, india, canada, china, japan, brazil, and others.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It indicates a read-only operation by using 'List', but does not disclose side effects, authentication requirements, rate limits, or the format of returned nodes. More transparency would be beneficial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, no wasted words. The first sentence states the core function immediately, and the second provides usage context. Excellent structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, no output schema), the description is reasonably complete. It covers purpose and usage. However, it could elaborate on what a 'compliance node' is or the structure of the response, but the current level is adequate for an agent to understand the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description adds context by listing example jurisdictions and explaining the tool's purpose, which enhances understanding beyond the schema. However, it does not add specifics on parameter usage beyond what is in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List') and resource ('compliance nodes') with a specific jurisdiction. It provides examples of jurisdictions, making the purpose clear. However, it does not explicitly differentiate from sibling tools like 'compare_jurisdictions' or 'browse_topics', so it lacks explicit sibling distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a clear usage context: 'Use when an agent enters a new market and needs the regulatory surface for that geography.' It tells when to use the tool, but does not mention when not to use it or provide alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_latest_changesA

Regulatory change feed: primary sources whose documents changed within the tracking window, with counts by status. Use to see what recently moved before relying on a cached rule.

NameRequiredDescriptionDefault
limitNoMax change entries to return (default 25, max 100).

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full burden. It explains the output (changed primary sources with counts) and implies a read-only operation, but does not detail the tracking window or status meanings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: first defines the tool's purpose and output, second gives practical usage context. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description provides sufficient context about what it returns and why to use it. Minor gaps like defining 'tracking window' are acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully describes the 'limit' parameter with min/max and default, so the description adds no additional meaning. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a regulatory change feed for primary sources with counts by status. It distinguishes from siblings like 'browse_topics' or 'watch_changes' by focusing on recently changed documents and status counts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a usage hint ('Use to see what recently moved before relying on a cached rule'), but does not explicitly state when not to use it or mention alternative tools for similar tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

obligation_deltasA

The obligation-level change feed: primary sources whose content changed (or whose node was withdrawn), mapped to the Bidda obligation nodes they affect, filterable by time, pillar, or specific nodes. Answers 'what obligations changed since I last reviewed?'. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
limitNoOptional: max deltas to return (default 100, max 500).
nodesNoOptional: restrict to deltas affecting these node_ids.
sinceNoOptional ISO timestamp; only deltas newer than this are returned.
pillarNoOptional: restrict to one pillar.
api_keyYesYour Bidda subscription API key. A free trial counts.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full responsibility for behavioral disclosure. It indicates the tool is a change feed (implying read-only), describes what it maps, and mentions filtering capabilities. However, it does not discuss pagination behavior, rate limits, or response structure, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first defines the tool's core functionality, the second provides a concrete use case and a prerequisite. Every sentence adds value, no fluff, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, no output schema, and no annotations, the description adequately explains the tool's purpose, filters, and the API key requirement. It lacks details on response format or behavior at limits, but the presence of sibling tools with similar purposes makes the differentiation clear enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all 5 parameters with descriptions (100% coverage). The description adds contextual meaning by summarizing filter capabilities (time, pillar, nodes) and the requirement for an API key, but these largely mirror the schema descriptions without providing additional constraints or formatting details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is the 'obligation-level change feed' that maps changed primary sources to affected obligation nodes. It also provides a concrete use-case question ('what obligations changed since I last review?'), which strongly differentiates it from sibling tools like 'get_latest_changes' or 'watch_changes' that might be more general.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states the tool answers a specific question and highlights filterability by time, pillar, or nodes. However, it does not mention when not to use it or provide direct comparisons to sibling tools, such as when to prefer 'obligation_deltas' over 'watch_changes' or 'get_latest_changes'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

oscal_assessment_resultsA

Export a governed run's evidence as a NIST OSCAL assessment-results document (the machine-readable format GRC and audit tooling consumes): reviewed-controls (the obligation nodes consulted), observations (each pinned to its version and integrity hash), and props recording the independent integrity self-check. A sealed run is readable by id; a still-open run needs your api_key.

