Skip to main content
Glama
ComplianceCow

ComplianceCow MCP Server

ComplianceCow MCP Servers

Table of Contents

  1. Introduction

  2. Glossary

  3. Architecture

  4. MCP Servers

  5. Getting Started

  6. MCP Host Setup

  7. Running Locally

  8. Tools Reference

  9. FAQ


Related MCP server: Fianu Compliance Intelligence MCP Server

Introduction

MCP (Model Context Protocol) servers are designed to process structured requests from AI agents, perform domain-specific operations, and return context-aware responses. The ComplianceCow MCP servers enable seamless integration with MCP-compatible hosts like Claude Desktop and Goose Desktop/CLI for secure, modular, and intelligent compliance automation.


Glossary

Keyword

Description

Example

Control

A compliance or security control that needs to be implemented to ensure adherence to regulations, standards, and policies

Ensure MFA is enabled for all users

Assessment

A collection of controls organized hierarchically, representing an industry standard or cybersecurity framework

PCI DSS 4.0

Assessment Run

The verification of controls in an assessment for a given time period, including evidence collection

-

Check

A rule or verification for compliance or conformance

Check if MFA is enabled for all AWS users

Resource Type

Category or class of resources

AWS EC2, AWS S3

Resource

Instance of a resource type for which checks are performed

Specific EC2 instances, GitHub repositories

Asset

A group of resources of various types

AWS services, Kubernetes, GitHub

Evidence

Data aggregated through checks against resources for a given control

CSV file with AWS users and their MFA status

Action

Activity (automated or manual) to respond or remediate based on conditions

Create a JIRA ticket for non-compliant EC2 instance

Rule

A reusable automation unit that executes tasks and generates evidence

AWS MFA Compliance Check Rule

Workflow

An event-driven automation sequence with conditions and activities

Alert workflow on critical finding


Architecture

The ComplianceCow MCP servers support the STDIO transport mechanism for seamless local integration with your MCP host. At the core is the Compliance Graph, which continuously ingests data such as assessment runs, evidence, and compliance status. The server actively pulls information from:

  • Vector stores for semantic search

  • Relational databases for structured data

  • Graph databases for relationship queries

  • File storage systems for evidence artifacts


MCP Servers

We have organized ComplianceCow’s MCP tools into 4 distinct servers.

Why multiple MCP servers? In the MCP ecosystem, using fewer tools per server yields better results and better performance. Each server can be enabled independently via the MCP_TOOLS_TO_BE_INCLUDED environment variable. Important: Enable only one server at a time in the MCP Host to avoid tool name conflicts. Some tools share the same name across servers but have different implementations based on the use case.

1. ComplianceCow-Rules

The Rules server enables creating, managing, and executing compliance rules. It provides a comprehensive toolkit for rule creation with guided input collection, task orchestration, and ComplianceCow integration.

Use Cases:

  • Create custom compliance rules with multiple tasks

  • Execute rules against cloud infrastructure

  • Publish rules to ComplianceCow and attach to controls

  • Generate rule documentation (design notes, README)


2. ComplianceCow-Insights

The Insights server provides comprehensive access to compliance data, dashboards, assessments, and evidence through the Compliance Graph. Ideal for querying and analyzing compliance posture.

Use Cases:

  • Query dashboard data for compliance overview

  • Explore assessments and their runs

  • Retrieve evidence and compliance status

  • Execute Cypher queries on the Compliance Graph

  • Perform actions on controls and evidence


3. ComplianceCow-Workflow

The Workflow server enables building and executing automated compliance workflows with event-driven triggers, conditions, and activities.

Use Cases:

  • Create automated compliance workflows

  • Define event triggers and conditions

  • Execute multi-step workflow sequences

  • Manage workflow states and transitions


4. ComplianceCow-Assistant

The Assistant server specializes in assessment configuration, control setup, and SQL-based evidence collection. It provides tools for configuring compliance assessments and managing control evidence.

Use Cases:

  • Create and configure assessments

  • Set up control configurations with context entities

  • Create SQL-based evidence collection

  • Manage control citations and documentation


Getting Started

Prerequisites

  1. MCP Host: You need an MCP-compatible host:

  2. Python: Version 3.11 or higher

  3. uv Package Manager: Required to run the MCP server

Authentication

The ComplianceCow MCP servers use OAuth 2.0 with client_credentials grant type.

To obtain credentials:

  1. Sign up at ComplianceCow (or your dedicated instance)

  2. Click "Manage Client Credentials" in the top-right user profile menu

  3. Fill out the form to obtain your Client ID and Client Secret

Installation

  1. Clone the repository:

    git clone https://github.com/ComplianceCow/cow-mcp.git
    cd cow-mcp
  2. Create virtual environment and install dependencies:

    uv venv .venv
    source .venv/bin/activate  # On Windows: .venv\Scripts\activate
    uv pip install .
  3. Find your uv binary path (needed for configuration):

    which uv  # On macOS/Linux
    where uv  # On Windows

Configuration

Environment Variables

Variable

Description

Required

CCOW_HOST

ComplianceCow API host URL (Ex: https://partner.compliancecow.live)

Yes

CCOW_CLIENT_ID

Your Client ID (see Authentication section above)

Yes

CCOW_CLIENT_SECRET

Your Client Secret (see Authentication section above)

Yes

MCP Host Setup

Claude Desktop

Configuration file location:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

For detailed setup instructions, see Claude Desktop MCP Setup.

Configuration template for all 4 servers:

{
  "mcpServers": {
    "ComplianceCow-Rules": {
      "command": "<UV_BIN_PATH>",
      "args": [
        "--directory",
        "<PATH_TO_COW_MCP_REPO>",
        "run",
        "main.py"
      ],
      "env": {
        "CCOW_HOST": "<YOUR_CCOW_HOST>",
        "CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
        "CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
        "MCP_TOOLS_TO_BE_INCLUDED": "rules"
      }
    },
    "ComplianceCow-Insights": {
      "command": "<UV_BIN_PATH>",
      "args": [
        "--directory",
        "<PATH_TO_COW_MCP_REPO>",
        "run",
        "main.py"
      ],
      "env": {
        "CCOW_HOST": "<YOUR_CCOW_HOST>",
        "CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
        "CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
        "MCP_TOOLS_TO_BE_INCLUDED": "insights"
      }
    },
    "ComplianceCow-Workflow": {
      "command": "<UV_BIN_PATH>",
      "args": [
        "--directory",
        "<PATH_TO_COW_MCP_REPO>",
        "run",
        "main.py"
      ],
      "env": {
        "CCOW_HOST": "<YOUR_CCOW_HOST>",
        "CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
        "CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
        "MCP_TOOLS_TO_BE_INCLUDED": "workflow"
      }
    },
    "ComplianceCow-Assistant": {
      "command": "<UV_BIN_PATH>",
      "args": [
        "--directory",
        "<PATH_TO_COW_MCP_REPO>",
        "run",
        "main.py"
      ],
      "env": {
        "CCOW_HOST": "<YOUR_CCOW_HOST>",
        "CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
        "CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
        "MCP_TOOLS_TO_BE_INCLUDED": "assistant"
      }
    }
  }
}

Replace the following placeholders:

  • UV_BIN_PATH: Path to your uv binary (e.g., /Users/username/.local/bin/uv). You can find this by running which uv (macOS/Linux) or where uv (Windows).

  • PATH_TO_COW_MCP_REPO: The absolute path to your cloned cow-mcp repository. After cloning and running cd cow-mcp, use pwd (macOS/Linux) or cd (Windows) to get this path.

  • YOUR_CCOW_HOST: https://partner.compliancecow.live (or <your_dedicated_instance_hosturl>)

  • YOUR_CLIENT_ID: Your ComplianceCow Client ID (see Authentication)

  • YOUR_CLIENT_SECRET: Your ComplianceCow Client Secret (see Authentication)


Goose Desktop/CLI

For detailed setup instructions, see Goose Extensions Documentation.

Configuration file location:

  • macOS/Linux: ~/.config/goose/config.yaml

  • Windows: %APPDATA%\goose\config.yaml

Configuration template for all 4 servers:

extensions:
  ComplianceCow-Rules:
    enabled: true
    type: stdio
    name: Compliancecow-Rules
    description: 'ComplianceCow Rules - Create and manage compliance rules'
    cmd: <UV_BIN_PATH>
    args:
      - --directory
      - <PATH_TO_COW_MCP_REPO>
      - run
      - main.py
    envs:
      CCOW_HOST: <YOUR_CCOW_HOST>
      CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
      CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
      MCP_TOOLS_TO_BE_INCLUDED: rules
    timeout: 300

  ComplianceCow-Insights:
    enabled: true
    type: stdio
    name: Compliancecow-Insights
    description: 'ComplianceCow Insights - Query compliance data and dashboards'
    cmd: <UV_BIN_PATH>
    args:
      - --directory
      - <PATH_TO_COW_MCP_REPO>
      - run
      - main.py
    envs:
      CCOW_HOST: <YOUR_CCOW_HOST>
      CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
      CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
      MCP_TOOLS_TO_BE_INCLUDED: insights
    timeout: 300

  ComplianceCow-Workflow:
    enabled: true
    type: stdio
    name: Compliancecow-Workflow
    description: 'ComplianceCow Workflow - Build and execute compliance workflows'
    cmd: <UV_BIN_PATH>
    args:
      - --directory
      - <PATH_TO_COW_MCP_REPO>
      - run
      - main.py
    envs:
      CCOW_HOST: <YOUR_CCOW_HOST>
      CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
      CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
      MCP_TOOLS_TO_BE_INCLUDED: workflow
    timeout: 300

  ComplianceCow-Assistant:
    enabled: true
    type: stdio
    name: Compliancecow-Assistant
    description: 'ComplianceCow Assistant - Configure assessments and controls'
    cmd: <UV_BIN_PATH>
    args:
      - --directory
      - <PATH_TO_COW_MCP_REPO>
      - run
      - main.py
    envs:
      CCOW_HOST: <YOUR_CCOW_HOST>
      CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
      CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
      MCP_TOOLS_TO_BE_INCLUDED: assistant
    timeout: 300

Replace the following placeholders:

  • UV_BIN_PATH: Path to your uv binary (e.g., /Users/username/.local/bin/uv). You can find this by running which uv (macOS/Linux) or where uv (Windows).

  • PATH_TO_COW_MCP_REPO: The absolute path to your cloned cow-mcp repository. After cloning and running cd cow-mcp, use pwd (macOS/Linux) or cd (Windows) to get this path.

  • YOUR_CCOW_HOST: https://partner.compliancecow.live (or <your_dedicated_instance_hosturl>)

  • YOUR_CLIENT_ID: Your ComplianceCow Client ID (see Authentication)

  • YOUR_CLIENT_SECRET: Your ComplianceCow Client Secret (see Authentication)


Running Locally

To verify the MCP server is properly set up before configuring your MCP host:

# Navigate to the cow-mcp directory
cd /path/to/cow-mcp

# Set required environment variables
export CCOW_HOST="https://partner.compliancecow.live"
export CCOW_CLIENT_ID="<your_client_id>"
export CCOW_CLIENT_SECRET="<your_client_secret>"
export MCP_TOOLS_TO_BE_INCLUDED="rules"  # or insights, workflow, assistant

# Run the server
uv run main.py

If the server starts without errors, you're ready to configure your MCP host.


Tools Reference

Rules Server Tools

Tool

Description

get_tasks_summary

Retrieve available tasks for rule creation

get_task_details

Get detailed task information including inputs/outputs

fetch_tasks_suggestions

Intelligent task suggestions based on requirements

get_rules_summary

List all available rules in the catalog

fetch_rules_suggestions

Suggest matching rules to avoid duplicates

create_rule

Create a new rule with tasks and I/O mapping

fetch_rule

Retrieve complete rule structure by name

check_rule_status

Check rule completion level

prepare_input_collection_overview

Overview of required inputs before collection

get_template_guidance

Guidance for template-based inputs

collect_template_input

Collect file/template inputs with validation

confirm_template_input

Confirm and process template input

collect_parameter_input

Collect primitive parameter values

confirm_parameter_input

Confirm and store parameter values

upload_file

Upload files with format validation

verify_collected_inputs

Verify all inputs before execution

execute_task

Execute a specific task with collected inputs

execute_rule

Execute complete rule with credentials

fetch_execution_progress

Monitor live execution progress

fetch_output_file

Fetch output files from execution

fetch_cc_rule_by_id

Fetch rule from ComplianceCow by ID

fetch_cc_rule_by_name

Fetch rule from ComplianceCow by name

fetch_cc_rules_list

List published ComplianceCow rules

publish_rule

Publish rule to ComplianceCow

fetch_assessments

Retrieve available assessments

fetch_leaf_controls_of_an_assessment

Fetch attachable controls from assessment

verify_control_in_assessment

Verify control is attachable

attach_rule_to_control

Attach published rule to control

get_applications_for_tag

Get applications for specific tag

get_application_info

Get application details and credential types

fetch_applications

Fetch all available applications

prepare_applications_for_execution

Prepare application configuration

check_applications_publish_status

Check application publication status

publish_application

Publish applications for rule execution

add_unique_identifier_to_task

Add unique identifier to task

configure_rule_output_schema

Configure standard/extended output schema

generate_design_notes_preview

Generate Jupyter notebook design notes

create_design_notes

Save design notes

fetch_rule_design_notes

Fetch existing design notes

generate_rule_readme_preview

Generate comprehensive README

create_rule_readme

Save README

update_rule_readme

Update existing README

list_assets

List integration plans/assets

list_checks

List checks for an asset

get_asset_control_hierarchy

Get control hierarchy for asset

create_asset_and_check

Create asset with initial check

add_check_to_asset

Add check to existing asset

schedule_asset_execution

Schedule automated asset execution

list_asset_schedules

List schedules for an asset

delete_asset_schedule

Delete asset schedule

suggest_control_config_citations

Suggest control citations

add_citation_to_asset_control

Attach citation to control

verify_control_automation

Verify control automation status

create_control_note

Create documentation note on control

list_control_notes

List control notes

update_control_config_note

Update control note

create_support_ticket

Create support tickets

check_rule_publish_status

Check rule publication status

read_file

Read local file content

read_resource

Read resource URI content

create_downloadable_file

Create downloadable file URL


Insights Server Tools

Tool

Description

list_all_assessment_categories

List all assessment categories

list_assessments

List assessments by category/name

fetch_recent_assessment_runs

Fetch recent assessment runs

fetch_assessment_runs

Fetch runs with pagination

fetch_assessment_run_details

Get control details from run

fetch_assessment_run_leaf_controls

Get leaf controls from run

fetch_run_controls

Get controls by name

fetch_run_control_meta_data

Get control metadata

fetch_assessment_run_leaf_control_evidence

Get evidence for controls

fetch_controls

Fetch control information

fetch_evidence_records

Get evidence records with filtering

fetch_evidence_record_schema

Get evidence schema

fetch_available_control_actions

Fetch available control actions

fetch_assessment_available_actions

Fetch assessment actions

fetch_evidence_available_actions

Fetch evidence actions

fetch_general_available_actions

Fetch general actions

fetch_automated_controls_of_an_assessment

Fetch automated controls

execute_action

Execute action on control/evidence

list_assets

List all assets

fetch_assets_summary

Get asset summary statistics

fetch_resource_types

Get resource types with pagination

fetch_checks

Get checks for resource type

fetch_resources

Get resources with pagination

fetch_resources_by_check_name

Get resources by check name

fetch_checks_summary

Get checks summary statistics

fetch_resources_summary

Get resources summary statistics

fetch_resources_by_check_name_summary

Get resources summary by check

fetch_resource_types_summary

Get resource types summary

get_dashboard_review_periods

Get available review periods

get_dashboard_data

Get comprehensive dashboard data

fetch_dashboard_framework_controls

Get framework controls

fetch_dashboard_framework_summary

Get framework summary

get_dashboard_common_controls_details

Get common control details

get_top_over_due_controls_detail

Get top overdue controls

get_top_non_compliant_controls_detail

Get top non-compliant controls

fetch_unique_node_data_and_schema

Fetch graph node data and schema

execute_cypher_query

Execute Cypher query on graph

help

Get help information

read_file

Read local file content

read_resource

Read resource URI content

create_downloadable_file

Create downloadable file URL


Workflow Server Tools

Tool

Description

list_workflow_event_categories

List workflow event categories

list_workflow_events

List available trigger events

list_workflow_activity_types

List available activity types

list_workflow_function_categories

List function categories

list_workflow_functions

List available functions

list_workflow_tasks

List available workflow tasks

list_workflow_condition_categories

List condition categories

list_workflow_conditions

List available conditions

list_workflow_predefined_variables

List predefined variables

list_workflow_rules

List available workflow rules

create_workflow

Create workflow from YAML

list_workflows

List all workflows

get_workflow_by_name

Get workflow by name

fetch_workflow_details

Fetch complete workflow details

modify_workflow

Update workflow implementation

update_workflow_summary

Update workflow description

update_workflow_mermaid_diagram

Update workflow diagram

fetch_workflow_resource_data

Fetch resource data for execution

create_workflow_custom_event

Create custom trigger event

trigger_workflow

Trigger workflow execution

fetch_workflow_rule

Fetch workflow rule by name

fetch_task_readme

Fetch task README

fetch_rule_readme

Fetch rule README


Assistant Server Tools

Tool

Description

create_assessment

Create assessment from YAML

list_assessments

List all assessments

list_assessment_control_configs

List control configurations

create_control_config

Create control configuration

update_control_config_contexts

Update control context entities

attach_citation_to_control_config

Attach citation to control

suggest_control_config_citations

Suggest relevant citations

mark_control_ready_for_execution

Mark control ready for execution

create_sql_query_evidence

Create SQL-based evidence

list_sql_query_evidence

List SQL evidence for control

update_sql_query_evidence

Update SQL evidence

validate_sql_query

Validate SQL query syntax

get_evidence_sample_data

Get sample evidence data

fetch_control_source_summary

Fetch evidence source summary

create_control_config_note

Create control config note

list_control_config_notes

List control config notes

update_control_config_note

Update control config note

get_entity_hierarchy

Get entity hierarchy

get_context_tables

Get available context tables

fetch_rule_readme

Fetch rule README


FAQ

1. How do I sign up for ComplianceCow?

Visit ComplianceCow Signup to create an account using various sign-up options including Google, Microsoft, and OTP.

2. What value does ComplianceCow deliver?

ComplianceCow helps with automated security compliance evidence collection, analysis, and remediation challenges. It's a security GRC controls automation studio for custom controls and workflows. Learn more at compliancecow.com.

3. Why are there 4 separate servers?

MCP works best with fewer tools per server. Splitting into 4 servers (Rules, Insights, Workflow, Assistant) ensures optimal performance and allows you to enable only the tools you need for specific use cases.

4. What if some tools have the same name across servers?

Some tools share the same name but have different implementations. Enable only one server at a time to avoid conflicts. The tool behavior is determined by the MCP_TOOLS_TO_BE_INCLUDED env.

5. How do I update the MCP server?

cd /path/to/cow-mcp
git pull origin main
uv pip install .

Then restart your MCP host (Claude Desktop or Goose).

6. Where can I get help?

  • Create an issue on GitHub

  • Contact ComplianceCow support through the platform

Available Tools

118 tools
add_check_to_assetA

Add a new control and a new check to an asset under a specified parent control. The check will be attached to newly created control beneath the parent control.

Args: - assetId (str): Asset id. - parentControlId (str): Parent control id under which the check will be added. - checkName (str): Name of the check to be added. - checkDescription (str): Description of the check to be added.

Returns: - success (bool): Indicates if the check was added successfully. - error (Optional[str]): An error message if any issues occurred during the addition.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetIdYes
parentControlIdYes
checkNameYes
checkDescriptionYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool creates a new control and attaches a check to it, which implies a write operation, but does not specify permissions, idempotency, or side effects like what happens if the parent control doesn't exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured with separate 'Args' and 'Returns' sections. It is front-loaded with the core purpose and uses minimal but sufficient text, earning its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, the description covers the return values (success, error) and the basic behavior. However, it could include more context about error conditions, duplicate checks, or required permissions. Still, it provides a solid foundation for an agent to understand the tool's function.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. The 'Args' section adds context for each parameter (e.g., 'parentControlId' is described as the parent control under which the check will be added), which goes beyond the basic type definitions in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Add a new control and a new check to an asset under a specified parent control.' It uses specific verbs and identifies the resources (asset, control, check), distinguishing it from siblings like create_asset_and_check which creates the asset itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear purpose but lacks explicit guidance on when to use this tool versus alternatives. No mention of prerequisites, exclusions, or when not to use it. The context with siblings is not leveraged to differentiate use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

add_citation_to_asset_controlD

Create a new asse with an initial control and check structure. The asset will be created with a hierarchical structure: asset -> control -> check.