NameRequiredDescriptionDefault
run_idYesThe run to export as OSCAL assessment-results.
api_keyNoOptional: your Bidda key, required for a still-open (unsealed) run.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description fully explains the export's content (reviewed-controls, observations, props) and notes the integrity self-check. It also clarifies the sealed/unsealed access behavior. However, it does not mention if any state is modified or if permissions are required beyond the api_key.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each earning its place: the first covers purpose and content, the second covers access conditions. No redundant or extraneous information, and the key details are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the output format (OSCAL assessment-results with listed components) and handles the api_key condition. Since there is no output schema, the description adequately describes what the agent can expect. The tool's complexity is moderate, and all relevant aspects are addressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters have schema descriptions with 100% coverage. The description adds value by explaining the purpose of api_key (required for unsealed runs), which the schema does not elaborate. However, the schema already describes the parameters adequately, so the addition is helpful but not essential.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies a concrete action: exporting a governed run's evidence as a NIST OSCAL assessment-results document, listing the included components (reviewed-controls, observations, props). This clearly distinguishes it from sibling tools, which perform different functions like browsing topics or checking compliance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when the api_key parameter is needed (for still-open runs) and distinguishes sealed vs. open runs. However, it does not explicitly contrast this tool with siblings or state when to choose it over alternatives, though the unique OSCAL output implicitly sets it apart.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

point_in_timeA

Get a signed record of which committed version of a rule was authoritative at a specific past date, anchored to the public history chain. Useful when an agent must show what a rule said at the moment it acted. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
as_ofNoISO date or time, or epoch milliseconds. Defaults to now.
api_keyYesYour Bidda subscription API key. A free trial counts.
node_idYesThe rule (node_id).

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It mentions the signed, anchored nature of the record and the API key requirement, but does not detail return structure, error conditions (e.g., missing node_id at the date), or rate limits. Some transparency provided, but gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: one defining the action, the second providing use case and requirement. No unnecessary words; highly concise and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description covers purpose, usage, and key requirement, it lacks details on the return format (signed record structure) and potential edge cases (e.g., no version at date). Given no output schema, more detail would improve completeness. Sufficient but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all three parameters with descriptions (100% coverage). The tool description reinforces the api_key requirement and node_id as 'rule,' but adds no additional semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a signed historical record of which rule version was authoritative at a given past date. It distinguishes itself from sibling tools like 'consult_node' (current version) and 'get_latest_changes' (recent updates) by specifying past point-in-time retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Useful when an agent must show what a rule said at the moment it acted,' providing clear context for use. However, it does not name alternatives or state when not to use this tool, which would improve guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

record_run_entryA

Append one entry to an open run: which Bidda rules the agent consulted, what it decided, and the end user's input (as text via note, or privately as input_hash). Each entry is hash-chained to the previous one. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
noteNoOptional: the end user's message as text.
modelNoOptional: the model id/version that produced this decision.
nodesNoOptional node_ids the agent consulted (max 50).
actionNoOptional: an action the agent took or checked.
run_idYesThe run_id returned by open_run.
api_keyYesYour Bidda subscription API key. A free trial counts.
decisionNoOptional: what the agent decided or did this turn.
entry_typeNoOptional: node_consulted, action_checked, decision, or note. Defaults to note.
input_hashNoOptional: a sha256:... hash of the user's message instead of the text.
output_hashNoOptional: a sha256:... hash of the agent's output.
subject_hashNoOptional: a sha256:... hash of an end-user identifier. Hash only, never plaintext.
verify_nodesNoOptional: pin each node to its current version and integrity hash (proof, not just a claim).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only adds one behavioral detail: 'Each entry is hash-chained to the previous one.' This is useful but leaves out other traits like whether entries are immutable, permission requirements, or rate limits. The description carries the full burden and is only partially transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the core purpose and key behavioral note (hash-chaining). It is concise but packs significant detail. Some restructuring could improve clarity (e.g., separating the entry content from the requirement), but overall it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (12 parameters, no output schema, no annotations), the description covers the core purpose and ensures the agent knows what an entry contains. However, it does not describe the return value (e.g., success indicator or entry ID), prerequisites beyond the API key, or what happens if the run is not open. These gaps could hinder a new agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is documented. The description adds meaningful context beyond the schema by explaining the distinction between note and input_hash for user input, and mentioning that entry_type defaults to note. This enriches understanding of how parameters interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'append' and the resource 'one entry to an open run', specifying the content (Bidda rules, decisions, user input). This distinguishes it from sibling tools like browse_topics or check_action_compliance, which are not recording actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the requirement for a Bidda subscription key, but does not explicitly state when to use this tool versus alternatives (e.g., consult_node, drift_check). Usage is implied by the recording nature, but no exclusions or comparative context are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_nodesA

Keyword search across the Bidda registry of source-verified compliance obligations. Returns matching nodes with their id, title, pillar, and a plain-language summary (BLUF). Every node traces to a primary legal source. Use to find the rule that governs a topic, law, standard, or MITRE technique. Examples: 'GDPR breach notification 72 hours', 'Basel III capital', 'SOC 2 Type II'.