Args: - assetControlId (str): Id of the control in asset. - authorityDocument (str): Authority document name of the citation. - authorityDocumentControlId (str): Id of the control in authority document.

Returns: - success (bool): Indicates if the citation was created successfully. - error (Optional[str]): An error message if any issues occurred during creation.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetControlIdYes
authorityDocumentYes
authorityDocumentControlIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

D1.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only states returns (success, error) without detailing behavioral traits such as idempotency, permissions, or effects of duplicate citations. The typo 'asse' further undermines clarity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is of moderate length but includes irrelevant information about asset hierarchy. It could be more concise if focused on the actual citation action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and 3 parameters, the description fails to accurately describe the tool's purpose (mismatch with name) and lacks essential context about citations and controls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 0%, and the description merely repeats parameter names with vague one-line descriptions (e.g., 'Id of the control in asset'). It does not explain formats, constraints, or relationships between parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose1/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says 'Create a new asset with an initial control and check structure,' which contradicts the tool name 'add_citation_to_asset_control.' The parameters are about linking a citation to an existing asset control, not creating an asset. This is misleading.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus siblings like 'suggest_control_citations' or 'attach_rule_to_control.' The description does not clarify the context of use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

add_unique_identifier_to_taskA

Add a unique identifier key-value pair to a specific task's appTags.

Use this when multiple tasks share the same appType but need DIFFERENT applications. The unique identifier allows the system to match each application to its specific task.

WHEN TO USE:

  • After prepare_applications_for_execution() identifies tasks needing differentiation

  • When user chooses "separate applications" option for tasks with same appType

  • Before configuring separate applications for same appType tasks

NOT NEEDED WHEN:

  • User wants to SHARE the same application across multiple tasks

  • Task already has a unique appType (no other tasks share it)

WORKFLOW:

  1. Call prepare_applications_for_execution()

  2. If user chooses separate applications for an appType:

    • Call this tool for each task to add unique identifier

    • Use same key but different values (e.g., "purpose": "source" vs "purpose": "target")

  3. Configure applications with matching identifiers

Args: rule_name: Name of the rule containing the task task_alias: Alias of the task to update identifier_key: Unique identifier key (e.g., "purpose", "sourceSystem") identifier_value: Value for the identifier (e.g., "source-repo", "production-db")

Returns: Dict with update status and guidance

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
task_aliasYes
identifier_keyYes
identifier_valueYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains the effect (adding an identifier to appTags) and the purpose (matching applications to tasks). However, it does not disclose potential side effects like overwriting existing keys, error conditions (e.g., task not found), or authentication requirements. A score of 3 reflects adequate but incomplete disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-organized into sections (purpose, when/not to use, workflow, args, returns). It is front-loaded with the main action. While every section earns its place, the length could be slightly reduced without losing clarity. A score of 4 reflects good structure and efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (4 required parameters, part of a multi-step workflow), the description provides sufficient context: it references the preceding step (prepare_applications_for_execution) and explains the return type. The absence of an output schema is mitigated by stating 'Dict with update status and guidance'. Overall, it is complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, meaning the schema provides no parameter documentation. The description compensates by listing all four parameters with examples and context in an 'Args' section. This adds significant meaning beyond the raw schema, guiding the agent on how to populate them correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Add', the resource 'task's appTags', and the specific action 'unique identifier key-value pair'. It is precise and distinguishes itself from siblings like 'create_control_note' or 'update_control_note', which do not add identifiers to tasks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides 'WHEN TO USE' and 'NOT NEEDED WHEN' sections, including a workflow that references a specific sibling tool (prepare_applications_for_execution). This gives clear context and alternatives, making it easy for an agent to decide when to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

attach_rule_to_controlA

Attach a rule to a specific control in an assessment.

🚨 CRITICAL EXECUTION BLOCKERS — DO NOT SKIP 🚨 Before any part of this tool can run, five preconditions MUST be met:

  1. Control Verification:

  • You MUST verify the control exists in the assessment by calling verify_control_in_assessment().

  • Verification must confirm the control is present, valid, and a leaf control.

  • If verification fails → STOP immediately. Do not proceed.

  1. Rule ID Resolution:

  • If rule_id is a valid UUID → proceed.

  • If rule_id is an alphabetic string → treat it as the rule name and resolve it to a UUID using fetch_cc_rule_by_name().

  • If resolution fails or rule_id is still not a UUID after this step → STOP immediately.

  • Execution is STRICTLY PROHIBITED with a plain name.

  1. Rule Publish Validation:

  • You MUST check if the rule is published in ComplianceCow before proceeding.

  • If the rule is not published → STOP immediately.

  • Published status is a hard requirement for attachment.

  1. Evidence Creation Acknowledgment:

  • Before proceeding, you MUST request confirmation from the user about create_evidence.

  • Ask: "Do you want to auto-generate evidence from the rule output? (default: True)"

  • Only proceed after the user explicitly acknowledges their choice.

  1. Override Acknowledgment:

  • If the control already has a rule attached, you MUST request user confirmation before overriding.

  • Ask: "This control already has a rule attached. Do you want to override it? (yes/no)"

  • Only proceed if the user explicitly confirms.

RULE ATTACHMENT WORKFLOW:

  1. Perform control verification using verify_control_in_assessment() (MANDATORY).

  2. Resolve rule_id using the CRITICAL EXECUTION BLOCKERS above (use fetch_cc_rule_by_name() when needed).

  3. Validate that the rule is published in ComplianceCow.

  4. Confirm evidence creation preference from the user (acknowledgment REQUIRED).

  5. Check for existing rule attachments and request override acknowledgment if needed.

  6. Attach rule to control.

  7. Optionally create evidence for the control.

ATTACHMENT OPTIONS:

  • create_evidence: Whether to create evidence along with rule attachment. Must be confirmed by the user before proceeding.

VALIDATION REQUIREMENTS:

  • Control must be verified and confirmed as a leaf control.

  • Rule must be published.

  • Rule ID must be a valid UUID.

  • Assessment and control must exist.

  • User must acknowledge override before replacing an existing rule.

Args: rule_id: ID of the rule to attach (UUID). If an alphabetic string is provided, it MUST be resolved to a UUID using fetch_cc_rule_by_name() before the tool proceeds. assessment_name: Name of the assessment. control_id: ID of the control. create_evidence: Whether to create auto-generated evidence from the rule output (default: True). ⚠️ MUST be confirmed by user acknowledgment before execution.

Returns: Dict containing attachment status and details.

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_idYes
assessment_nameYes
control_idYes
create_evidenceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavioral traits: it requires user confirmation for override and evidence creation, performs validation steps, and may fail if preconditions aren't met. However, it doesn't explicitly state side effects or rollback behavior, keeping it from a perfect score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and detailed, with headers and bullet points for structure. While thorough, it could be more concise; some repetition exists (e.g., 'CRITICAL EXECUTION BLOCKERS' reiterated in workflow). The length may overwhelm the agent, earning a middle score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple preconditions, user confirmations, workflow steps), the description is highly complete. It covers control verification, rule resolution, publish validation, evidence creation, override handling, and return value expectations. An output schema exists but doesn't reduce the need for this rich context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no descriptions (0% coverage), so the description compensates by explaining each parameter's usage, especially rule_id (UUID or name resolution) and create_evidence (needs user acknowledgment). It adds context about resolution logic, but lacks details on format constraints for assessment_name and control_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence clearly states 'Attach a rule to a specific control in an assessment,' which provides a specific verb and resource. This differentiates it from sibling tools like 'add_check_to_asset' or 'add_citation_to_asset_control' by focusing on rule-control attachment.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists critical execution blockers and a detailed workflow, including preconditions like control verification, rule ID resolution, and user confirmations. It mentions using related tools (verify_control_in_assessment, fetch_cc_rule_by_name) for prerequisite steps, offering clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_applications_publish_statusA

Check publication status for each application in the provided list.

app_info structure is [{"name":["ACTUAL application_class_name"]}]

Args: app_info: List of application objects to check

Returns: Dict with publication status for each application. Each app will have 'published' field: True if published, False if not.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_infoYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of disclosing behavior. It states 'Check publication status', which implies a read-only operation, but does not explicitly confirm no side effects, authentication needs, or rate limits. Minimal but acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at 5 lines, including args and returns. The structure hint could be clearer with formatting, but overall it is efficient without extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (expected), the description covers input format and return structure. However, it does not address error handling or edge cases, leaving minor gaps for a tool with a single parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the tool description provides detailed structure: 'app_info structure is [{"name":["ACTUAL application_class_name"]}]' and 'List of application objects to check'. This goes beyond the schema's minimal object type array.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Check publication status for each application', specifying the verb (check) and resource (application publish status). It distinguishes from sibling tools like 'check_rule_publish_status' and 'publish_application' by targeting applications and only checking status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly mention when to use this tool versus alternatives. It implies usage via the action 'check', but lacks explicit context such as 'Use this to verify publication status before publishing' or exclusion of sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_rule_publish_statusC

Check if a rule is already published.

  • If not published → publish the rule so it becomes available for control attachment

  • Once published, prompt the user:
    "Do you want to attach this rule to a ComplianceCow control? (yes/no)"

  • If yes → ask for assessment name and control alias to proceed with association

  • If no → end workflow

Args: rule_name: Name of the rule to check

Returns: Dict with publication status and details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Lacks annotations; the description is ambiguous about side effects. The bullet 'If not published → publish the rule' suggests a write operation, but the tool name and return type imply read-only. No disclosure of actual behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with bullets and an Args section, but includes verbose workflow instructions that are not part of the tool's direct behavior, reducing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Does not describe the return dict structure, error cases, or side effects. For a simple tool with no annotations or output schema detail, the description is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description explains 'rule_name: Name of the rule to check'. This adds basic meaning beyond the schema's type-only definition, but is minimal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Check if a rule is already published' which is clear, but then includes workflow steps that suggest the tool may also publish or prompt the user, creating ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs siblings like 'publish_rule' or 'check_rule_status'. The workflow steps imply subsequent actions but do not explicitly differentiate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_rule_statusA

Quick status check showing what's been collected and what's missing. Perfect for resuming in new chat windows.

ENHANCED WITH AUTO-INFERENCE STATUS ANALYSIS:

  • Ignores stored status/phase fields and analyzes actual rule structure

  • Auto-detects completion status based on rule content (same logic as create_rule)

  • Calculates real-time progress percentage from actual components

  • Determines next actions based on what's actually missing

  • Provides accurate resumption guidance regardless of stored metadata

  • Perfect for cross-chat resumption with reliable state detection

AUTO-INFERENCE LOGIC:

  • Analyzes spec.tasks, spec.inputs, spec.inputsMeta__, spec.ioMap, spec.outputsMeta__

  • Calculates completion based on actual content, not stored fields

  • Determines status: DRAFT → READY_FOR_CREATION → ACTIVE

  • Provides accurate progress: 5% → 25% → 85% → 100%

  • Identifies exactly what components are missing

Args: rule_name: Name of the rule to check status for

Returns: Dict with auto-inferred status information and accurate next action recommendations

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description thoroughly explains the tool's behavior beyond annotations: it ignores stored status/phase fields, analyzes actual rule structure, auto-detects completion status, calculates progress percentages, and provides resumption guidance. This ensures the agent understands exactly how it operates.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, with repeated emphasis on auto-inference and a long list of auto-inference logic details. While structured with headings, it could be more concise without losing critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter and the description explains the output (dict with status information), it covers the essential aspects. The description also addresses resumption use cases, making it sufficiently complete for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, rule_name, is described simply as 'Name of the rule to check status for.' With 0% schema description coverage, the description adds minimal value but covers the necessary context. For a single string parameter, this is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs a quick status check on a rule, showing what's collected and missing. It distinguishes itself from sibling tools by emphasizing auto-inference status analysis, making its unique purpose evident.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions the tool is 'Perfect for resuming in new chat windows,' providing clear guidance on when to use it. However, it does not explicitly state when not to use it or list alternatives, though the unique auto-inference feature implies scenarios where other status tools might not be suitable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

collect_parameter_inputA

Collect user input for non-template parameter inputs.

PARAMETER INPUT PROCESSING:

  • Collects primitive data type values (STRING, INT, FLOAT, BOOLEAN, DATE, DATETIME)

  • Stores values in memory (NEVER uploads files for primitive types)

  • Handles optional vs required inputs based on 'required' attribute

  • Supports default value confirmation workflow

  • Validates data types and formats

  • MANDATORY: Gets final confirmation for EVERY input before proceeding

INPUT REQUIREMENT RULES:

  • MANDATORY: Only if input.required = true

  • OPTIONAL: If input.required = false, user can skip or provide value

  • DEFAULT VALUES: If user requests defaults, must get confirmation

  • FINAL CONFIRMATION: Always required before proceeding to next input

DEFAULT VALUE WORKFLOW:

  1. User requests to use default values

  2. Show default value to user for confirmation

  3. "I can fill this with the default value: '[default_value]'. Confirm?"

  4. Only proceed after explicit user confirmation

  5. Store confirmed default value in memory

FINAL CONFIRMATION WORKFLOW (MANDATORY):

  1. After user provides value (or confirms default)

  2. Show final confirmation: "You entered: '[value]'. Is this correct? (yes/no)"

  3. If 'yes': Store value and proceed to next input

  4. If 'no': Allow user to re-enter value

  5. NEVER proceed without final confirmation

DATA TYPE VALIDATION:

  • STRING: Any text value

  • INT: Integer numbers only

  • FLOAT: Decimal numbers

  • BOOLEAN: true/false, yes/no, 1/0

  • DATE: YYYY-MM-DD format

  • DATETIME: ISO 8601 format

COLLECTION PRESENTATION: "Now configuring: [X of Y inputs]

Task: {task_name} Input: {input_name} ({data_type}) Description: {description} Required: {Yes/No} Default: {default_value or 'None'}

Please provide a value, type 'default' to use default, or 'skip' if optional:"

CRITICAL RULES:

  • NEVER upload files for primitive data types

  • Store all primitive values in memory only

  • Always confirm default values with user

  • ALWAYS get final confirmation before proceeding to next input

  • Respect required vs optional based on input.required attribute

  • Validate data types before storing

Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter user_value: Value provided by user (optional) use_default: Whether to use default value (requires confirmation)

Returns: Dict containing parameter value and storage info

ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes
input_nameYes
user_valueNo
use_defaultNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It extensively discloses behaviors: collects only primitive types, stores in memory, never uploads files, validates types, requires mandatory confirmation, and details the default value workflow. This is comprehensive and transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively long with repeated information, multiple sections, bullet points, and numbered lists. While structured, it is not concise; many details like the final confirmation workflow are reiterated. Every sentence does not earn its place, reducing efficiency for an AI agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity and lack of annotations, the description covers purpose, parameters, workflows, validation rules, and critical rules comprehensively. It also mentions return type. However, the verbosity slightly hinders quick understanding, but overall completeness is high.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It lists the four parameters (task_name, input_name, user_value, use_default) in an 'Args' section with brief descriptions, adding meaning beyond the schema. However, the descriptions are somewhat terse and could provide more detail on formats or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool collects user input for non-template parameter inputs, specifies it handles primitive types, and distinguishes from sibling tool 'collect_template_input' by explicitly mentioning 'non-template'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use (for parameter inputs) and includes critical rules, but does not explicitly list alternatives or when not to use, though the distinction from template inputs is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

collect_template_inputA

Collect user input for template-based task inputs.

TEMPLATE INPUT PROCESSING (Enhanced with Progressive Saving):

  • Validates user content against template format (JSON/TOML/YAML)

  • Handles JSON arrays and objects properly

  • Checks for required fields from template structure

  • Uploads validated content as file (ONLY for FILE dataType inputs)

  • Returns file URL for use in rule structure

  • MANDATORY: Gets final confirmation for EVERY input before proceeding

  • CRITICAL: Only processes user-provided content, never use default templates

  • NEW: Prepared for automatic rule updates in confirm step

JSON ARRAY HANDLING (Preserved):

  • Properly validates JSON arrays: [{"key": "value"}, {"key": "value"}]

  • Validates JSON objects: {"key": "value", "nested": {"key": "value"}}

  • Handles complex nested structures with arrays and objects

  • Validates each array element and object property

VALIDATION REQUIREMENTS (Preserved):

  • JSON: Must be valid JSON (arrays/objects) with proper brackets and quotes

  • TOML: Must follow TOML syntax with proper sections [section_name]

  • YAML: Must have correct indentation and structure

  • XML: Must be well-formed XML with proper tags

  • Required fields: All template fields must be present in user content

STREAMLINED WORKFLOW:

  1. User provides template content

  2. Validate and process immediately

  3. Auto-proceed if validation passes

FILE NAMING CONVENTION (Preserved):

  • Format: {task_name}_{input_name}.{extension}

  • Extensions: .json, .toml, .yaml, .xml, .txt based on format

WORKFLOW INTEGRATION (Enhanced):

  1. Called after get_template_guidance() shows template to user

  2. User provides their actual configuration content

  3. This tool validates content (including JSON arrays)

  4. Shows content preview and asks for confirmation

  5. Only after confirmation: uploads file or stores in memory

  6. Returns file URL or memory reference for rule structure

  7. NEW: Prepared for rule update in confirm_template_input()

CRITICAL RULES (Preserved):

  • ONLY upload files for inputs with dataType = "FILE" or "HTTP_CONFIG"

  • Template inputs and HTTP_CONFIG inputs are typically file types and need file uploads

  • Store non-FILE template content in memory

  • ALWAYS get final confirmation before proceeding

  • Handle JSON arrays properly: validate each element

  • Never use template defaults - always use user-provided content

MANDATORY: Task-sequential collection only. Sanitize input names (alphanumeric + underscore).

Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter user_content: Content provided by the user based on the template

Returns: Dict containing validation results and file URL or memory reference, prepared for progressive rule updates

ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes
input_nameYes
user_contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It discloses validation behavior, file upload condition (only for FILE dataType), mandatory confirmation, and rule updates. It covers error-prone details like JSON array handling and sanitization. Lacks details on error handling or idempotency, but overall transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and contains redundancy (e.g., 'Preserved' repeated, 'NEW:' temporal markers). It is well-structured with sections, but could be more concise. Some sentences are wordy (e.g., 'MANDATORY: Task-sequential collection only.' could be shorter). Adequate but not optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (3 parameters, no annotations, output schema only described in text), the description covers workflow integration, validation requirements, file naming convention, and return values. It includes critical rules and workflow steps. Missing some edge case handling (e.g., validation failure behavior), but overall complete for a template input collection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It provides clear semantics for each parameter: `task_name` (task identifier), `input_name` (name of input), and `user_content` (content based on template). It also explains validation formats (JSON/TOML/YAML/XML) and required fields, adding significant meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Collect user input for template-based task inputs.' It provides specific actions (validate, upload, store) and distinguishes from siblings like `collect_parameter_input` and `confirm_template_input` by focusing on template-based inputs. The verb 'collect' and resource 'template input' are precise.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit context on when to use: 'Called after get_template_guidance() shows template to user' and 'Task-sequential collection only.' It also includes critical rules like 'Never use template defaults' and that it is for template inputs, not parameter inputs. However, it does not explicitly list alternatives or when not to use, so slightly incomplete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

configure_rule_output_schemaA

PREREQUISITE — MUST RUN FIRST (NON-SKIPPABLE) This tool is a hard prerequisite and MUST be executed successfully before the prepare_input_collection_overview() tool (and any downstream rule-creation or evaluation steps). If this tool has not run or did not complete, the workflow MUST fail fast with an explicit error.

PURPOSE Establish the rule's output schema policy for ComplianceCow and apply any required transformations. In ComplianceCow, we maintain a standard format for storing evidence records. The user MUST choose one of the following rule output options:

  1. Standard schema only (ComplianceCow structured response fields)

  2. Extended schema only (all fields from the source response)

  3. Both standard + extended

USER PROMPT (MANDATORY — NEVER SKIPPABLE) The workflow MUST always pause and explicitly prompt the user before proceeding.
This step CANNOT be bypassed, defaulted, auto-selected, or inferred.
If the user has not actively selected one of (a), (b), or (c), this tool MUST fail fast with a clear error message and stop execution.

VALIDATION & ENFORCEMENT

  • This tool is NON-SKIPPABLE. If not executed, or if the user does not provide an explicit choice (a/b/c), the workflow MUST stop immediately with an error.

  • No implicit defaults, assumptions, or auto-selections are allowed.

  • Mandatory Key mapping rules still apply if Standard schema is chosen.

BEHAVIOR BY SELECTION

A) If user selects STANDARD ONLY:

  • If the pipeline already ends with a Transformation task, reuse the existing Transformation task instead of appending a new one.

  • Otherwise, append a Transformation task at the END of the selected task pipeline.

  • In the Transformation task, map ALL Mandatory Keys (listed below).

  • Values for these keys MUST be taken from the pipeline's input file(s) and/or upstream task outputs, following the Deeper Analysis Rules.

  • Continue collecting inputs for the Transformation task using: collect_template_input() or collect_parameter_input().

  • For each input that requires user guidance, call: get_template_guidance('{task.name}', '<input_name>') to display the expected input format to the user.

  • Ask the user to review and confirm OR edit the configuration before proceeding.

  • Do not proceed unless all Mandatory Keys are mapped and the configuration is confirmed (fail fast with guidance).

B) If user selects EXTENDED ONLY:

  • The Extended schema is a NON-STANDARD structure. It preserves the raw fields from the source response without enforcing ComplianceCow's standard schema format or mandatory key order.

  • Use the LAST task's output directly as the Extended schema output.

  • No mandatory field ordering or schema enforcement is applied — the structure is kept as-is for completeness and traceability.

C) If user selects BOTH:

  • Perform all steps from (A) to create the Standard schema:

  • Append a Transformation task at the END of the selected task pipeline.

  • Map ALL Mandatory Keys in the exact required order.

  • Include as needed for compliance.

  • Also add the Extended schema as a NON-STANDARD structure:

  • Create exactly ONE output field named: ExtendedData_. MUST be determinable from the use case (e.g., source, resource, or input artifact name).

  • Map the SAME LAST task output that is used as the input to the Transformation task into ExtendedData_.

  • Do NOT create duplicate extended outputs (for example, do not add both ExtendedData_JSONToCSV and ConvertedCSVFile if they contain the same data). Only ExtendedData_ must exist.

  • Continue collecting inputs for the Transformation task using: collect_template_input() or collect_parameter_input().

  • For each input that requires user guidance, call: get_template_guidance('{task.name}', '') to display the expected input format to the user.

  • Ask the user to review and confirm OR edit the configuration before proceeding.

  • Do not proceed unless:

  • All Mandatory Keys are mapped and validated in order

  • Configuration is confirmed by the user

DEEPER ANALYSIS RULES

  • Always extract and map the core Mandatory Keys required for compliance.

  • For , determine the minimal required fields based on the user's specific use case and map them under the Standard schema.

  • If additional fields are critical for the use case, map them explicitly into the Standard schema.

  • If fields are non-critical but useful, preserve them under ExtendedData_<filename>.

  • If MCP cannot store certain fields, the tool MUST explain the omission clearly to the user before proceeding and request confirmation if needed.

MANDATORY KEYS (MUST ALWAYS BE MAPPED — IN THIS EXACT ORDER)

  • System

  • Source

  • ResourceID

  • ResourceName

  • ResourceType

  • ResourceLocation

  • ResourceTags

  • <Important Keys Based On User's Use Case> (for example: fields from the response file such as user_id, username, email, license_type, assigned_date, last_login_date, last_activity_date)

  • ValidationStatusCode

  • ValidationStatusNotes

  • ComplianceStatus

  • ComplianceStatusReason

  • EvaluatedTime

  • UserAction

  • ActionStatus

  • ActionResponseURL

VALIDATION & ENFORCEMENT

  • This tool is NON-SKIPPABLE. If not executed, or if any Mandatory Key mapping is missing for the chosen Standard schema path, the workflow MUST stop with an error.

  • Key names are case-sensitive and MUST NOT be renamed.

  • The tool MUST persist the chosen option and mappings so that downstream tools consume a consistent schema contract.

  • The workflow MUST NOT proceed to prepare_input_collection_overview() until:

    • Inputs are collected via collect_template_input() or collect_parameter_input()

    • get_template_guidance() has been used for each input needing guidance

    • The user has confirmed or edited the configuration

    • All Mandatory Keys are mapped and validated in order

  • Mandatory, a JS chart (Mermaid/D3) MUST be generated to visualize the rule's I/O field structure. The chart must be displayed in this chat immediately after user input, and no further processing is allowed until this step is completed.

EXECUTION ORDER GUARANTEE On success, and ONLY after input collection and configuration confirmation, the next tool to run MUST be prepare_input_collection_overview().

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It thoroughly discloses all behavioral traits: it requires mandatory user prompt, is non-skippable, and details three selection options (standard, extended, both) with specific actions for each. It also mentions chart generation and mapping persistence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and contains redundant phrasing (e.g., 'NON-SKIPPABLE' repeated multiple times). It is well-structured with clear sections, but could be more concise. The front-loading of the prerequisite warning is good.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of the tool (setting up output schema with user interaction), the description is highly detailed and covers all necessary aspects: purpose, prerequisites, user prompt requirement, behavior per selection, validation rules, and follow-up steps. However, the output schema is mentioned but not fully detailed in the description (though context says it exists).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, and schema description coverage is 100%. The description explains that the tool requires a user choice (a/b/c), which is not a formal parameter but is effectively the tool's input. It adds meaning beyond the schema by describing the three options and their implications.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: 'Establish the rule's output schema policy for ComplianceCow and apply any required transformations.' It explicitly positions itself as a mandatory prerequisite that must run before `prepare_input_collection_overview()`, distinguishing it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it MUST run first and is non-skippable. It also states when-not-to-use: if not executed or user does not provide explicit choice, the workflow must fail. It names the next tool (`prepare_input_collection_overview()`) and sets the ordering.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_parameter_inputA

Confirm and store parameter input after user validation.

CONFIRMATION PROCESSING (Enhanced with Automatic Rule Updates):

  • Handles final confirmation of parameter values

  • Stores confirmed values in memory

  • Supports both default value confirmation and final value confirmation

  • MANDATORY step before proceeding to next input

  • NEW: Automatically updates rule with parameter if rule_name provided

CONFIRMATION TYPES (Preserved):

  • "default": User confirmed they want to use default value

  • "final": User confirmed their entered value is correct

  • Both types require explicit user confirmation

STORAGE RULES (Enhanced):

  • Store all confirmed values in memory (never upload files)

  • Only store after explicit user confirmation

  • Include metadata about confirmation type and timestamp

  • NEW: Automatic rule update with parameter data

AUTOMATIC RULE UPDATE PROCESS: If rule_name is provided, this tool automatically:

  1. Fetches the current rule structure

  2. Adds the parameter to spec.inputs

  3. Updates spec.inputsMeta__ with parameter metadata

  4. Calls create_rule() to save the updated rule

  5. Rule status will be auto-detected based on completion

Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter rule_input_name: Must be one of the values defined in the rule structure's inputs confirmed_value: The value user confirmed explanation: Add explanation only if dataType is JQ_EXPRESSION or SQL_EXPRESSION. This field provides details about the confirmed_value. confirmation_type: Type of confirmation ("default" or "final") rule_name: Optional rule name for automatic rule updates

Returns: Dict containing stored value confirmation and rule update status

ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes
input_nameYes
rule_input_nameYes
confirmed_valueYes
explainationYes
confirmation_typeNofinal
rule_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses storing in memory, not uploading files, requiring explicit user confirmation, and the automatic rule update process including steps like fetching current rule structure and calling create_rule(). It lacks details on error handling or idempotency but covers essential behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections but is verbose. It repeats information (e.g., confirmation types and storage rules appear in multiple sections). While front-loaded with the main purpose, it could be more concise without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters (5 required) and an output schema, the description covers behavior, parameter semantics, and output format ('Dict containing stored value confirmation and rule update status'). There are no significant gaps for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add meaning. The Args section explains each parameter, including constraints like rule_input_name must be one of the rule structure's inputs and explanation is only for JQ/SQL expressions. It adds context beyond the schema, though some parameters like task_name are not elaborated beyond their name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool confirms and stores parameter input after user validation. It specifies the action (confirm and store), the resource (parameter input), and the context (user validation). It distinguishes from siblings like 'collect_parameter_input' and 'confirm_template_input' by detailing automatic rule updates and memory storage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is a 'MANDATORY step before proceeding to next input', providing clear when-to-use guidance. It mentions handling default and final confirmation types and automatic rule updates when rule_name is provided. However, it does not explicitly state when not to use this tool or what alternatives exist, though the sibling list provides context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

confirm_template_inputA

Confirm and process template input after user validation.

CONFIRMATION PROCESSING (Enhanced with Automatic Rule Updates):

  • Handles final confirmation of template content

  • Uploads files for FILE dataType inputs

  • Stores content in memory for non-FILE inputs

  • MANDATORY step before proceeding to next input

  • NEW: Automatically updates the rule with new input after processing

  • Skips confirmation if the user accepts the suggested template

PROCESSING RULES (Enhanced):

  • FILE dataType: Upload content as file, return file URL

  • HTTP_CONFIG dataType: Upload content as file, return file URL

  • Non-FILE dataType: Store content in memory

  • Include metadata about confirmation and timestamp

  • NEW: Automatic rule update with new input data

AUTOMATIC RULE UPDATE PROCESS: After successful input processing, this tool automatically:

  1. Fetches the current rule structure

  2. Adds the new input to spec.inputs

  3. Updates spec.inputsMeta__ with input metadata

  4. Calls create_rule() to save the updated rule

  5. Rule status will be auto-detected (DRAFT → collecting_inputs → READY_FOR_CREATION)

UI DISPLAY REQUIREMENT:

  • The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.

Args: rule_name: Descriptive name for the rule based on the user's use case. Note: Use the same rule name for all inputs that belong to this rule. Example: rule_name = "MeaningfulRuleName" task_name: Name of the task this input belongs to input_name: Name of the input parameter rule_input_name: Must be one of the values defined in the rule structure's inputs confirmed_content: The content user confirmed

Returns: Dict containing processing results (file URL or memory reference) and rule update status

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
task_nameYes
rule_input_nameYes
input_nameYes
confirmed_contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It comprehensively discloses the processing flow (file upload for FILE/HTTP_CONFIG, memory storage for others), automatic rule updates (including the step-by-step process), and UI display requirement. It does not mention error handling or permissions, but the detail is sufficient for transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is overly verbose with multiple sections in ALL CAPS, bullet points, and repetition (e.g., 'NEW' and 'Enhanced' markers). While it contains necessary information, the structure is not concise and could be streamlined to improve readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, no enums, output schema present), the description covers the processing steps, side effects (automatic rule updates), and UI requirement. It mentions the return type as a dict with file URL/memory reference and rule update status. It lacks error handling details or prerequisites, but is otherwise complete for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage for its 5 parameters. The description's 'Args' section adds valuable context: it specifies that rule_name should be consistent across inputs, task_name identifies the task, rule_input_name must match rule structure, confirmed_content is the validated content. This compensates for the schema's lack of descriptions, though not all parameters are equally detailed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Confirm and process template input after user validation.' It clearly states the verb (confirm/process) and the resource (template input). It distinguishes from siblings like confirm_parameter_input by specifying it's for template inputs, and it details sub-actions like file uploads and memory storage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is a 'MANDATORY step before proceeding to next input' and mentions it skips confirmation if the user accepts the suggested template. This provides clear context on when to use. However, it does not explicitly compare to sibling tools like collect_template_input or confirm_parameter_input, nor does it specify when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_asset_and_checkA

Create a new asse with an initial control and check structure. The asset will be created with a hierarchical structure: asset -> parentcontrol -> control -> check.

Args: - assetName (str): Name of the asset to be created. - controlName (str): Name of the initial control to be created within the asset. - checkName (str): Name of the initial check to be created under the control. (letters and numbers only, no spaces) - checkDescription (str): Description of the initial check.

Returns: - success (bool): Indicates if the asset was created successfully. - assetId (str): ID of the created asset (only present if successful). - error (Optional[str]): An error message if any issues occurred during creation.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetNameYes
controlNameYes
checkNameYes
checkDescriptionYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the burden. It details the hierarchical creation, parameter constraints (checkName format), and return values. It lacks info on idempotency or error details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with bullet under 'Args', front-loaded with main purpose. Minor typo ('asse' instead of 'asset') slightly reduces clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 params, no annotations, and implied output schema, description is quite complete. Covers hierarchy, parameters, and returns. Missing context like authentication or error scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It provides clear meaning for all four parameters, including format constraint for checkName, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it creates a new asset with a hierarchical control and check structure. It distinguishes from sibling 'add_check_to_asset' by emphasizing creation of the full hierarchy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for creating a new asset with initial structure, but does not explicitly state when to use this tool vs alternatives like 'add_check_to_asset'. No when-not or exclusion conditions provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_control_noteA

Create a documentation note on a control.

This tool creates a markdown documentation note that is attached to a control.

✅ CONFIRMATION-BASED SAFETY FLOW

  • When confirm=False: → The tool returns a PREVIEW of the generated markdown note. → The user may edit the note before confirming.

  • When confirm=True: → The note is permanently created and attached to the control.

Args: controlId (str): The control ID where the note will be attached (required). assessmentId (str): The assessment ID or asset ID that contains the control (required). notes (str): The documentation content in MARKDOWN format (required). topic (str, optional): Topic or subject of the note. confirm (bool, optional):
- False → Preview only (default, no persistence) - True → Create and permanently attach the note

Returns: Dict with success status and note data: - success (bool): Whether the request was successful - note (dict, optional): Created note object containing: - id (str): Note ID - topic (str): Note topic - notes (str): Note content in markdown format - controlId (str): Control ID the note is attached to - assessmentId (str): Assessment ID - error (str, optional): Error message if request failed - next_action (str, optional): Recommended next action

ParametersJSON Schema
NameRequiredDescriptionDefault
controlIdYes
assessmentIdYes
notesYes
topicYes
confirmNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description fully discloses the dual behavior: preview mode vs. permanent creation. It explains the return values and that the note is attached to a control. It does not mention permissions or side effects, but the core behavioral split is well-covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but well-organized with sections, bullet points, and formatting. Each part serves a purpose, though it is slightly longer than necessary. The main purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (confirmation flow, five parameters, detailed return schema), the description is complete. It explains the preview behavior, the creation mode, and the full return object, making it self-sufficient even without annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description lists all five parameters with their purposes, required status, and the confirm parameter's boolean options. It also explains the return structure, adding significant value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool creates a documentation note attached to a control, specifying the verb 'create' and the resource 'control note'. It distinguishes itself from siblings like 'update_control_note' and 'list_control_notes' by focusing on creation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on the confirmation-based safety flow with confirm=False for preview and confirm=True for persistence. While it does not explicitly mention when to use this tool versus alternatives, the flow is clearly explained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_design_notesA

Create and save design notes after user confirmation.

DESIGN NOTES CREATION:

This tool actually creates and saves the design notes after the user has reviewed and confirmed the preview structure from generate_design_notes_preview().

WORKFLOW:

  1. Before creating new design notes, call fetch_rule_design_notes() to check if already exist and continue the flow, if not then continue this flow

  2. User has already reviewed notebook structure from preview

  3. User confirmed the structure is acceptable

  4. This tool receives the complete design notes dictionary structure

  5. MCP saves the notebook and returns access details

Args: rule_name: Name of the rule for which to create design notes design_notes_structure: Complete Jupyter notebook structure as dictionary

Returns: Dict containing design notes creation status and access details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
design_notes_structureYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears full burden for behavioral disclosure. It discloses that the tool creates and saves design notes and returns access details. However, it could be more transparent about side effects (e.g., overwriting) or permissions required, but the provided info is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections, front-loading the main purpose. While slightly verbose with repeated workflow steps, it is organized and clear, earning a high but not perfect score for conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's role in a multi-step workflow, the description effectively explains how it fits: prerequisite calls, user confirmation, and return details. It references sibling tools and provides a comprehensive overview, making it complete for its context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so by explaining rule_name as 'Name of the rule' and design_notes_structure as 'Complete Jupyter notebook structure as dictionary', adding meaningful context beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create and save design notes after user confirmation', specifying the verb and resource. It also distinguishes itself from sibling tools like generate_design_notes_preview and fetch_rule_design_notes by outlining the workflow context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides usage guidelines: call fetch_rule_design_notes first to check existence, then proceed after user confirmation of the preview. It also lists the workflow steps, making it clear when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_ruleA

Create a rule with the provided structure.

COMPLETE RULE CREATION PROCESS WITH PROGRESSIVE SAVING:

This tool now handles both initial rule creation and progressive updates during the rule creation workflow. It intelligently detects the completion status and sets appropriate metadata automatically. It returns the URL to view the rule in the UI once it is created display the URL in chat.

ENHANCED FOR PROGRESSIVE SAVING:

  • Automatically detects rule completion status based on rule structure content

  • Determines if rule is in-progress, ready for execution, or needs more inputs

  • Handles both initial creation and updates of existing rules

  • No additional parameters needed - analyzes rule structure intelligently

  • Maintains all existing validation and creation logic

  • Preserves all original docstring instructions and requirements

CRITICAL REQUIREMENT - INPUTS META:

  • spec.inputsMeta__ is mandatory for all rules, and rule creation cannot proceed without it.

AUTOMATIC STATUS DETECTION:

  • DRAFT: Rule has tasks but missing inputs or I/O mapping (5-85% complete)

  • READY_FOR_CREATION: All inputs collected but I/O mapping incomplete (85% complete)

  • ACTIVE: Complete rule with tasks, inputs, and I/O mapping (100% complete)

RULE COMPLETION ANALYSIS:

  • Checks if tasks are defined in spec.tasks

  • Validates that spec.inputsMeta__ exists

  • Counts collected inputs in spec.inputs vs spec.inputsMeta__

  • Validates I/O mapping presence and completeness in spec.ioMap

  • Analyzes outputsMeta__ for mandatory compliance outputs

  • Sets appropriate status and creation phase automatically

PROGRESSIVE CREATION PHASES (Auto-detected):

  1. "initialized" - Basic rule info provided (5%)

  2. "tasks_selected" - Tasks chosen and defined (25%)

  3. "collecting_inputs" - Individual inputs being collected (25-85%)

  4. "inputs_collected" - All inputs gathered, ready for I/O mapping (85%)

  5. "completed" - Final rule creation complete with I/O mapping (100%)

ORIGINAL REQUIREMENTS MAINTAINED:

  • All existing validation rules still apply

  • Task alias validation in I/O mappings preserved

  • Primary app type determination logic maintained

  • Mandatory output requirements (CompliancePCT_, ComplianceStatus_, LogFile)

  • YAML preview and user confirmation workflow preserved

  • All existing error handling and validation checks

CRITICAL: This tool should be called:

  1. After planning phase to create initial rule structure

  2. After each input collection to update rule progressively

  3. After input verification to finalize rule with I/O mapping

  4. Rule status and progress automatically detected each time

PRE-CREATION REQUIREMENTS (Original):

  1. spec.inputsMeta__ must be defined and contain valid input definitions

  2. All inputs must be collected through systematic workflow

  3. User must provide input overview confirmation

  4. All template inputs processed via collect_template_input()

  5. All parameter values collected and verified

  6. User must confirm all input values before rule creation

  7. Primary application type must be determined

  8. Rule structure must be shown to user in YAML format for final approval

STEP 1 - PRIMARY APPLICATION TYPE DETERMINATION (Preserved): Before creating rule structure, determine primary application type:

  1. Collect all unique appType tags from selected tasks

  2. Filter out 'nocredapp' (dummy placeholder value)

  3. Handle app type selection:

    • If only one valid appType: Use automatically

    • If multiple valid appTypes: Ask user to choose primary application

    • If no valid appTypes (all were nocredapp): Use 'generic' as default

  4. Set primary app type for appType, annotateType, and app fields (single value arrays)

STEP 2 - RULE STRUCTURE WITH TASK ALIASES (Preserved):

    apiVersion: rule.policycow.live/v1alpha1
    kind: rule
    meta:
        name: MeaningfulRuleName # Simple name. Without special characters and white spaces
        purpose: Clear statement based on user breakdown
        description: Detailed description combining all steps
        labels:
            appType: [PRIMARY_APP_TYPE_FROM_STEP_1] # Single value array CRITICAL: Must be extracted from spec.tasks[].appTags.appType - NEVER use random values or user requirements
            environment: [logical] # Array
            execlevel: [app] # Array
        annotations:
            annotateType: [PRIMARY_APP_TYPE_FROM_STEP_1] # Same as appType - MUST match a task's appType
    spec:
        inputs:
        InputName: [ACTUAL_USER_VALUE_OR_FILE_URL]  # Use original or unique names based on conflicts, omit duplicates
        inputsMeta__:
        - name: InputName             # unique name for the input
        description:                # purpose of the input
        dataType: FILE|HTTP_CONFIG|STRING|INT|FLOAT|BOOLEAN|DATE|DATETIME
        repeated:                   # true = multiple values allowed, false = single value
        allowedValues:              # if repeated=true: comma-separated input is split into array
        required:                   # value must be taken from task details.
        defaultValue: [ACTUAL_USER_VALUE] #values are collected from users, If the dataType is FILE or HTTP_CONFIG then the value should be filepath URL.
        format: [ACTUAL_FILE_FORMAT]      # only include for FILE types (json, yaml, toml, xml, etc.)
        showField: true                   # true = most important field, false = optional/less important
        outputsMeta__:
        - name: FinalOutput
        dataType: FILE|STRING|INT|FLOAT|BOOLEAN|DATE|DATETIME
        required: true
        defaultValue: [ACTUAL_RULE_OUTPUT_VALUE]
        tasks:
        - name: Step1TaskName # Original task names
        alias: step1 # Meaningful task aliases (simple descriptors)
        type: task
        appTags:
            appType: [COPY_FROM_TASK_DEFINITION] # Keep original task appType
            environment: [logical] # Array
            execlevel: [app] # Array
        purpose: What this task does for Step 1
        - name: Step2TaskName
        alias: validation # Another meaningful alias
        type: task
        appTags:
            appType: [COPY_FROM_TASK_DEFINITION]
            environment: [logical] # Array
            execlevel: [app] # Array
        purpose: What this task does for validation
        ioMap:
        - step1.Input.TaskInput:=*.Input.InputName  # Use task aliases in I/O mapping
        - validation.Input.TaskInput:=step1.Output.TaskOutput
        # MANDATORY: Always include these three outputs from the last task
        - '*.Output.FinalOutput:=validation.Output.TaskOutput'
        - '*.Output.CompliancePCT_:=validation.Output.CompliancePCT_'    # Compliance percentage from last task
        - '*.Output.ComplianceStatus_:=validation.Output.ComplianceStatus_'  # Compliance status from last task
        - '*.Output.LogFile:=validation.Output.LogFile'  # Log file from last task

STEP 3 - I/O MAPPING WITH TASK ALIASES (Preserved):

  • Use golang-style assignment: destination:=source

  • 3-part structure: PLACE.DIRECTION.ATTRIBUTE_NAME

  • Always use EXACT attribute names from task specifications

  • Use meaningful task aliases instead of generic names

  • Ensure sequential data flow: Rule → Task1 → Task2 → Rule

  • Mandatory compliance outputs from last task

STEP 4 - inputsMeta__ Cleanup: In spec.inputsMeta__, retain only the entries whose keys exist in spec.inputs. Remove any fields in spec.inputsMeta__ that are not present in spec.inputs.

VALIDATION CHECKLIST (Preserved): □ Rule structure validation against schema □ Task alias validation in I/O mappings □ Primary app type determination □ Input/output specifications validation □ Mandatory compliance outputs present □ Sequential data flow in I/O mappings

Args: rule_structure: Complete rule structure with any level of completion

Returns: Result of rule creation including auto-detected status and completion level

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_structureYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully details behavior: it handles creation and updates, auto-detects status, has progressive phases, and returns a URL. It does not mention auth needs or rate limits, but covers the primary behavioral aspects comprehensively.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and repetitive, with multiple sections repeating similar information (e.g., progressive saving, phases). While important details are present, conciseness is lacking; it could be streamlined without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of rule creation, the description is extremely complete. It covers all phases, validation, examples, and requirements. It also references an output schema (though not provided), so return values need not be described. The description leaves no critical gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has only one parameter (rule_structure) with 0% schema description coverage. The description compensates extensively by documenting the structure with a YAML example, steps, validation checklist, and all required fields, providing far more meaning than the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a rule with the provided structure' and elaborates on progressive saving and automatic status detection. It distinguishes from sibling tools (e.g., fetch_rule, publish_rule) by specifying it is for creation and progressive updates.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly specifies when to call the tool: after planning, after each input collection, and after input verification. It lists pre-creation requirements and workflow steps, but does not explicitly state when not to use it or mention alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_rule_readmeA

Create and save README.md file after user confirmation.

README CREATION:

This tool actually creates and saves the README.md file after the user has reviewed and confirmed the preview content from generate_rule_readme_preview().

WORKFLOW:

  1. User has already reviewed README content from preview

  2. User confirmed the content is acceptable

  3. This tool receives the complete README.md content as string

  4. MCP saves the README file and returns access details

Args: rule_name: Name of the rule for which to create README readme_content: Complete README.md content as string

Returns: Dict containing README creation status and access details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
readme_contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains the tool saves the file and returns access details, but does not address potential overwrites, permissions, or side effects. The behavior is adequately disclosed but lacks deeper safety context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections (README CREATION, WORKFLOW, Args, Returns). It is front-loaded with purpose, each sentence adds value, and there is no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool with 2 string parameters and an output schema, the description covers the workflow and return details. It lacks error scenarios (e.g., invalid content), but is largely sufficient for an AI agent to understand the tool's role.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% description coverage. The description adds 'Name of the rule' and 'Complete README.md content as string', which clarifies the parameters beyond the schema. This compensates well, though more detail (e.g., format constraints) would improve.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create and save README.md file after user confirmation.' It explicitly differentiates from the sibling tool generate_rule_readme_preview and update_rule_readme by specifying it is the final step after preview and confirmation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear workflow: user must have reviewed preview and confirmed. It implies usage only after preview, but does not explicitly state when not to use or list alternatives. The context is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_support_ticketA

PURPOSE:

  • Create structured support tickets only after strict user review and explicit approval of all descriptions.

  • Ticket creation MUST NOT occur without explicit user confirmation at every required step.

  • Reduce user input errors and rework by ensuring clarity and completeness before ticket submission.

MANDATORY CONDITIONS — NO STEP MAY BE SKIPPED OR BYPASSED:

  1. BEFORE TOOL ENTRY:

  • The tool MUST generate a detailed, pre-filled plain-text description for the task or workflow.

  • The user MUST review this description carefully.

  • Ticket creation MUST be blocked until the user explicitly APPROVES this description.

  1. USER VERIFICATION:

  • The user MUST be presented with the full pre-filled description.

  • The user MUST either confirm its correctness or provide feedback for changes.

  • The tool MUST update the description and priority per feedback and repeat this verification step as many times as needed.

  • Skipping or auto-approving this step is strictly prohibited.

  1. FINAL APPROVAL & FORMATTING:

  • After user approval of the plain text, the description MUST be converted into professional HTML format (bold headings, clear structure, spacing).

  • The user MUST explicitly approve this final HTML-formatted description.

  • The tool MUST block ticket creation until this final approval is given.

  • Only the fully user-approved, HTML-formatted description MAY be used to create the support ticket.

IMPORTANT:
Under no circumstances shall the tool proceed to ticket creation without explicit user approval at all mandatory steps.
The process must strictly enforce these approvals, preventing any premature or automatic ticket submissions.

MANDATORY USER INPUTS:

  • subject (str) — ticket title.

  • description (str) — final user-approved, HTML-formatted description.

  • priority (str) — ticket priority level.
    Valid values: "High", "Medium", "Low" (case-sensitive).
    The user MUST provide one of these values to proceed.

RETURNS:

  • A dictionary simulating the ticket creation response for integration or testing purposes.

ParametersJSON Schema
NameRequiredDescriptionDefault
subjectYes
descriptionYes
priorityYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It describes intended agent behavior (generating descriptions, blocking creation) rather than actual tool behavior, which may mislead. It adds some context but is more about process than tool capabilities.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose and repetitive, with multiple bullet sections. It is structured but could be more concise. Several sentences rephrase the same idea of mandatory user approval.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 3 parameters and no enums, the description thoroughly covers the workflow and output. It mentions the return type (dictionary) and provides all necessary context for correct usage, though it overemphasizes process.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description compensates by explaining each parameter: subject as title, description as HTML-formatted and user-approved, priority with valid case-sensitive values (High, Medium, Low). This adds meaningful guidance beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates support tickets after user review. It differentiates from sibling tools by emphasizing a strict approval workflow, though no direct sibling comparison is made.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit mandatory conditions and steps, including when to use (after user approval) and when not to use (without approval). It does not compare to alternatives but offers clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_workflowA

Create a new workflow using YAML definition. Always display the workflow diagram. Before creation confirm workflow name and creation with the user before executing this tool. Later use 'modify_workflow' tool to update states, activities, conditions, and transitions.

yaml struct:

metadata: name: description: summary: mermaidDiagram:

This function creates a workflow from a YAML specification.

Create workflow (establishes the ID) Update summary (document what we're building) Update mermaid diagram (visualize the flow) Then modify workflow (implement the actual logic)

Args: workflow_yaml: YAML string defining the workflow structure

Returns: Success message with workflow ID or error message

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_yamlYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose side effects, permissions, or safety concerns. It mentions displaying a diagram and a confirmation step but does not address reversibility, overwrite behavior, or error cases. The YAML struct hint adds some context, but behavioral traits are insufficiently covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat verbose, containing redundant statements (e.g., 'Create a new workflow using YAML definition' and 'This function creates a workflow from a YAML specification'). It includes an Args/Returns section and a code block, but could be more tightly written without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema (not shown), the description reasonably covers the tool's purpose, usage, and parameter format. However, it lacks detail on expected behavior, error states, or prerequisites, and does not fully differentiate from the many sibling tools that exist on the server.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides a YAML struct example and states that the parameter is a 'YAML string defining the workflow structure,' which adds meaning beyond the schema's type-only definition. However, it does not fully specify all YAML fields or constraints, leaving gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates a new workflow using a YAML definition, and distinguishes it from the similarly named 'modify_workflow' tool, which handles updates. The verb 'create' and resource 'workflow' are specific, and the YAML format is explicitly referenced.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: confirm with user before execution and later use 'modify_workflow' for updates. It outlines a multi-step process for workflow creation, which helps the agent decide when to use this tool, though it could also note when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_workflow_custom_eventA

Create a Workflow Catalog Custom Event. Show a preview of the event configuration and ask for user confirmation before proceeding. Only create the event after explicit confirmation from user (confirm=True) This tool validates payload item types against allowed values and requires explicit user confirmation before creating the event.

Args: - displayable: Event display name - desc: Event description - categoryId: Event category identifier - payload: List of payload items. Each item must have {name, type, desc} and type must be one of: Text, MultilineText, TextArray, DynamicTextArray, Number, File, Boolean, Json - eventType: Event type. Default: "CUSTOM_EVENT" - confirm: Boolean flag. If False, will show a preview for user confirmation. Only returns True after user explicitly accepts the preview. Returns: - Success or error message

ParametersJSON Schema
NameRequiredDescriptionDefault
displayableYes
descYes
payloadYes
categoryIdNo7
eventTypeNoCUSTOM_EVENT
confirmNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavioral traits: it validates payload item types, requires explicit user confirmation, and returns a success or error message. It explains that when confirm=False, it returns a preview without creating the event. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose statement, usage instructions, and parameter list. It is front-loaded with the key confirmation requirement. While it is fairly detailed, it could be slightly more concise, but the structure aids readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (6 parameters, nested schema), the description covers the main behavior and all parameters. It explains the confirmation workflow and validation. The return value is vaguely described as 'Success or error message,' but since the context indicates an output schema exists, this is acceptable. It adequately supports an agent's decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains all six parameters in the Args section, adding meaning beyond the schema. For example, it lists the allowed types for payload items, which the schema references via $defs. Schema coverage is 0%, so the description carries the full burden and does so effectively.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Create a Workflow Catalog Custom Event.' It uses a specific verb (create) and resource (Workflow Catalog Custom Event), and the tool name is self-explanatory. Among siblings, there is no other creation tool for custom events, so differentiation is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidelines: 'Show a preview of the event configuration and ask for user confirmation before proceeding. Only create the event after explicit confirmation from user (confirm=True).' It instructs the agent to first call with confirm=False to show a preview, then only proceed with confirm=True after user acceptance. This clearly defines when and how to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_asset_scheduleB

Delete an existing assessment schedule.

Args: - scheduleId (str): ID of the schedule to delete

Returns: - success (bool) - error (Optional[str])

ParametersJSON Schema
NameRequiredDescriptionDefault
scheduleIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full burden. It discloses deletion and return values but omits important behavioral traits like irreversible effects, required permissions, or error handling for non-existent schedules.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and front-loaded. However, the structured Args/Returns format adds redundancy given the schema and presumed output schema. Some fluff could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple delete tool with one parameter and an output schema, the description is adequate but lacks explanation of edge cases (e.g., idempotency, what happens if schedule doesn't exist).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'scheduleId' has 0% schema description coverage. The description adds 'ID of the schedule to delete,' which is redundant with the parameter name and adds no additional meaning (e.g., format, source, or validation).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (delete) and the resource (assessment schedule). It distinguishes from sibling tools like list_asset_schedules and schedule_asset_execution.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives, nor prerequisites like schedule existence or permissions. The description provides no context for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_actionA

Use this tool when the user asks about actions such as create, update or other action-related queries.

IMPORTANT: This tool MUST ONLY be executed after explicit user confirmation. Always prompt for REQUIRED-FROM-USER field from user and get inputs from user. Always confirm the inputs below execute action. Always describe the intended action and its effects to the user, then wait for their explicit approval before proceeding. Do not execute this tool without clear user consent, as it performs actual operations that modify system state.

Execute or trigger a specific action on an assessment run. use assessment id, assessment run id and action binding id. Execute or trigger a specific action on an control run. use assessment id, assessment run id, action binding id and assessment run control id . Execute or trigger a specific action on an evidence level. use assessment id, assessment run id, action binding id, assessment run control evidence id and evidence record ids. Use fetch assessment available actions to get action binding id. Only once action can be triggered at a time, assessment level or control level or evidence level based on user preference. Use this to trigger action for assessment level or control level or evidence level. Please also provide the intended effect when executing actions. For inputs use default value as sample, based on that generate the inputs for the action. Format key - inputName value - inputValue. If inputs are provided, Always ensure to show all inputs to the user before executing the action, and also user to make changes to the inputs and also confirm modified inputs before executing the action.

WORKFLOW:

  1. First fetch the available actions based on user preference assessment level or control level or evidence level

  2. Present the available actions to the user

  3. Ask user to confirm which specific action they want to execute

  4. Explain what the action will do and its expected effects

  5. Wait for explicit user confirmation before calling this tool

  6. Only then execute the action with this tool

Args: - assessmentId - assessmentRunId - actionBindingId - assessmentRunControlId - needed for control level action - assessmentRunControlEvidenceId - needed for evidence level action - evidenceRecordIds - needed for evidence level action - inputs (Optional[dict[str, Any]]): Additional inputs for the action, if required by the action's rules.

Returns: - id (str): id of triggered action.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessmentIdYes
assessmentRunIdYes
actionBindingIdYes
assessmentRunControlIdNo
assessmentRunControlEvidenceIdNo
evidenceRecordIdsNo
inputsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
idNo
errorNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses that this tool modifies system state, requires explicit user confirmation, and can only trigger one action at a time. It explains the return value (triggered action id) and references the need to fetch action binding IDs, providing clear behavioral expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose and contains repetition (e.g., user confirmation is mentioned multiple times). It includes a lengthy workflow and multiple warnings that could be condensed. The essential information is present but not optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, no schema descriptions, no annotations, output schema exists), the description covers the workflow, safety, level-specific parameters, and return value. It does not address error handling or non-standard scenarios, but it is largely sufficient for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains which parameters are needed for each level (control, evidence) and notes that inputs are optional and action-specific. It also describes how to obtain actionBindingId. However, it lacks detailed semantics for each parameter (e.g., how to derive assessmentId, assessmentRunId) beyond level differentiation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes actions on assessment runs at different levels (assessment, control, evidence). It specifies the resource ('action on assessment run') and verb ('execute or trigger'), and distinguishes itself from sibling tools like fetch_assessment_available_actions by referencing them in the workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit step-by-step workflow, including prerequisites (fetch available actions), user confirmation requirements, and parameter necessity by level. It includes strong warnings not to execute without user consent and instructs to prompt for required fields and input modifications.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_cypher_queryA

Given a question and query, execute a cypher query and transform result to human readable format.

This tool queries a Neo4j graph database containing compliance controls, frameworks, and evidence.

Key database structure: - Controls have hierarchical relationships via HAS_CHILD edges - Evidence nodes are attached to leaf controls (controls with no children) - Use recursive patterns [HAS_CHILD*] for traversing control hierarchies - Controls may have multiple levels of nesting - Evidence contains records - RiskItem nodes are attached to control-config via HAS_RISK & HAS_MAPPED_CONTROL edges - RiskItemAttribute nodes are attached to RiskItem via HAS_ATTRIBUTE edges - RiskItem contains RiskItemAttributes

Query guidelines: - For control hierarchies: Use MATCH (parent)-[HAS_CHILD*]->(child) patterns - For evidence: Evidence is only available on leaf controls (Always check last child of control for evidence) (no outgoing HAS_CHILD relationships) - For control depth: Calculate hierarchy depth when analyzing control structures - Use APOC procedures for complex graph operations when available - While list assessment run always include assessment name - For large datasets from query: Provide overview summary & suggest refinement suggestion

Args: query (str): The Cypher query to execute against the graph database.

Returns: - result (Any): The formatted, human-readable result of the Cypher query. - error (Optional[str]): An error message if the query execution fails or encounters issues.

Example queries: - Find all root controls: MATCH (c:Control) WHERE NOT ()-[:HAS_CHILD]->(c) RETURN c - Get control hierarchy: MATCH (root)-[:HAS_CHILD*]->(leaf) RETURN root, leaf - Find evidence for controls (leaf control): MATCH (c:Control)-[:HAS_EVIDENCE]->(e:Evidence) RETURN c, e - Find leaf control: MATCH (c:Control) WHERE NOT (c)-[:HAS_CHILD]->(:Control) RETURN c - Find records: MATCH (e:Evidence)-[:HAS_RECORD]-(:Record) RETURN e

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultNo
errorNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description lacks annotations, so it carries the full burden of behavioral disclosure. It explains the database structure and query patterns but does not warn that the tool can execute write queries (Cypher includes CREATE, DELETE, etc.), potentially leading to unintended data mutation. It also omits permission requirements or error handling details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear purpose statement, nested details, and examples. It is somewhat lengthy but every section adds value. It could be slightly more concise by removing redundant phrases.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the minimal input schema and no annotations, the description provides a comprehensive overview of the tool's behavior, database context, and return format. It is mostly complete but could benefit from mentioning write operation implications and more detailed error handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage for the single parameter 'query', the description fully compensates by providing query guidelines, database schema details, and multiple example queries. This adds critical meaning beyond the bare schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes a Cypher query and transforms the result to a human-readable format. It specifies the database type (Neo4j) and provides extensive context on database structure, making the purpose unambiguous and distinct from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides query guidelines, example queries, and hints for traversing hierarchies. While it does not explicitly compare to alternative tools or state when not to use it, the context given is sufficient for an agent to understand appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_ruleA

RULE EXECUTION WORKFLOW:

PREREQUISITE STEPS: 0. MANDATORY: Check rule status to ensure rule is fully developed before execution

  1. User chooses to execute rule after creation

  2. Extract unique appTags from selected tasks (excluding 'nocredapp')

  3. APPLICATION CONFIGURATION (OPTIONAL - only for tasks requiring credentials): For tasks that need application credentials:

    • Fetch available applications via get_applications_for_tag().

    • Present them to the user for manual selection.

    • User decides to: a. Use an existing application, or b. Run with new credentials (not persisted or saved as an application).

    • Proceed after user confirmation.

    Note: Rules with only 'nocredapp' tasks can be executed without any application configuration.

APPLICATION-TASK MATCHING LOGIC (when applications are needed):

  • Applications are matched to tasks via 'appTags' labels

  • Tasks with 'nocredapp' appType do not require application configuration

  • SHARED APPLICATION SUPPORT: A single application CAN be used for multiple tasks if the user confirms they want to share the same credentials

  • When multiple tasks share the same appType AND require DIFFERENT applications, unique identifier key-value pairs MUST be added to distinguish them

MATCHING SCENARIOS:

  1. One application per task: Each task has unique appType → straightforward matching

  2. Shared application: Multiple tasks share same appType AND same application

    • User confirms: "Use same application for all [appType] tasks? (yes/no)"

    • If yes: Single application covers all matching tasks

    • Application appTags should match the common appType

  3. Multiple applications for same appType: Different credentials needed for different tasks

    • Add unique identifier key (e.g., "purpose", "sourceSystem") to distinguish

    • Each application's appTags must include the unique identifier matching its target task

APPLICATION CONFIGURATION FORMAT (when needed): For existing application (can be shared across multiple tasks): json [ { "applicationType": "[application_class_name from fetch_applications(appType)]", "applicationId": "[Actual application ID chosen by user]", "appTags": "[Complete object from rule spec.tasks[].appTags]" } ]

For new credentials: json [ { "applicationType": "[application_class_name from fetch_applications(appType)]", "appURL": "[Application URL from user (optional - can be empty string)]", "credentialType": "[User chosen credential type]", "credentialValues": { "[User provided credentials]" }, "appTags": "[Complete object from rule spec.tasks[].appTags]" } ]

WORKFLOW FOR MULTIPLE TASKS WITH SAME APPTYPE:

  1. Detect tasks sharing same appType (excluding 'nocredapp')

  2. Ask user: "Tasks [task1, task2] both require [appType]. Options: a) Use SAME application/credentials for all tasks b) Use DIFFERENT applications (requires unique identifiers)"

  3. If SAME: User provides one application config with basic appTags

  4. If DIFFERENT:

    • Prompt for unique identifier key (e.g., "purpose", "sourceSystem")

    • User provides separate application configs with unique identifier values

    • Update task appTags with matching unique identifiers

  5. Build applications array (if needed) → get user confirmation

  6. Additional Inputs (optional):

    • Ask user: "Do you want to specify a date range for this execution?"

    • From Date (format: YYYY-MM-DD) - optional

    • To Date (format: YYYY-MM-DD) - optional

  7. Final confirmation → execute rule

  8. If execution starts successfully → call fetch_execution_progress()

  9. Rule Output File Display Process: a. Extract task outputs from execution results b. MANDATORY: Show output in this format: - TaskName: [task_name] - Files: [list of files] c. Ask: "View file contents? (yes/no)" d. If yes: Call fetch_output_file() for each requested file e. Display results with formatting

  10. Rule Publication (optional):

  • Ask user: "Do you want to publish this rule to make it available in ComplianceCow system? (yes/no)"

  • If yes: Call publish_rule() to publish the rule

  • If no: End workflow

UI DISPLAY REQUIREMENT:

  • The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.

CRITICAL: rule_inputs MUST be the complete spec.inputsMeta__ objects with ALL original fields (name, description, dataType, repeated, allowedValues, required, defaultValue, format, showField, explanation) plus the 'value' field. DO NOT send trimmed objects with only name/dataType/value.

MANDATORY: The 'value' field content MUST also be copied to the 'defaultValue' field. Both fields must contain identical values. Example: if value="CSV", then defaultValue must also be "CSV".

Args: rule_name: The name of the rule to be executed. from_date: (Optional) Start date provided by the user in the format YYYY-MM-DD. to_date: (Optional) End date provided by the user in the format YYYY-MM-DD. rule_inputs: Complete spec.inputsMeta__ objects with ALL fields plus 'value' field, and 'defaultValue' set to same value as 'value'. applications: Application configuration details. For rules with only 'nocredapp' tasks, pass an empty list and the system will automatically use the hardcoded nocredapp application structure. is_application_data_provided_by_user (bool): Indicates whether application data was provided by the user. - Set to True if user provided or configured application details during execution. - Set to False if using nocredapp (empty applications list) or pre-existing applications.

Returns: Dict with execution results

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
from_dateYes
to_dateYes
rule_inputsYes
applicationsYes
is_application_data_provided_by_userYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It details the execution workflow, application matching logic, output display process, and optional publication. It also specifies critical data formatting rules for 'rule_inputs'. However, it does not explicitly mention authentication requirements or side effects like data mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively long, running multiple hundreds of words with a full workflow that includes UI display requirements and step-by-step instructions. While it is structured with sections and formatting, it could be significantly trimmed without losing essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (rule execution with application orchestration and output handling), the description covers all necessary aspects: prerequisites, configuration options, matching logic, parameter specifications, post-execution steps, and optional publication. The mention of a return value (Dict with execution results) complements the output schema richness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the 'Args' section in the description adds substantial meaning to each parameter. It explains the complex structure of 'rule_inputs' and 'applications' beyond the generic object type, including constraints like the 'defaultValue' requirement. The explanation is thorough but verbose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly indicates that the tool executes a rule, but the purpose is embedded in a lengthy workflow narrative rather than stated concisely upfront. The verb 'execute' and resource 'rule' are explicit, and it distinguishes from siblings like 'execute_task' by specifying the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides extensive usage guidance including mandatory prerequisite steps and post-execution actions. However, it does not explicitly contrast with sibling tools like 'execute_task' or 'publish_rule', and when-not-to-use scenarios are implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_taskA
Execute a specific task with real data after collecting all required inputs.

**This tool executes tasks with REAL data, not sample data.**
If any input depends on a previous task's output and that output is not available,
the dependent task(s) MUST be executed first to obtain the real output.

===============================================================================
EXECUTION CONTEXT
===============================================================================
- This tool MUST be called after collecting the inputs for a task.
- Execution is sequential: execute Task 1 → then Task 2 → etc.
- No task may proceed until its dependent tasks have been executed.
- On execution failure, provide detailed error feedback.

===============================================================================
DEPENDENCY & REAL DATA HANDLING
===============================================================================
If a task requires input from a previous task (dataset, file, or structured output):

1. **Use real task output when available**
    - If the dependent task was already executed and produced outputs:
        → Use those outputs as the input.
        → Do NOT generate synthetic/sample data.
        → Do NOT re-run the previous task unnecessarily.

2. **If required previous task output does NOT exist**
    - The assistant MUST:
        - Explain *why* execution of the previous task is required.
        - Automatically execute the previous task (and any required tasks in the chain).
        - **After execution, display all execution results and outputs.**
        - NO user confirmation should be requested—only explanation.
        - Use the REAL output from the executed task as input.

3. **If executing a required previous task fails**
    - The assistant MUST:
        - Explain clearly why the task failed.
        - Ask the user to provide the required input data manually.
    - User-provided data becomes the fallback input.

4. **Only execute what is needed**
    - Execute ONLY the minimal set of tasks whose outputs are required.
    - **Every executed task must have its results shown to the user immediately.**

===============================================================================
APPLICATION CONFIGURATION
===============================================================================
Application credentials are REQUIRED if the task's appType is NOT 'nocredapp'.

If the task requires application credentials (appType != 'nocredapp'):
- Application config must be provided with:
    - appName: Application class name
    - appURL: Application URL (optional, can be empty string)
    - credentialType: Type of credentials
    - credentialValues: Actual credential key-value pairs
- OR applicationId if using existing saved application

If the task's appType is 'nocredapp':
- Application configuration can be omitted (pass None or empty)
- The system will automatically use the hardcoded nocredapp application structure:
  {
      "applicationType": "NoCredApp",
      "appURL": "",
      "credentialType": "NoCred",
      "credentialValues": {"Dummy": ""},
      "appTags": {"appType": ["nocredapp"], "environment": ["logical"], "execlevel": ["app"]}
  }

===============================================================================
TASK EXECUTION FLOW
===============================================================================
1. Receive task name and collected inputs
2. Check if any input depends on previous task output
3. For dependency inputs:
    a. Check if previous task output exists
    b. If not, execute previous task first
    c. Use real output as input value
4. Prepare execution payload with real data
5. Call task execution API
6. Parse and return execution results with output file URLs

===============================================================================
REQUEST BODY FORMAT
===============================================================================
    {
        "taskname": "TaskName",
        "application": {
            "appName": "ApplicationClassName",
            "appURL": "https://app.url.com",
            "credentialType": "CredentialTypeName",
            "credentialValues": {
                "key1": "value1",
                "key2": "value2"
            },
            "appTags": [Complete object from of 'appTags' from the task in the rule]
        },
        "taskInputs": {
            "inputs": {
                "InputName1": "value_or_file_url",
                "InputName2": "value_or_file_url"
            }
        }
    }
===============================================================================
Args:
    task_name: Name of the task to execute
    task_inputs: Dictionary containing key-value pairs of task inputs
                Format: {"input_name": "value" or file_url}
    application: Optional application configuration for tasks requiring credentials
                Format: {
                    "appName": "ApplicationClassName",
                    "appURL": "https://...",
                    "credentialType": "...",
                    "credentialValues": {...},
                    "appTags": [Complete object from of 'appTags' from the task in the rule]
                }
                OR {"applicationId": "existing-app-id", "appTags": [Complete object from of 'appTags' from the task in the rule]}

Returns:
    Dict containing:
    {
        "success": bool,
        "execution_status": "COMPLETED" | "FAILED",
        "task_name": str,
        "task_inputs": dict,
        "outputs": dict,  # Output file URLs and values
        "errors": list,
        "message": str,
        "next_action": str
    }
ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes
task_inputsYes
applicationNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Given no annotations, the description carries full behavioral burden. It clearly states the tool executes with real data, handles dependencies, and shows results. However, it could explicitly mention that execution may trigger real-world actions (e.g., data modification) beyond what the name implies, but the emphasis on 'real data' and the execution flow strongly implies mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but well-structured with clear sections (execution context, dependency handling, configuration, flow) and bullet points. It is front-loaded with the core purpose. While every sentence adds value, it could be slightly more concise, but the complexity warrants the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all aspects: input parameters, dependency logic, error handling, application configuration, execution flow, and return value format. Given the tool's complexity and the presence of an output schema, it is complete and leaves no significant gaps for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by detailing parameter formats: task_name as a string, task_inputs as key-value pairs, and application with appName, credentialType, etc. It provides a complete request body example and explains optionality based on appType, adding critical meaning beyond the minimal schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: executing a specific task with real data after input collection. It emphasizes real data vs. sample, sequential execution, and dependency handling, distinguishing it from sibling tools like execute_rule or fetch_task_details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool ('MUST be called after collecting inputs'), how to handle dependencies (execute previous tasks automatically, use real outputs), and when not to use it (do not generate synthetic data). It also explains fallback on failure and the minimal execution principle.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_applicationsB

Fetch all available applications from the system.

Returns: Dict containing list of applications with their details

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not reveal any behavioral traits beyond the basic operation. No details on performance, pagination, data size, or side effects. Since no annotations exist, the description carries the burden but only provides minimal information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences: purpose and return type. It is front-loaded and avoids unnecessary detail, though a brief note on usage context would improve it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an existing output schema, the description is minimally adequate. However, it lacks context about when to use this tool vs siblings and does not hint at the output schema's richness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so schema coverage is 100% trivially. The description adds no parameter semantics, but none are needed. Baseline for 0 parameters is high.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch all available applications from the system,' specifying the verb (fetch), resource (applications), and scope (all). It effectively distinguishes itself from siblings like get_application_info (single app) and get_applications_for_tag (filtered).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as get_applications_for_tag. The description lacks context about use cases, performance implications, or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessment_available_actionsA

Get actions available on assessment for given assessment name. Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action. Args:

  • name (str): Assessment name

Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalRecordsNo
compliantRecordsNo
nonCompliantRecordsNo
notDeterminedRecordsNo
recordsNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It describes the return type (List of actions with fields and optional error) but does not mention any side effects, authorization requirements, or potential failures beyond an error message. The description is adequate but lacks depth, such as whether the fetch modifies state or requires specific permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. It starts with the core purpose, then gives a usage guideline, and finally specifies parameters and return format using clear sections (Args, Returns). No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, well-defined return structure), the description covers all necessary information: what it does, how to use it, what output to expect, and the relationship with 'execute_action'. The output schema is present, so detailed return documentation is not required from description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds bare minimum parameter info: 'Args: - name (str): Assessment name'. This adds no additional meaning beyond the schema's type and default. Schema description coverage is 0%, so the description should compensate, but it only repeats the parameter name and type without format, source, or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get actions available on assessment for given assessment name.' It specifies the verb (fetch), resource (assessment actions), and scope (by name). This distinguishes it from sibling tools like 'fetch_evidence_available_actions' and 'fetch_available_control_actions' by explicitly targeting assessment-level actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear workflow steps: 'Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool...' This tells the agent when to use this tool (before executing) and how to proceed afterward. However, it does not explicitly state when not to use it or mention alternative tools for different action types.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessment_run_detailsB

Get assessment run details for given assessment run id. This api will return many contorls, use page to get details pagewise. If output is large store it in a file.

Args: - id (str): Assessment run id

Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description details return fields and warns about large output ('store it in a file'), but the pagination advice is inconsistent with the schema. With no annotations, it partially discloses behavior but lacks clarity on the missing page parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the purpose but then provides an extensive list of return fields. While informative, it is verbose for a tool with an output schema. The structure with Args and Returns is clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return fields and large output handling, but lacks context on how to obtain the assessment run ID, potential errors beyond the error field, and pagination details. It is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter (id) with 0% coverage. The description adds meaning by labeling it as 'Assessment run id', which clarifies its purpose. However, the reference to a non-existent 'page' parameter detracts from clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves assessment run details for a given ID, using a specific verb and resource. However, it mentions pagination ('use page to get details pagewise') but the input schema lacks a page parameter, causing slight ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool compared to siblings like fetch_assessment_runs or fetch_run_controls. The description does not specify prerequisites or alternative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessment_run_leaf_control_evidenceB

Get leaf control evidence for given assessment run control id.

Args:

  • id (str): Assessment run control id

Returns: - evidences (List[ControlEvidenceVO]): List of control evidences - id (str): Evidence id. - name (str): Evidence name. - description (str): Evidence description. - fileName (str): File name. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
evidencesNo
errorNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description discloses return structure and possible error, implying a read operation. Lacks deeper behavioral context like permissions, side effects, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise with clear header and structured args/returns. Every sentence adds value, though the detailed return description could be slightly trimmed if output schema is sufficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, flat output), the description adequately covers purpose, input, and output. It does not mention empty list handling or prerequisites, but is sufficiently complete for a basic fetch tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description adds value by naming the parameter as 'Assessment run control id'. This adds meaning beyond the bare schema, but could be more specific about format or source.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Get leaf control evidence for given assessment run control id', specifying verb, resource, and input. However, it does not distinguish from siblings like fetch_evidence_records or fetch_automated_controls_of_an_assessment.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, nor any context about prerequisites or conditions. The description only provides input and output details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessment_run_leaf_controlsA

Get leaf controls for given assessment run id. If output is large store it in a file.

Args: - id (str): Assessment run id

Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description adds limited behavioral context: it notes large output handling and returns an optional error field. However, it does not disclose permission requirements, side effects (likely read-only), or rate limits. The output schema partially compensates.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clarity: it starts with the action, includes a note, then documents args and returns. The return section is detailed but appropriate given the output schema presence. It is not overly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with one parameter, missing annotations, and an output schema, the description is complete. It covers the argument, return structure (matching output schema), and a caveat for large outputs. No significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'id' has 0% schema coverage, but the description explains it as 'Assessment run id,' which adds meaning beyond the bare type string. This is useful for an agent to understand the parameter's purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get leaf controls for given assessment run id,' specifying the verb (Get) and resource (leaf controls) with the key parameter (assessment run id). It distinguishes from siblings like fetch_leaf_controls_of_an_assessment and fetch_run_controls by targeting a specific run.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a usage hint about storing large output in a file, but lacks explicit guidance on when to use this tool versus alternatives like fetch_leaf_controls_of_an_assessment. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessment_runsA

Get all assessment run for given assessment id Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize, default page is 1 If the request times out retry with pagination, increasing pageSize from 5 to 10. use this tool when expected run is got in fetch recent assessment runs tool

Args: - id (str): Assessment id

Returns: - assessmentRuns (List[AssessmentRuns]): A list of assessment runs. - id (str): Assessement run id. - name (str): Name of the assessement run. - description (str): Description of the assessment run. - assessmentId (str): Assessement id. - applicationType (str): Application type. - configId (str): Configuration id. - fromDate (str): From date of the assessement run. - toDate (str): To date of the assessment run. - status (str): Status of the assessment run. - computedScore (str): Computed score. - computedWeight (str): Computed weight. - complianceStatus (str): Compliance status. - compliancePCT (str): Compliance percentage. - complianceWeight (str): Compliance weight. - createdAt (str): Time and date when the assessement run was created. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
pageNo
pageSizeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
assessmentRunsNo
errorNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, but description discloses pagination behavior, default page, retry on timeout, and covers possible errors. It also fully lists return fields. However, it does not explicitly state read-only nature or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description contains redundant formatting (extra bullet lists) and some repeated info (e.g., page/pageSize explained twice). Could be trimmed to fewer sentences while retaining clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With output schema present and all return fields listed, description covers parameters, errors, pagination, retry logic, and usage context. No critical information missing for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% description coverage, but description fully explains each parameter: id as assessment id, page and pageSize with defaults and usage. This compensates completely for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool fetches all assessment runs for a given assessment ID, and distinguishes itself from fetch_recent_assessment_runs by specifying when to use it. Verb 'Get' and resource 'assessment runs' are explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description provides clear when-to-use guidance: 'use this tool when expected run is got in fetch recent assessment runs tool'. It also gives retry strategy with pageSize. However, it lacks explicit when-not-to-use or alternative tools beyond the one sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assessmentsA

Fetch the list of available assessments in ComplianceCow.

TOOL PURPOSE:

  • Retrieves a list of available assessments if no specific match is provided.

  • Returns only basic assessment info (id, name, category) without the full control hierarchy.

  • Used to confirm the assessment name while attaching a rule to a specific control.

Args: categoryId (Optional[str]): Assessment category ID.
categoryName (Optional[str]): Assessment category name.
assessmentName (Optional[str]): Assessment name.

Returns: - assessments (List[Assessments]): A list of assessment objects, each containing:
- id (str): Unique identifier of the assessment.
- name (str): Name of the assessment.
- category_name (str): Name of the category.
- error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryIdNo
categoryNameNo
assessmentNameNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must carry the burden. It explicitly states the tool returns only basic info and includes an error field. It does not mention authentication or rate limits, but for a fetch operation, the transparency is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a brief purpose, detailed tool purpose, Args section, and Returns section. It is front-loaded and efficient, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch-list tool, the description fully covers behavior, parameters, and return structure. Even without an output schema, the described return fields (id, name, category_name, error) provide complete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description includes an Args section that explains each parameter (categoryId, categoryName, assessmentName) and their filtering purpose, fully compensating for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches a list of assessments, returning basic info (id, name, category) without full control hierarchy. It distinguishes from sibling tools like list_all_assessments by specifying the limited scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a specific use case: confirming assessment name while attaching a rule to a control. It implies usage for basic retrieval but does not explicitly mention when not to use or alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_assets_summaryC

Get assets summary for given assessment id

Args: - id (str): Assessment id

Returns: - integrationRunId (str): Asset id. - assessmentName (str): Name of the asset. - status (str): Name of the asset. - numberOfResources (str): Name of the asset. - numberOfChecks (str): Name of the asset. - dataStatus (str): Name of the asset. - createdAt (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
planRunIDNo
assessmentNameNo
statusNo
numberOfResourcesNo
numberOfChecksNo
dataStatusNo
createdAtNo
errorNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must convey behavioral traits. It implies a read-only operation but lacks details on authentication, rate limits, side effects, or data freshness. The return field descriptions are incorrect (e.g., 'status' described as 'Name of the asset'), which undermines transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear first line but becomes verbose with a repetitive and incorrect Returns section. The field descriptions are all the same placeholder text 'Name of the asset.', wasting space and potentially confusing the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the single parameter and lack of structured output schema, the description attempts to document returns but does so with errors. It omits context like the nature of the summary, pagination, or filtering. The inaccuracies reduce completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description explains the sole parameter 'id' as 'Assessment id', adding minimal semantic value beyond the schema. This is adequate for a simple string parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get assets summary for given assessment id', specifying the verb and resource. It distinguishes from sibling tools like fetch_checks_summary or fetch_resources_summary by focusing on assets summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description does not mention preconditions, typical use cases, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_automated_controls_of_an_assessmentA

To fetch the only the automated controls for a given assessment. If assessment_id is not provided use other tools to get the assessment and its id.

Args: - assessment_id (str, required): Assessment id or plan id.

Returns: - controls (List[AutomatedControlVO]): List of controls - id (str): Control ID. - displayable (str): Displayable name or label. - alias (str): Alias of the control. - activationStatus (str): Activation status. - ruleName (str): Associated rule name. - assessmentId (str): Assessment identifier. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessment_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden. It only lists return fields and an error message, but does not disclose side effects, read-only nature, or the inconsistency between the description (required) and schema (optional). This minimal disclosure is insufficient for full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively concise but includes the return structure, which is redundant given the output schema exists. It could be more streamlined without losing essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides basic context for parameter and usage, but does not differentiate from similar sibling tools like fetch_controls. The mismatch between required and optional undermines completeness. Given the output schema covers returns, the description is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds meaning by clarifying assessment_id as 'Assessment id or plan id' and noting its requirement. However, it contradicts the input schema which has a default and no required flag, reducing clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches 'only the automated controls' for a given assessment, using specific verb and resource. It distinguishes from sibling tools like fetch_controls and fetch_leaf_controls_of_an_assessment by emphasizing 'automated'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises using other tools if assessment_id is not provided, providing clear context for when to use this tool. It implies the ID is necessary, but could more explicitly compare with sibling tools for fetching controls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_available_control_actionsB

This tool should be used for handling control-related actions such as create, update, or to retrieve available actions for a given control.

If no control details are given use the tool "fetch_controls" to get the control details.

  1. Fetch the available actions.

  2. Prompt the user to confirm the intended action.

  3. Once confirmed, use the execute_action tool with the appropriate parameters to carry out the operation.

Args:

  • assessmentName (str): Name of the assessment (required)

  • controlNumber (str): Identifier for the control (required)

  • controlAlias (str): Alias of the control (required)

If the above arguments are not available:

  • Use the fetch_controls tool to retrieve control details.

  • Then generate and execute a query to fetch the related assessment information before proceeding.

Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessmentNameYes
controlNumberNo
controlAliasNo
evidenceNameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalRecordsNo
compliantRecordsNo
nonCompliantRecordsNo
notDeterminedRecordsNo
recordsNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, but description mentions retrieval and lists output fields. Does not disclose side effects, permissions, or error conditions beyond the error field.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is somewhat lengthy with step-by-step instructions that could be separate. Front-loaded with purpose but includes redundant agent instructions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers return values and provides a workflow but lacks parameter descriptions and has inaccuracies. EvidenceName parameter not addressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description lists three args as required (contradicting schema where only assessmentName is required) and omits evidenceName. No explanation of what each parameter does beyond its name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves available actions for a control, matching the tool name. It distinguishes from sibling tools like fetch_controls and execute_action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: use fetch_controls if control details missing, prompt user, then use execute_action. However, it does not explicitly state when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_cc_rule_by_idA

Fetch rule details by rule id from the compliancecow.

Args: rule_id: Rule Id of the rule to retrieve

Returns: Dict containing complete rule structure and metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description indicates a read-only operation ('Fetch ... details'), but lacks detail on side effects, authentication, or error cases. Adequate for a simple fetch, but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sections (Args, Returns) and uses bold for emphasis. It is well-structured and avoids redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple nature of the tool and presence of an output schema (not shown here), the description sufficiently covers the purpose and parameters. The Returns clause adds context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the only parameter 'rule_id' as 'Rule Id of the rule to retrieve,' adding meaning beyond the schema (0% coverage). Clear and helpful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch rule details by rule id from the compliancecow,' specifying the verb+resource and distinguishing from siblings like 'fetch_cc_rule_by_name' and 'fetch_cc_rules_list'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have a rule ID but provides no explicit guidance on when not to use or alternatives. Basic clarity is present, but no comparative advice is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_cc_rule_by_nameA

Fetch rule details by rule name from the compliancecow.

Args: rule_name: Rule name of the rule to retrieve

Returns: Dict containing complete rule structure and metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behavioral traits. It only states it returns a dict, but does not mention it is a read-only operation, error behavior if rule not found, or authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with no wasted words: a single sentence for purpose plus clear Args/Returns sections. Front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple fetch tool with one parameter and an existing output schema, the description covers the essential purpose and return type. Minor gap: no mention of error scenarios, but overall adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must add meaning. It says 'rule_name: Rule name of the rule to retrieve' which merely repeats the parameter name without adding format, case sensitivity, or examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Fetch rule details by rule name from the compliancecow' with a specific verb and resource, and clearly differentiates from sibling tools like 'fetch_cc_rule_by_id' (fetch by ID) and 'fetch_cc_rules_list' (list all rules).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives (e.g., by ID or list). The purpose implies usage when the rule name is known, but lacks exclusions or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_cc_rules_listA

Fetch list of CC rules with only name, description, and id. This tool should ONLY be used for attaching rules to control flows.

Args: params: Optional query parameters for filtering/pagination - name_contains: Filter rules by name containing this string - page_size: Number of items to be returned (default 100)

Returns: List of simplified rule objects containing only name, description, and id

ParametersJSON Schema
NameRequiredDescriptionDefault
paramsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the return format and filtering/pagination parameters but does not mention side effects (likely a read operation), permissions, rate limits, or other behavioral traits. Basic transparency is present but lacks deeper context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two paragraphs covering purpose and usage first, then args and returns. Every sentence adds value, with no fluff. Minor improvement could be merging the first sentence with the guideline for tighter structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (list fetch with one param and known output schema), the description covers purpose, usage, parameters, and returns. Lacks explanation of the 'CC' acronym and the context of 'control flows', but overall is complete for the agent's needs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% coverage (single 'params' object with additionalProperties). The description compensates by listing two specific sub-parameters (name_contains and page_size) with descriptions and defaults, adding significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch' and the resource 'list of CC rules with only name, description, and id'. It distinguishes from sibling tools like fetch_cc_rule_by_id or fetch_cc_rule_by_name by indicating it returns a list. However, the acronym 'CC' is not explained, which may cause ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states 'This tool should ONLY be used for attaching rules to control flows,' providing a strong usage constraint. It does not explicitly list alternatives or when-not conditions, but the clear directive guides the agent appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_checksA

Get checks for given assets run id and resource type. Use this function to get all checks for given assets run id and resource type Use 'fetch_assets_summary' tool to get asset run id Use 'fetch_resource_types' tool to get all resource types Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 5 to 10.

If the check data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the checks.

  1. Call fetch_checks with page=1, pageSize=10

  2. Note the totalPages from the response

  3. Continue calling each page until complete

  4. Summarize all results together

Args: - id (str): Asset run id - resourceType (str): Resource type - complianceStatus (str): Compliance status

Returns: - checks (List[CheckVO]): A list of checks. - name (str): Name of the check. - description (str): Description of the check. - rule (RuleVO): Rule associated with the check. - type (str): Type of the rule. - name (str): Name of the rule. - activationStatus (str): Activation status of the check. - priority (str): Priority level of the check. - complianceStatus (str): Compliance status of the check. - compliancePCT (float): Compliance percentage. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
resourceTypeYes
pageNo
pageSizeNo
complianceStatusNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
checksNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. Discloses pagination, timeout handling, return structure (checks list with error), and large dataset alternatives. Lacks permissions info but acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized into sections (overview, args, returns) but verbose with repetitive first two sentences. Could trim redundancies for better conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers complexity: pagination, timeout, large dataset alternative, return schema. Includes step-by-step usage but omits error handling details beyond error field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, description explains all 5 parameters: id, resourceType, complianceStatus, page, pageSize. Adds practical guidance on pageSize defaults and usage, though complianceStatus values not specified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Get checks for given assets run id and resource type', with explicit contrast to the summary tool for large datasets, differentiating from sibling fetch_checks_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance (use summary for large datasets), prerequisite tools (fetch_assets_summary, fetch_resource_types), and step-by-step pagination instructions with fallback for timeouts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_checks_summaryA

Use this to get the summary on checks Use this when total items in 'fetch_checks' is high Get checks summary for given asset run id and resource type. Get a summarized view of resources based on - Compliance breakdown for checks - Total Checks available - Total compliant checks - Total non-compliant checks

Args: - id (str): Asset run id - resourceType (str): Resource type

Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
resourceTypeYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
complianceSummaryNo
errorNo

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must cover behavioral traits. It does not disclose side effects, permissions, rate limits, or whether the operation is read-only. It only mentions return values and minimal error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description contains redundancy (e.g., 'Use this to get the summary on checks' followed by 'Get checks summary...'). It could be more concise, but the structure with Args/Returns is clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an implied output schema, and the description covers the return fields (complianceSummary, error). The input parameters are explained, and usage context is provided. It is sufficiently complete for a summary tool, though the structure of complianceSummary could be detailed more.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description explains each parameter ('id' as asset run ID, 'resourceType' as resource type). This adds meaningful context beyond the schema structure, though it lacks details on possible value formats or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provides a summary of checks for a given asset run ID and resource type, with a compliance breakdown. It distinguishes itself from sibling tools like fetch_checks by explicitly referencing when to use this summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a specific condition for use: when total items in fetch_checks is high. It implicitly suggests using fetch_checks for lower counts, and names the sibling tool fetch_checks, providing clear guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_controlsC

To fetch controls. Args: control_name (str): name of the control.

Returns: - prompt (str): The input prompt used to generate the Cypher query for fetching the control.

ParametersJSON Schema
NameRequiredDescriptionDefault
control_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
promptNo
errorNo

TDQS

C2.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided. The description discloses that the tool returns a 'prompt' rather than control data, which is critical behavior, but does not explain the rationale or what the prompt is used for. No mention of idempotency or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (two sentences), but it is more underspecified than concise. It does not waste words, but lacks necessary detail. An acceptable score for conciseness, but borderline.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fails to fully explain the tool's behavior. It does not mention that an output schema exists, nor does it describe the actual control data (if any) that the prompt relates to. Incomplete for a simple tool given the lack of annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage. The description adds only 'name of the control' for the parameter, but does not clarify its format, that it is optional (has default), or how it affects the prompt. Insufficient for an agent to use correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'To fetch controls' which is nearly tautological with the name. It then describes the return as a prompt, creating confusion between fetching controls and returning a query prompt. The purpose is unclear and potentially misleading.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus the many sibling fetch tools (e.g., fetch_run_controls, fetch_checks). No context about prerequisites or use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_dashboard_framework_controlsA

Function Overview: Retrieve Control Details for a Given CCF and Review Period

This function retrieves detailed control-level data for a specified Common Control Framework (CCF) during a specific review period.

Args:

  • review_period: The compliance period (typically a quarter) for which the control-level data is requested.
    Format: "Q1 2024"

  • framework_name:
    The name of the Common Control Framework to fetch data for.

Purpose

This function is used to fetch a list of controls and their associated data for a specific CCF and review period.
It does not return an aggregated overview — instead, it retrieves detailed, item-level data for each control via an API call.

The results are displayed in the MCP host with client-side pagination, allowing users to navigate through the control list efficiently without making repeated API calls.

Returns: - controls (List[FramworkControlVO]): A list of framework controls. - name (str): Name of the control. - assignedTo (str): Email ID of the user the control is assigned to. - assignmentStatus (str): Status of the control assignment. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for completing the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - page (int): Current page number in the overall result set. - totalPage (int): Total number of pages. - totalItems (int): Total number of items. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodYes
framework_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

As no annotations exist, the description bears full responsibility. It discloses the API call, returns pagination info, and mentions an optional error field, but lacks detail on rate limits or authentication.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly long and contains some redundant phrasing (e.g., repeating the purpose). It is well-structured with sections, but could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, the description covers input parameters, return fields, and pagination details sufficiently. It is complete for a fetch tool, though lacks some behavioral nuance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds value by explaining the purpose and format of both parameters. However, there is a naming mismatch (review_period vs. period) that could confuse the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves detailed control-level data for a specific CCF and review period, distinguishing it from aggregated overview tools like fetch_dashboard_framework_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly tells when to use this tool (for detailed item-level data) vs. aggregated overview, but does not explicitly name alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_dashboard_framework_summaryB

Function Overview: CCF Dashboard Summary Retrieval

This function returns a summary dashboard for a specified compliance period and Common Control Framework (CCF). It is designed to provide a high-level view of control statuses within a given framework and period, making it useful for compliance tracking, reporting, and audits.

Args:

  • period:
    The compliance quarter for which the dashboard data is requested.
    Format: "Q1 2024"

  • framework_name:
    The name of the Common Control Framework whose data is to be retrieved.

Dashboard Overview

The dashboard provides a consolidated view of all controls under the specified framework and period. It includes key information such as assignment status, compliance progress, due dates, and risk scoring to help stakeholders monitor and manage compliance posture.

Returns: - controls (List[FramworkControlVO]): A list of framework controls. - name (str): Name of the control. - assignedTo (str): Email ID of the user the control is assigned to. - assignmentStatus (str): Status of the control assignment. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for completing the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - page (int): Current page number in the overall result set. - totalPage (int): Total number of pages. - totalItems (int): Total number of items. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodYes
framework_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains the read-only nature and return structure, but does not disclose side effects, authentication needs, or rate limits. A score of 3 reflects adequate but incomplete behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections for Args, Returns, and Overview, but is verbose and could be more concise. The first sentence front-loads the purpose, but some details are redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input schema (2 string params) and the presence of an output schema in the description, the description is fairly complete. It explains purpose, parameters, and return values, though it lacks details on pagination behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description adds meaningful context: period format (e.g., 'Q1 2024') and framework_name explanation. This significantly aids the agent in providing correct values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a summary dashboard for a compliance period and CCF, with a high-level view of control statuses. However, it does not differentiate from sibling tools like fetch_dashboard_framework_controls, which may have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it is useful for compliance tracking, reporting, and audits, but provides no explicit guidance on when to use this tool versus alternatives. No when-not or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_evidence_available_actionsA

Get actions available on evidence for given evidence name. If the required parameters are not provided, use the existing tools to retrieve them. Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action. Args: - assessment_name (str): assessment name (required) - control_number (str): control number (required) - control_alias (str): control alias (required)
- evidence_name (str): evidence name (required)

Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessment_nameNo
control_numberNo
control_aliasNo
evidence_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
actionsNo
errorNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It details the return structure (actions list with fields and optional error) and implies read-only behavior by stating 'get actions available.' It does not contradict any annotations, as none are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an overview, workflow advice, and clearly separated Args/Returns sections. It is relatively concise given the detail provided, though the workflow advice could be slightly trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 4 parameters and the presence of an output schema, the description adequately covers the tool's inputs, outputs, and usage context. It also references sibling tools (like 'execute_action' and other retrieval tools) to complete the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% coverage, but the description lists all four parameters (assessment_name, control_number, control_alias, evidence_name) with types and explicitly marks them as required, compensating for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get actions available on evidence for given evidence name.' It specifies the required parameters and distinguishes from similar fetch tools by focusing on evidence-level actions, though it does not explicitly contrast with siblings like fetch_available_control_actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit workflow guidance: if parameters are missing, use other tools to retrieve them; after fetching, ask user to confirm and then use 'execute_action'. This clearly indicates when to use this tool and the subsequent steps, though it lacks explicit 'when not to use' statements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_evidence_recordsA

Get evidence records for a given evidence ID with optional compliance status filtering. Returns max 50 records but counts all records for the summary.

Args: - id (str): Evidence ID - compliantStatus Optional[(str)]: Compliance status to filter "COMPLIANT", "NON_COMPLIANT", "NOT_DETERMINED" (optional).

Returns: - totalRecords (int): Total records. - compliantRecords (int): Number of complian records. - nonCompliantRecords (int): Number of non compliant records. - notDeterminedRecords (int): Number of not determined records. - records (List[RecordListVO]): List of evidence records. - id (str): Record id. - name (str): System name. - source (str): Record source. - resourceId (str): Resource id. - resourceName (str): Resource name. - resourceType (str): Resource type. - complianceStatus (str): Compliance status. - complianceReason (str): Compliance reason. - createdAt (str): The date and time the record was initially created.
- otherInfo (Any): Additional information.
- error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
compliantStatusNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalRecordsNo
compliantRecordsNo
nonCompliantRecordsNo
notDeterminedRecordsNo
recordsNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses important behavioral traits: returns max 50 records but counts all records for summary, includes an error field. Since no annotations are provided, the description adequately covers the tool's behavior beyond the input schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with Args/Returns sections, but includes a verbose return type specification that could be trimmed. However, the front-loaded summary sentence quickly conveys the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and a single output schema, the description covers all essential aspects: input filtering, max records, return fields (including summary counts and error messages). It is complete for a fetch tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully explains both parameters: 'id' (evidence ID) and 'compliantStatus' (optional, with enumerated values listed). This adds significant meaning beyond the schema's property types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it fetches evidence records for a given evidence ID with optional compliance status filtering. The verb 'fetch' is specific, and the resource 'evidence records' is well-defined, distinguishing it from sibling tools that fetch other entities (e.g., applications, controls).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Usage is implied through the description of inputs and outputs, but lacks direction on context or prerequisites (e.g., when to choose this over other fetch tools).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_evidence_record_schemaB

Get evidence record schema for a given evidence ID. Returns the schema of evidence record.

Args: - id (str): Evidence ID

Returns: - records (List[RecordListVO]): List of evidence record schema. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
schemaNo
errorNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It explains the return values (List of RecordListVO and optional error) but does not mention side effects, authentication needs, or rate limits. It is adequate but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded, starting with the core purpose. The docstring-style formatting adds clarity, though it could be slightly more compact. Overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists (though not shown), the description's mention of return types (records, error) is sufficient. However, it does not elaborate on the structure of 'RecordListVO' or edge cases, leaving some gaps for a tool with only one parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It lists the 'id' parameter with type 'str' and a brief description ('Evidence ID'), but adds no format, constraints, or examples beyond the schema. This is minimal added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the schema of an evidence record for a given evidence ID, using a specific verb ('Get') and resource ('evidence record schema'). It is distinct from siblings like 'fetch_evidence_records', which likely returns the records themselves.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., 'fetch_evidence_records') or any conditions for usage. It lacks explicit 'when to use' or 'when not to use' information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_execution_progressA

Fetch execution progress for a running rule.

IMPORTANT FOR CLAUDE/CLIENT:

This tool returns a snapshot of current progress. To see real-time updates:

  1. Call this tool repeatedly every 1 seconds

  2. Check the "continue_polling" flag in response

  3. If continue_polling=true, call again after 1 seconds

  4. If continue_polling=false, execution is complete

DISPLAY INSTRUCTIONS FOR CLAUDE:

When displaying progress, REPLACE the previous output (don't append):

🔄 Execution Progress (Live) ─────────────────────────────────

Show each task on ONE line that UPDATES in place: • task_name (type) [progress_bar] XX% STATUS

Use these Unicode blocks for progress bars:

  • COMPLETED: 🟦 (blue blocks)

  • INPROGRESS: 🟩 (green blocks)

  • ERROR: 🟥 (red blocks)

  • PENDING: ⬜ (white blocks)

After each poll, REPLACE the entire progress display with new data. DO NOT show multiple versions of the same task.

EXAMPLE DISPLAY SEQUENCE: Poll 1: • fetch_users (HTTP) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING • process_data (Script) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING

Poll 2 (REPLACES above): • fetch_users (HTTP) 🟩🟩🟩🟩⬜⬜⬜⬜⬜⬜ 40% INPROGRESS • process_data (Script) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING

Poll 3 (REPLACES above): • fetch_users (HTTP) 🟦🟦🟦🟦🟦🟦🟦🟦🟦🟦 100% COMPLETED • process_data (Script) 🟩🟩🟩⬜⬜⬜⬜⬜⬜⬜ 30% INPROGRESS

RESPONSE FLAGS:

  • continue_polling: true = keep polling every 1 seconds

  • continue_polling: false = execution complete, show final summary

  • display_mode: "replace" = replace previous display

UI DISPLAY REQUIREMENT:

  • The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.

Args: rule_name: Rule being executed execution_id: ID from execute_rule()

Returns: Dict with progress data and polling instructions

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
execution_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description discloses that it returns a snapshot, polling behavior, and response flags. No annotations exist, so description carries full burden; it covers expected behavioral traits like real-time updates and completion detection.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is bloated with extensive display instructions and examples that are not essential for tool selection/invocation. The core behavior is only a small part; the rest could be separate guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers polling and response but lacks error handling, idempotency, or restrictions. Output schema exists, so return description is sufficient, but behavioral context is incomplete without annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds minimal semantics via 'Args:' line explaining rule_name and execution_id. This is helpful but basic, lacking details like formats or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch execution progress for a running rule' with a specific verb and resource. While it lacks explicit differentiation from sibling tools like 'check_rule_status', the name itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit polling instructions: 'call this tool repeatedly every 1 seconds', check 'continue_polling' flag, and criteria for stopping. Clear when to use and how to interpret response.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_general_available_actionsA

Get general actions available on assessment, control & evidence. Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action. For inputs use default value as sample, based on that generate the inputs for the action. Args: - type (str): Type of the action, can be "assessment", "control" or "evidence".

Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - ruleInputs: Optional[dict[str, Any]]: Rule inputs for the action, if applicable. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
actionsNo
errorNo

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It indicates a read operation and lists return structure and error. Could add more about auth or idempotency but adequate for a fetch tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise, front-loaded with purpose, then workflow instructions, then parameter details. Every sentence adds value, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 1-parameter tool with output schema, the description covers purpose, parameter, return structure, and usage workflow, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 0% coverage, but description explicitly explains parameter 'type' with valid values ('assessment', 'control', 'evidence'), adding meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool gets 'general actions available on assessment, control & evidence', using a specific verb ('get') and resource. It distinguishes from siblings like 'fetch_assessment_available_actions' by being 'general'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear workflow: fetch, ask user to confirm, then use 'execute_action' tool. Implicitly guides when to use (for general actions) but does not explicitly exclude alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_leaf_controls_of_an_assessmentA

To fetch the only the leaf controls for a given assessment. If assessment_id is not provided use other tools to get the assessment and its id.

Args: - assessment_id (str, required): Assessment id or plan id.

Returns: - controls (List[AutomatedControlVO]): List of controls - id (str): Control ID. - displayable (str): Displayable name or label. - alias (str): Alias of the control. - activationStatus (str): Activation status. - ruleName (str): Associated rule name. - assessmentId (str): Assessment identifier. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessment_idNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description discloses the return structure and error field. It implies a read-only operation ('fetch') and adds behavioral context beyond the schema, though it could mention if there are any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with a clear one-line purpose followed by structured Args and Returns. No unnecessary information, and key points are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema), the description adequately covers purpose, parameter, and return structure. It could be improved by noting any limitations or differences from sibling tools, but is still complete for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning beyond the input schema: it states the parameter is required (despite schema default) and explains it's 'assessment id or plan id.' This compensates for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches 'leaf controls' for a given assessment. It distinguishes from siblings like 'fetch_automated_controls_of_an_assessment' by specifying 'leaf', but lacks explicit differentiation from other similar tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: 'If assessment_id is not provided use other tools to get the assessment and its id.' This helps the agent know when to use this tool vs alternatives, though it doesn't mention specific sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_output_fileA

Fetch and display content of an output file from rule execution.

FILE OUTPUT HANDLING:

WHEN TO USE:

  • Rule execution output contains file URLs

  • User requests to view specific file content

  • Files contain reports, logs, compliance data, or analysis results

CONTENT DISPLAY LOGIC:

  • If file size < 10KB: Show entire file content

  • If file size >= 10KB: Show only first 3 records/lines with user-friendly message

  • Supported formats: JSON, CSV, Parquet, and other text files

  • Always return file format extracted from filename

  • Provide clear user messaging about content truncation

  • CRITICAL: If content is truncated or full content, include truncation message with the display_content

  • The file URL (file_url) must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.

MANDATORY CONTENT DISPLAY FORMAT:

  • FileName: [extracted from file_url]

  • Format: [file format from file_format]

  • Message: [truncation status or completion message if applicable user_message]

  • Content: [display_content based on file format show the entire display_content]

  • File URL: [always show the file_url in the UI so the user can view or download the file] Args: file_url: URL of the file to fetch and display

Returns: Dict containing file content, metadata, and display information

ParametersJSON Schema
NameRequiredDescriptionDefault
file_urlYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully compensates by detailing content display logic (truncation at 10KB, first 3 lines, format support), mandatory URL display, and user messaging. This provides comprehensive behavioral transparency beyond what annotations would typically cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, containing multiple sections (overview, WHEN TO USE, CONTENT DISPLAY LOGIC, MANDATORY FORMAT) with some redundancy (e.g., truncation mentioned twice). It could be more streamlined while retaining key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple schema (one parameter) and presence of an output schema, the description thoroughly covers purpose, usage, behavior, parameter, and return format (via MANDATORY CONTENT DISPLAY FORMAT). No gaps remain for the user to guess about.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description adds a brief 'Args: file_url: URL of the file to fetch and display' that provides essential meaning. While not extensive, it clarifies the parameter's role beyond the schema's bare type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch and display content of an output file from rule execution' with specific verb and resource. The WHEN TO USE section further clarifies scope, differentiating it from other fetch tools by focusing on rule execution output files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a WHEN TO USE section that lists specific scenarios (rule execution output contains file URLs, user requests to view file content, files contain reports/logs). However, it does not explicitly state when not to use the tool or suggest alternative tools, which would improve differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_recent_assessment_runsC

Get recent assessment run for given assessment id

Args: - id (str): assessment id

Returns: - assessmentRuns (List[AssessmentRuns]): A list of assessment runs. - id (str): Assessement run id. - name (str): Name of the assessement run. - description (str): Description of the assessment run. - assessmentId (str): Assessement id. - applicationType (str): Application type. - configId (str): Configuration id. - fromDate (str): From date of the assessement run. - toDate (str): To date of the assessment run. - status (str): Status of the assessment run. - computedScore (str): Computed score. - computedWeight (str): Computed weight. - complianceStatus (str): Compliance status. - compliancePCT (str): Compliance percentage. - complianceWeight (str): Compliance weight. - createdAt (str): Time and date when the assessement run was created. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
assessmentRunsNo
errorNo

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only states the function returns a list of runs. It does not disclose whether the call is read-only, destructive, or has authentication or rate limit implications. The return type is mentioned but behavioral traits are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with clear Args/Returns sections and front-loaded with the primary purpose. However, the extensive return field list could be shortened if an output schema is available.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input and provided output details, the description is mostly complete. However, it lacks usage guidance and behavioral context, which are important for an agent to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description restates the sole parameter 'id' as 'assessment id', adding no semantic value beyond the schema. With 0% schema description coverage, the description should elaborate on expected format or examples, which it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches recent assessment runs for a given assessment ID. However, it does not define what 'recent' means or differentiate from sibling tools like fetch_assessment_runs, which may return all runs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., fetch_assessment_run_details for a specific run, fetch_assessment_runs for all runs). The description lacks context for appropriate selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_resourcesA

Get resources for given asset run id and resource type Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize, default page is 1 If the request times out retry with pagination, increasing pageSize from 5 to 10.

If the resource data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the resource.

  1. Call fetch_resources with page=1, pageSize=10

  2. Note the totalPages from the response

  3. Continue calling each page until complete

  4. Summarize all results together

Args: - id (str): Asset run id - resourceType (str): Resource type - complianceStatus (str): Compliance status

Returns: - resources (List[ResourceVO]): A list of resources. - name (str): Name of the resource. - resourceType (str): Type of the resource. - complianceStatus (str): Compliance status of the resource. - checks (List[ResourceCheckVO]): List of checks associated with the resource. - name (str): Name of the check. - description (str): Description of the check. - rule (RuleVO): Rule applied in the check. - type (str): Type of the rule. - name (str): Name of the rule. - activationStatus (str): Activation status of the check. - priority (str): Priority level of the check. - controlName (str): Name of the control. - complianceStatus (str): Compliance status specific to the resource. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
resourceTypeYes
pageNo
pageSizeNo
complianceStatusNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resourcesNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully covers pagination behavior, timeout handling, and response structure. It discloses the step-by-step process for paginating through results. Missing details on required permissions or rate limits, but otherwise transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, including a lengthy nested return structure and step-by-step pagination list. While structured, it could be more concise. The first sentence is clear, but later sections add redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description includes an output schema, which reduces the need for return value explanation, but it still duplicates some information. It covers pagination and timeouts but lacks details on valid values for resourceType and complianceStatus, and error scenarios beyond the error field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains page and pageSize semantics through pagination instructions but only provides minimal label-like descriptions for id and resourceType ('Asset run id', 'Resource type'). complianceStatus is not explained at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get resources for given asset run id and resource type', specifying the verb 'get' and the resource. It distinguishes from sibling tools like fetch_resources_by_check_name by emphasizing asset run id and resource type parameters.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit pagination instructions and recommends using the 'summary tool' for large datasets, offering clear guidance on when to use pagination and an alternative. However, it does not directly contrast with all sibling tools like fetch_resources_summary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_resources_by_check_nameA

Get resources for given asset run id, and check name. Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 10 to 50.

If the resource data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the resource.

  1. Call fetch_resources_for_check with page=1, pageSize=10

  2. Note the totalPages from the response

  3. Continue calling each page until complete

  4. Summarize all results together

Args: - id: Asset run id. - checkName: Check name.

Returns: - resources (List[ResourceVO]): A list of resources. - name (str): Name of the resource. - resourceType (str): Type of the resource. - complianceStatus (str): Compliance status of the resource. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
checkNameYes
pageNo
pageSizeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resourcesNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses pagination requirements, timeout behavior, error handling, and return structure (list of resources with fields). However, it doesn't explicitly state read-only nature but implies it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with purpose first, then details, but contains some redundancy (e.g., pagination details repeated). Could be slightly more concise without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given complexity (paginated fetch, potential timeouts) and no annotations, description covers key aspects: pagination, alternatives, return structure, and error handling. Output schema supplements completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description adds meaning by explaining id and checkName in Args and describing page/pageSize usage in text. Missing page/pageSize in formal Args section slightly reduces clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets resources for a given asset run id and check name, distinguishing from summary variant by recommending the summary tool for large datasets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides when to use pagination, retry with increasing pageSize, and suggests using the summary tool when data is large, including step-by-step pagination instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_resources_by_check_name_summaryA

Use this to get the summary on check resources Use this when total items in 'fetch_resources_for_check' is high Get check resources summary for given asset run id, resource type and check Paginated data is enough for summary Get a summarized view of check resources based on - Compliance breakdown for resources - Total Resources available - Total compliant resources - Total non-compliant resources

Args: - id (str): Asset run id - resourceType (str): Resource type

Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
resourceTypeYes
checkYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
complianceSummaryNo
errorNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the return format (compliance summary with breakdown) and that it's a summary, implying no side effects. However, it does not mention pagination behavior or rate limits, which would be helpful but not critical for a fetch operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat verbose with repeated phrases like 'Use this to get the summary on check resources'. It has bullet points and sections, but could be more concise. The structure is clear but not tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (indicated), the description doesn't need to fully detail returns, but it does include a returns section. However, it fails to document the 'check' parameter and does not clarify pagination details. For a tool with 3 required parameters, the description is incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description only explains two of three required parameters (id and resourceType) in the Args section, omitting 'check'. This is a significant gap. No format, enums, or constraints are mentioned, leaving the agent uncertain about the 'check' parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: fetching a summary of check resources. It uses specific verbs ('get summary') and resources ('check resources') and distinguishes from the sibling tool 'fetch_resources_by_check_name' by mentioning it's a summary when items are many.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this when total items in fetch_resources_for_check is high', providing clear context for when to use this tool versus alternatives. Also notes that paginated data is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_resources_summaryA
Use this to get the summary on resource 
Use this when total items in 'fetch_resources' is high
Fetch a summary of resources for a given asset run id and resource type.
Get a summarized view of resources include
    - Compliance breakdown for resource
        - Total Resources available
        - Total compliant resources
        - Total non-compliant resources

Args: - id (str): asset run ID - resourceType (str): Resource type

Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
resourceTypeYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
complianceSummaryNo
errorNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries burden. It describes return structure and error field but lacks details on side effects, permissions, or rate limits. Adequate for a read operation but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description has some redundancy ('Use this to get the summary on resource' then 'Fetch a summary...') and informal phrasing. Structured with bullet points and Args/Returns, but could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema provided but Has output schema true, the description partially describes output but not fully (complianceSummary dict lacks key structure). Adequate for simple tool but missing details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description adds meaning by labeling id as 'asset run ID' and resourceType as 'Resource type', which compensates well. Also lists Returns section, adding value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches a summary of resources for a given asset run ID and resource type, listing compliance breakdown. It distinguishes from sibling fetch_resources by suggesting use when total items is high.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use when total items in fetch_resources is high, providing clear context for when to choose this tool. Does not mention other alternatives or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_resource_typesA

Get resource types for given asset run id. Use 'fetch_assets_summary' tool to get assets run id Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 50 to 100.

  1. Call fetch_resource_types with page=1, pageSize=50

  2. Note the totalPages from the response

  3. Continue calling each page until complete

  4. Summarize all results together

Args: - id(str): Asset run id

Returns: - resourceTypes (List[AssetsVo]): A list of resource types. - resourceType (str): Resource type. - totalResources (int): Total number of resources.
- error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
pageNo
pageSizeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses pagination behavior, retry strategy on timeout, and return of totalPages. Without annotations, it covers key behavioral aspects but omits details like idempotency or caching.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear steps and bullet points. It is somewhat verbose but each part adds value, especially the numbered pagination process.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers prerequisites, input, output, and pagination workflow. Given the presence of sibling tools and no output schema in structured form, the description compensates well.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Explains each parameter's purpose and pagination usage. However, there is a contradiction: schema default for pageSize is 0, but description suggests starting at 50, which could confuse agents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets resource types for a given asset run ID. The verb 'Get' and resource 'resource types' are specific, and it distinguishes from siblings like fetch_resources and fetch_resources_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear guidance on using fetch_assets_summary to obtain the ID, and detailed pagination steps. However, it lacks explicit mention of when not to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_ruleA

Fetch rule details by rule name.

Args: rule_name: Name of the rule to retrieve

Returns: Dict containing complete rule structure and metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It states the return type (Dict with rule structure and metadata) but does not disclose potential side effects, permissions, error conditions, or rate limits. The description is minimal but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using a clear and standard format (description, Args, Returns). Every sentence serves a purpose with no redundancy. It is well-structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description does not need to detail return values extensively. It correctly mentions the return type. However, it lacks information on error handling or usage constraints. For a simple fetch tool, it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to the sole parameter by specifying 'Name of the rule to retrieve' in the Args section. Since schema coverage is 0%, this explanation is valuable and clarifies the parameter's purpose beyond the schema's type-only definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches rule details by rule name. It identifies the specific resource (rule) and the unique identifier (name), distinguishing it from sibling tools that fetch by ID or list rules. However, it does not explicitly differentiate from fetch_cc_rule_by_name, which may be similar.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like fetch_cc_rule_by_id, fetch_cc_rules_list, or fetch_rule_design_notes. There is no mention of prerequisites, exclusions, or context for optimal use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_rule_design_notesC

Fetch and manage design notes for a rule.

WORKFLOW:

  1. CHECK EXISTING NOTES:

  • Always check if design notes exist for the rule first (whether user wants to create or view)

  • If found: Present complete notebook to user in readable format

  • If not found: Offer to create new ones

  1. IF NOTES EXIST:

  • Show complete notebook with all sections (this serves as the VIEW)

  • Ask: "Here are your design notes. Modify or regenerate?"

  1. USER OPTIONS:

  • MODIFY:

  1. Ask "Do you need any changes to the design notes?"

  2. If no changes needed: Get user confirmation, then call create_design_notes() to update

  3. If changes needed: Collect modifications, show preview, get confirmation, then call create_design_notes() to update

  • REGENERATE:

  1. Generate the design notes using generate_design_notes_preview()

  2. Show preview to user

  3. Get user confirmation

  4. If confirmed: Call create_design_notes() to save the regenerated design notes

  • CANCEL: End workflow

  1. IF NO NOTES EXIST:

  • Inform user no design notes found

  • Ask: "Create comprehensive design notes for this rule?"

  • If yes: Generate the design notes using generate_design_notes_preview()

  • Show preview to user

  • Get user confirmation

  • If confirmed: Call create_design_notes() to generate

KEY RULES:

  • MUST follow this workflow explicitly step by step

  • Always check for existing notes first whenever user asks about design notes (create or view)

  • ALWAYS get user confirmation before calling create_design_notes()

  • If any updates needed, explicitly call create_design_notes() tool to save changes

  • Present notes in Python notebook format

  • Use create_design_notes() for creation and updates

Args: rule_name: Name of the rule

Returns: Dict with success status, rule name, design notes content, and error details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It describes a multi-step workflow that involves calling other tools, but doesn't clearly state that this tool itself only fetches data and relies on others for mutations. The side effects and dependencies are not transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is overly long (over 30 lines) with a detailed workflow that belongs in a separate guide rather than a tool description. It lacks conciseness and front-loading; the core purpose is buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the return dict format and workflow steps, but it mixes orchestration instructions with the tool's function. It is complete in the sense of detailing a process, but that process blurs the line between this tool and others, potentially leading to misuse.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (rule_name) with 0% schema description coverage. The description merely restates 'Name of the rule' without adding meaningful context (e.g., format, case sensitivity, required source).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says 'Fetch and manage design notes', which broadens the purpose beyond 'fetch'. It includes creation and update workflows, but the tool name suggests only fetching. This ambiguity makes it unclear whether this tool is a simple fetcher or a workflow orchestrator.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives like create_design_notes or generate_design_notes_preview. The workflow implies usage but doesn't state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_rule_readme_documentaionA

Retrieve README documentation for a specific rule by name.

Fetches the complete README documentation for a rule, providing detailed information about the rule's purpose, usage instructions, prerequisites, and implementation steps. This is useful for understanding how to properly use a rule in workflows.

Args: name (str): The exact name of the rule to retrieve README for

Returns: - readmeText (str): Complete README documentation as readable text - ruleName (str): Name of the rule for reference - error (str): Error message if retrieval fails or README not available

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
readmeTextNo
ruleNameNo
errorNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation by saying 'Retrieve' and detailing the return fields, but it does not disclose potential errors, permissions required, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with Args and Returns sections, but could be slightly more concise. The opening sentence is clear, and the details are appropriately placed without extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (1 parameter) and presence of an output schema, the description adequately covers purpose, parameter semantics, and return fields. It does not need to explain return values in depth since the output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning beyond the input schema: it explains the 'name' parameter as 'The exact name of the rule to retrieve README for'. Given 0% schema coverage, this fully compensates for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Retrieve' and resource 'README documentation for a specific rule by name'. It distinguishes from sibling tools like create_rule_readme, update_rule_readme, and fetch_rule_design_notes by specifying this is for documentation reading only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes this is useful 'for understanding how to properly use a rule in workflows', providing a clear use case. However, it does not explicitly mention when not to use it or contrast with alternatives like create_rule_readme.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_rules_suggestionsA

Tool-based version of fetch_rules_and_tasks_suggestions for improved compatibility and prevention of duplicate rule creation.

This tool serves as the initial step in the rule creation process. It helps determine whether the user's proposed use case matches any existing rule in the catalog.

PURPOSE:

  • To analyze the user's use case and avoid duplicate rule creation by identifying the most suitable existing rule based on its name, description, and purpose.

  • NEW: Check for partially developed rules in local system before allowing new rule creation

  • NEW: Present resumption options if incomplete rules are found to prevent duplicate work

WHEN TO USE:

  • As the first step before initiating a new rule creation process.

  • When the user wants to check if similar rules already exist by leveraging the Rules Suggestions API, instead of browsing the entire catalog manually.

  • When verifying if a suggested rule can be reused or adapted rather than creating one from scratch.

  • When checking for incomplete local rules that should be resumed instead of creating new ones.

🚫 DO NOT USE THIS TOOL FOR:

  • Checking what rules are available in the ComplianceCow system.

  • This tool only works with the rule catalog (not the entire ComplianceCow system).

  • The catalog contains only rules that are published and available for reuse in the catalog.

  • For direct ComplianceCow system lookups, use dedicated system tools instead:

  • fetch_cc_rule_by_name

  • fetch_cc_rule_by_id

MANDATORY STEP: CONTEXT SUMMARY

  • Before calling the rule catalog API, always rewrite the user’s raw requirement into a single-paragraph descriptive summary string (not bullet points, not verbatim input).

  • The summary must capture the essence of the requirement in clear, natural language.

  • This summary string is what will be passed to fetch_rules_and_tasks_suggestions.

  • Example: User input: "Use GitHub GraphQL API to fetch merged PRs and check if approvals >= 2" Summary: "The proposed rule validates compliance for GitHub Pull Requests by retrieving all merged PRs through the GitHub GraphQL API, checking whether the number of approvers meets a required threshold, and marking them as compliant or non-compliant."

WHAT IT DOES:

  • Generates a concise summary string from the user's intent or requirements.

  • Calls the Rules Suggestions API with this summary string to retrieve a narrowed list of relevant rules.

  • Performs intelligent matching using metadata (name, description, purpose) from the suggested rules against the user-provided use case details.

  • Uses semantic pattern recognition to identify similar or related rules, even across different systems (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions).

  • Analyzes the readmeData field from the fetch_rule() response to validate the rule's suitability for the user's use case.

IF A MATCHING RULE IS FOUND:

  • Retrieves complete details via fetch_rule().

  • If the readmeData field is available in the fetch_rule() response, Performs README-based validation using the readmeData field from the fetch_rule() response to assess its suitability for the user’s use case.

  • If suitable:

  • Returns the rule with full metadata, explanation, and the analysis report.

  • If not suitable:

  • Informs the user that the rule's README content does not align with the intended use case.

  • Prompts the user with clear next-step options:

    • "The rule's README content does not align with your use case. Please choose one of the following options:"

    • Customize the existing rule

    • Evaluate alternative matching rules

    • Proceed with new rule creation

  • Waits for the user's choice before proceeding.

IF A SIMILAR RULE EXISTS FOR AN ALTERNATE TECHNOLOGY STACK:

  • Detects rules with the same logic but built for a different platform or system (e.g., AzureUserUnusedPermission for SalesforceUserUnusedPermissions)

  • If the readmeData field is available in the fetch_rule() response, Retrieves and analyzes the readmeData from the fetch_rule() response to compare the implementation details against the user's proposed use case

  • Based on the comparison:

    • If the README content matches or is mostly reusable, suggest using the existing rule structure and logic as a foundation to create a new rule tailored to the user's target system

    • If the README content does not match or is not suitable, clearly inform the user and recommend either modifying the logic significantly or proceeding with a completely new rule from scratch

IF NO SUITABLE RULE IS FOUND:

  • Clearly informs the user that no relevant rule matches the proposed use case

  • Suggests continuing with new rule creation

  • Optionally highlights similar rules that can be used as a reference

MANDATORY STEPS: README VALIDATION:

  • Always retrieve and analyze readmeData from fetch_rule().

  • Ensure the rule's logic, behavior, and intended use align with the user's proposed use case.

README ANALYSIS REPORT:

  • Generate a clear and concise report for each readmeData analysis that classifies the result as a full match, partially reusable, or not aligned.

  • Present this report to the user for review.

USER CONFIRMATION BEFORE PROCEEDING: When analyzing a README file:

  • If no relevant rule matches the proposed use case, or if the README is deemed unsuitable, the tool must pause and request explicit user confirmation before proceeding further.

  • The tool should:

  • Clearly inform the user that no matching rule was found or the README is not appropriate.

  • Suggest creating a new rule as the next step.

  • Optionally recommend similar existing rules that can serve as references to help the user craft the new rule.

ITERATE UNTIL MATCH:

  • Repeat the above steps until a suitable rule is found or all options are exhausted.

CROSS-PLATFORM RULE HANDLING:

  • For rules from a different stack:

  • If reusable: suggest customization

  • If not reusable: recommend new rule creation

Returns:

  • A single rule object with full metadata and verified README match — if an exact match is found

  • A similar rule suggestion with customization options — if a cross-system match is found (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)

  • A message indicating no suitable rule found — with next steps and guidance to create a new rule

ParametersJSON Schema
NameRequiredDescriptionDefault
user_requirementYes
summary_stringYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description exhaustively discloses the tool's behavior: generating summary, calling API, matching, README validation, cross-platform handling, and user confirmation steps. It covers all scenarios and mandatory steps, leaving no ambiguity about the tool's actions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and contains redundant points (e.g., README validation appears in multiple sections). However, it is well-structured with clear headings and bullet points, making it navigable. It could be tightened but is not overly verbose given the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all major workflows (match found, cross-platform, no match) and mandatory steps like README validation and user confirmation. The presence of an output schema (not shown) is implied but the description includes return types. Slight gaps remain in parameter handling details, but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description explains the role of summary_string by describing a 'CONTEXT SUMMARY' step where the agent must generate it from user_requirement. It adds meaning beyond the schema, though it could clarify whether the tool generates the summary internally or expects both parameters. Overall, it compensates well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is the 'initial step in the rule creation process' to 'prevent duplicate rule creation.' It explicitly distinguishes from siblings like fetch_cc_rule_by_name and fetch_cc_rule_by_id by noting it works with the rule catalog, not the entire system.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides both a 'WHEN TO USE' section with specific scenarios and a 'DO NOT USE THIS TOOL FOR' section that lists alternatives. This explicitly guides when to invoke the tool versus using other sibling tools, meeting the highest standards of usage clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_run_control_meta_dataB

Use this tool to retrieve control metadata for a given control_id, including:

  • Control details: control name

  • Assessment details: assessment name and ID

  • Assessment run details: assessment run name and ID

Args: - id (str): Control id

Returns: - assessmentId (str): Assessment id. - assessmentName (str): Assessment name. - assessmentRunId (str): Assessment run id. - assessmentRunName (str): Assessment run name. - controlId (str): Control id. - controlName (str): Control name. - controlNumber (str): Control number. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
planIdNo
planNameNo
planInstanceIdNo
planInstanceNameNo
planInstanceControlIdNo
planInstanceControlNameNo
planInstanceControlDisplayableNo
errorNo

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only states retrieval and lists return fields. No details on side effects, auth needs, or behavior on invalid input. Minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Structured with bullet points and clear sections for Args and Returns. Concise but includes necessary detail. Front-loaded purpose sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one parameter and an explicit output schema in the description, it covers the return fields. However, lacks usage context like permissions or error handling beyond the error field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description adds 'Control id' for the single parameter, providing context. But the explanation is brief and does not elaborate beyond the schema type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves control metadata for a given control_id, specifying included details. It is specific but does not explicitly differentiate from sibling fetch_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use the tool (to retrieve metadata) but lacks guidance on when not to use it or alternatives. Context is clear but no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_run_controlsA

use this tool when you there is no result from the tool "execute_cypher_query". use this tool to get all controls that matches the given name. Next use fetch control meta data tool if need assessment name, assessment Id, assessment run name, assessment run Id

Args: - name (str): Control name

Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It describes the return type (list of controls with fields) and an error field, but does not disclose any side effects, permissions, or rate limits. The description is adequate for a simple fetch operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is multi-sentence with a conditional usage note, a follow-up suggestion, and a detailed return field list. While structured, the first sentence has grammatical issues and the list is lengthy. It could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (fetch by name), and the description lists all return fields, which compensates for the lack of schema descriptions. It does not explain error handling beyond the error field, but overall it provides sufficient context for the agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage for its single parameter 'name'. The description adds 'Control name', which provides semantic context beyond the schema's type-only definition. This compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches controls matching a given name, as a fallback when execute_cypher_query returns no result. It specifies the verb (get) and resource (controls), and distinguishes its usage from a sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when to use ('when there is no result from execute_cypher_query') and suggests a follow-up tool (fetch control meta data). However, it does not state when not to use it or name alternatives beyond the one condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_task_readmeA

Retrieve README documentation for a specific task by name.

Fetches the complete README documentation for a task, providing detailed information about the task's purpose, usage instructions, prerequisites, and implementation steps. This is useful for understanding how to properly use a task in workflows.

Args: name (str): The exact name of the task to retrieve README for

Returns: - readmeText (str): Complete README documentation as readable text - taskName (str): Name of the task for reference - error (str): Error message if retrieval fails or README not available

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
readmeTextNo
taskNameNo
errorNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains that the tool fetches complete README documentation, returns readmeText and taskName, and includes an error field for failures. This adequately discloses the read-only nature and error handling, though it could mention side effects (none) explicitly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary purpose in the first sentence, followed by a brief elaboration and structured Args/Returns. Every sentence provides value without redundancy, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description adequately explains the return fields (readmeText, taskName, error) and the purpose. It could mention potential length or format of the readme, but overall it is sufficient for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description adds 'name (str): The exact name of the task to retrieve README for', specifying that the name must be exact and is associated with a task. This compensates fully for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves README documentation for a specific task by name, distinguishing it from siblings like fetch_rule_readme_documentaion and get_template_guidance. The verb 'fetch' and resource 'task readme' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates this is useful for understanding how to properly use a task in workflows, implying the context. However, it does not explicitly state when not to use it or mention alternative tools for rules or templates, which given many siblings would improve clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_unique_node_data_and_schemaC

Fetch unique node data and schema

ParametersJSON Schema
NameRequiredDescriptionDefault
questionYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
node_namesNo
unique_property_valuesNo
neo4j_schemaNo
errorNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description only says 'Fetch,' implying a read-only operation but offering no details about side effects, auth needs, or return behavior beyond what might be in the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief (one sentence), which is concise, but it sacrifices informativeness. It is not sufficiently developed for its purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a required 'question' parameter and no annotations, the description should provide more detail about usage and expected input. An output schema exists but does not compensate for the lack of parameter context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter 'question' has no description in the schema (0% coverage) and no explanation in the description. The phrase 'unique node data and schema' does not clarify what the question parameter does.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Fetch unique node data and schema,' which indicates a fetch operation but does not clarify what 'unique node' refers to in this context or distinguish it from numerous sibling fetch tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool compared to alternatives like fetch_checks or fetch_assets_summary. The description lacks explicit context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_workflow_detailsC

Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; the description carries full burden but only explains parameter sourcing. It fails to disclose whether the operation is read-only, idempotent, or what happens with invalid IDs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief but uses a technical 'Args:' format. While concise, it could be more readable and front-loaded with a purpose statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema, return values need not be explained. However, the description omits a clear overall purpose and any behavioral context, leaving the agent under-informed for a fetch/details operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must compensate. It adds value by specifying how to obtain the ID from 'get_workflows' output, which aids correct invocation beyond the schema's type-only definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clarifies the parameter and its source, but the tool's purpose is implied rather than explicitly stated. The name and parameter hint at fetching workflow details by ID, but a clear verb+resource statement like 'Fetch workflow details by ID' is missing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like 'get_workflow_by_name' or 'list_workflows'. The description provides no context for selection or exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_workflow_resource_dataB

Fetch workflow resource data for a given resource type.

Resources provide dynamic data that can be used as inputs in workflow nodes. This function retrieves available data for a specific resource type.

Args: resource: The resource type to fetch data for. Resource options: USER_BLOCK

Returns: List of resource data items or error message

ParametersJSON Schema
NameRequiredDescriptionDefault
resourceYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions returns 'list or error message' but does not state whether the operation is read-only, if it has side effects, or any authentication or rate limit requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections (summary, context, args, returns) and concise, though slightly verbose in the 'Resources provide...' sentence. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and an output schema, the description provides sufficient context about the resource's purpose and return type. It is complete enough for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description fully explains the 'resource' parameter, including its meaning and an explicit option (USER_BLOCK). This adds significant value over the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches workflow resource data for a specific resource type, with a clear verb and resource. However, it does not explicitly differentiate from sibling tools like fetch_resources or fetch_resource_types, though the context implies a distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains that resources provide dynamic data for workflow node inputs, which implies when to use. However, it lacks explicit guidance on when not to use or alternatives, and no exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetch_workflow_ruleA

Retrieve a specific workflow rule by name.

Finds and returns the single workflow rule that matches the provided name. This rule contains the input/output specifications needed for workflow operations.

Args: name (str): The name of the workflow rule to retrieve

Returns: - rules (List[WorkflowRuleVO]): List containing the single matched workflow rule with input/output specifications - id: (str) - name: (str) - description: (str) - ruleInputs: [List[WorkflowRuleInputsVO]] - ruleOutputs: [List[WorkflowRuleOutputsVO]]

- error (Optional[str]): An error message if any issues occurred during retrieval.
ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
rulesNo
errorNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses that the tool returns a list with a single matched rule and an optional error, which is adequate for a read-only fetch. No contradictions with annotations since none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with Args/Returns sections and front-loads the main purpose. It is slightly verbose but not excessively so, and every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple parameter, existing output schema (described in description), and no nested objects, the description covers the essential parts: purpose, parameter, and return values. It could mention edge cases or error handling more explicitly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining the 'name' parameter: 'The name of the workflow rule to retrieve'. This is clear and sufficient for the single parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves a specific workflow rule by name, using specific verbs and resource. It distinguishes from siblings like fetch_cc_rule_by_name and fetch_workflow_details, but does not explicitly differentiate from all other fetch tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool (to retrieve a specific workflow rule by name) but does not provide guidance on when not to use it or mention alternatives such as list_workflow_rules or fetch_workflow_details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_design_notes_previewA

Generate design notes preview for user confirmation before actual creation.

DESIGN NOTES PREVIEW GENERATION

This tool generates a complete Jupyter notebook structure as a dictionary for user review. The MCP will create the full notebook content with 7 standardized sections based on rule context and metadata, then return it for user confirmation.

DESIGN NOTES TEMPLATE STRUCTURE REQUIREMENTS

The MCP should generate a Jupyter notebook (.ipynb format) with exactly 7 sections:

SECTION 1: Evidence Details

DESCRIPTION: System identification and rule purpose documentation

CONTENT REQUIREMENTS:

  • Table with columns: System | Source of data | Frameworks | Purpose

  • System: {TARGET_SYSTEM_NAME} (all lowercase")

  • Source: Always 'compliancecow'

  • Frameworks: Always '-'

  • Purpose: Use rule's purpose from metadata

  • RecommendedEvidenceName: {RULE_OUTPUT_NAME} (use rule's primary compliance output, exclude LogFile)

  • Description: Use rule description from metadata

  • Reference: Include actual API documentation links that the rule uses (extract from task specifications, no placeholder values)

FORMAT: Markdown cell with table and code blocks only

SECTION 2: Define the System Specific Data (Extended Data Schema)

DESCRIPTION: System-specific raw data structure definition with detailed breakdown

CONTENT REQUIREMENTS:

Step 2a: Inputs

  • Generate numbered list from rule's spec.inputs

  • Format: "{NUMBER}. {INPUT_NAME}({INPUT_DATA_TYPE}) - {INPUT_DESCRIPTION}"

  • Include all inputs with their types and purposes

Step 2b: API & Flow

  • Generate numbered list of API endpoints based on target system

  • Format: "{NUMBER}. {HTTP_METHOD} {URL} - {BRIEF_DESCRIPTION}"

  • Include only actual API endpoints that this specific rule uses for data collection

  • Extract from task specifications, not generic templates

Step 2c: Define the Extended Schema

  • Generate large JSON code block with actual API response structure

  • Use system-specific field names and realistic data values

  • Include all fields that will be processed by the rule

FORMAT: Markdown headers with detailed lists + large JSON code block

SECTION 3: Define the Standard Schema

DESCRIPTION: Standardized compliance data format documentation

CONTENT REQUIREMENTS:

  • Header explaining standard schema purpose

  • JSON code block with complete standardized structure containing:

  • System: based on target system (lowercase)

  • Source: Always 'compliancecow'

  • Resource info: ResourceID, ResourceName, ResourceType, ResourceLocation, ResourceTags, ResourceURL

  • System-specific data fields based on actual rule output columns, if unavailable then generate based on rule details

  • Compliance fields: ValidationStatusCode, ValidationStatusNotes, ComplianceStatus, ComplianceStatusReason

  • Evaluation and action fields: EvaluatedTime, UserAction, ActionStatus, ActionResponseURL (UserAction, ActionStatus, ActionResponseURL are empty by default)

Step 3a: Sample Data

  • Generate markdown table with ALL standard schema columns in same order - include all columns even if empty

  • Include three complete example rows with realistic, system-specific data

  • Use proper data formatting and realistic identifiers

FORMAT: JSON code block + comprehensive markdown table

SECTION 4: Describe the Compliance Taxonomy

DESCRIPTION: Status codes and compliance definitions

CONTENT REQUIREMENTS:

  • Table with columns: ValidationStatusCode | ValidationStatusNotes | ComplianceStatus | ComplianceStatusReason

  • ValidationStatusCode: CRITICAL FORMAT REQUIREMENT - Rule-specific codes must strictly follow this exact format:

    • Each word must be exactly 3-4 characters long

    • Words must be separated by underscores (_)

    • Use ALL UPPERCASE letters

    • Create codes that directly relate to the rule's compliance purpose

    • Examples: CODE_OWN_HAS_PR_REV (code ownership has pull request review), REPO_SEC_SCAN_PASS (repository security scan passed), AUTH_MFA_ENBL (authentication multi-factor enabled)

    • DO NOT use generic codes like "PASS" or "FAIL"

    • DO NOT exceed 4 characters per word

    • DO NOT use special characters other than underscores

    • Generate 4-6 different status codes covering various compliance scenarios

  • Detailed compliance reasons specific to the rule's purpose

  • Both COMPLIANT and NON_COMPLIANT scenarios

FORMAT: Markdown cell with table

SECTION 5: Calculation for Compliance Percentage and Status

DESCRIPTION: Percentage calculations and status logic

CONTENT REQUIREMENTS:

  • Header explaining compliance calculation methodology

  • Code cell with calculation logic:

  • TotalCount = Count of 'COMPLIANT' and 'NON_COMPLIANT' records

  • CompliantCount = Count of 'COMPLIANT' records

  • CompliancePCT = (CompliantCount / TotalCount) * 100

  • Status determination rules:

    • COMPLIANT: 100%

    • NON_COMPLIANT: 0% to less than 100%

    • NOT_DETERMINED: If no records are found

FORMAT: Markdown header cell + Code cell with calculation logic

SECTION 6: Describe (in words) the Remediation Steps for Non-Compliance

DESCRIPTION: Non-compliance remediation procedures

CONTENT REQUIREMENTS:

  • Can be "N/A" if no specific remediation steps apply

  • When applicable, provide:

  • Immediate Actions required

  • Short-term remediation steps

  • Long-term monitoring approaches

  • Responsible parties and timeframes

  • System-agnostic guidance that can be customized

FORMAT: Markdown cell with detailed remediation procedures

SECTION 7: Control Setup Details

DESCRIPTION: Rule configuration and implementation details

CONTENT REQUIREMENTS:

  • Table with two columns: Control Details | (Values)

  • Required fields (only these):

  • RuleName: Use actual rule name

  • PreRequisiteRuleNames: Default to 'N/A' or list dependencies

  • ExtendedSchemaRuleNames: Default to 'N/A' or list related rules

  • ApplicationClassName: Fetch all appType values from spec.tasks array, combine them, remove duplicates, and format as comma-separated values

  • PostSynthesizerName: Default to 'N/A' or specify if used

FORMAT: Markdown table with control configuration details

JUPYTER NOTEBOOK METADATA REQUIREMENTS

  • Include proper notebook metadata (colab, kernelspec, language_info)

  • Set nbformat: 4, nbformat_minor: 0

  • Use appropriate cell metadata with unique IDs for each section

  • Ensure proper markdown and code cell formatting

MCP CONTENT POPULATION INSTRUCTIONS

The MCP should extract the following information from the rule context:

  • Rule name, purpose, description from rule metadata

  • System name from appType (clean by removing connector suffixes like "-connector")

  • Task details from spec.tasks array

  • Input specifications from spec.inputs and spec.inputsMeta__

  • Output specifications from spec.outputsMeta__

  • Application connector information for control setup

  • API endpoints from task specifications (not generic placeholders)

CONTENT GENERATION GUIDELINES

  • Use realistic, system-specific examples that can be customized later

  • Include comments in code sections indicating customization points

  • Provide system-agnostic content that applies broadly

  • Use consistent naming conventions throughout all sections

  • Extract actual API documentation links from task specifications

  • Generate ValidationStatusCodes that are specific to the rule's compliance purpose

  • Ensure all sample data reflects the actual system being monitored

WORKFLOW

  1. MCP retrieves rule context from stored rule information

  2. MCP generates complete Jupyter notebook using template structure above

  3. MCP populates template with extracted rule metadata and calculated values

  4. MCP returns complete notebook structure as dictionary for user review

  5. User reviews and confirms the structure

  6. If approved, call create_design_notes() to actually save the notebook

ARGS

  • rule_name: Name of the rule for which to generate design notes preview

RETURNS

Dict containing complete notebook structure for user review and confirmation

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description extensively details the tool's behavior, including the exact template structure, content requirements for each section, metadata, and population instructions. It falls short of mentioning permissions or rate limits, but the depth of behavioral disclosure is very high.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely verbose (over 2000 words) and includes detailed template instructions that are more suited for internal documentation than a tool description. While well-structured with sections and headers, it is not concise and could be significantly shortened for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of generating a full notebook with 7 sections, the description is highly complete, covering all content requirements, metadata, and workflow. The output schema exists (though not shown) and the description states it returns a dict, which is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is only one parameter, 'rule_name', with no schema description (0% coverage). The description adds meaning by stating it is the name of the rule for which to generate the preview, which is sufficient for a single simple parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it generates a design notes preview for user confirmation