NameRequiredDescriptionDefault
limitNoMax results (default 10, max 50).
queryYesKeywords, a regulation name, or a topic (e.g. 'GDPR breach notification').
pillarNoOptional exact pillar/domain name to restrict results (see list_pillars).

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions that the tool returns nodes with id, title, pillar, and BLUF, and that every node traces to a primary legal source. However, it does not describe behavior such as result ordering, handling of no results, or whether search is fuzzy/exact. These gaps leave some behavioral uncertainty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states the core function and return fields, the second provides usage guidance and examples. It is front-loaded, efficient, and every sentence contributes meaningfully. No redundant or vague phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a search tool with 3 parameters and no output schema, the description covers the essential aspects: functionality, return information, usage context, and examples. It lacks details on pagination or result limits (though limit param is documented), but overall it provides sufficient context for an agent to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear parameter descriptions. The description adds value by showing example queries ('GDPR breach notification 72 hours') and hinting at pillar usage via 'list_pillars'. However, it does not significantly enhance understanding beyond the schema, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Keyword search across the Bidda registry of source-verified compliance obligations', clearly stating the verb ('search') and the resource (registry of obligations). It distinguishes from sibling tools like browse_topics or consult_node by being a general search tool, and the examples and usage guidance reinforce its unique purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes 'Use to find the rule that governs a topic, law, standard, or MITRE technique' and provides concrete examples. While it doesn't explicitly say when not to use or list alternatives, the context of sibling tools and the clear search purpose imply the appropriate use cases. It would benefit from mentioning when to use browse_topics or consult_node instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

watch_changesA

Subscribe to regulatory change alerts: watch specific rules and/or whole pillars and get notified by email or webhook when their primary source changes. Requires a Bidda subscription key (a free trial counts).

NameRequiredDescriptionDefault
labelNoOptional name for the alert.
nodesNonode_ids to watch.
api_keyYesYour Bidda subscription API key. A free trial counts.
pillarsNoPillar names to watch.
channelsNoDelivery channels, for example { "email": true, "webhook": false }. Defaults to email.
webhook_urlNoRequired if the webhook channel is enabled.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the subscription nature and delivery methods (email/webhook), but lacks details on unsubscription, subscription lifecycle, limits, or what the tool returns (e.g., a subscription ID).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: first captures action and method, second adds a critical prerequisite. No extra words, front-loaded, and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, nested objects, and no output schema, the description covers the what, how, and prerequisite. It misses the return value (e.g., subscription ID or confirmation), but overall is sufficient for an agent to understand the tool's role among 14 siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 6 parameters have schema descriptions (100% coverage), but the description adds value by explaining how parameters like 'nodes', 'pillars', 'channels', and 'webhook_url' relate to the overall purpose of watching rules and pillars and getting notified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Subscribe', the resource 'regulatory change alerts', and the outcome 'get notified by email or webhook'. It specifies what can be watched ('specific rules and/or whole pillars'), distinguishing it from sibling tools like 'get_latest_changes' (one-time query) and 'browse_topics' (browsing).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides the key prerequisite: 'Requires a Bidda subscription key (a free trial counts)'. It implies use for ongoing notifications rather than on-demand queries, but does not explicitly state when not to use or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 16 tool updatesv1.0.1
    • Addedbrowse_topics
    • Addedcheck_action_compliance
    • Addedcompare_jurisdictions
    • Addedconsult_node
    • Addedcreate_control_attestation
    • Addeddrift_check
    • Addedget_audit_pack
    • Addedget_jurisdiction_bundle
    • Addedget_latest_changes
    • Removedlist_pillars
    • Addedobligation_deltas
    • Addedoscal_assessment_results
    • Addedpoint_in_time
    • Addedrecord_run_entry
    • Addedsearch_nodes
    • Addedwatch_changes
  2. 1 tool updatev1.0.0
    • First observedlist_pillars

TDQS

A4.1/5.0

Scored across 15 tools

Disambiguation5/5

Each tool targets a distinct compliance function: browsing, compliance checking, jurisdiction comparison, node consultation, attestation, drift detection, export, etc. No two tools overlap in purpose; descriptions clearly differentiate them.

Naming Consistency4/5

Most tools follow a verb_noun pattern (e.g., browse_topics, check_action_compliance). 'obligation_deltas' breaks this pattern (noun_noun), but the deviation is minor and the overall style remains consistent.

Tool Count5/5

With 15 tools, the server covers a complex domain (regulatory compliance) without being overwhelming. Each tool has a clear purpose, and the number is appropriate for the scope.

Completeness4/5

The tool surface covers discovery, compliance checking, attestation, monitoring, and export. Minor gaps exist (e.g., no node update/delete), but core workflows like search, assessment, and audit are well-supported.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers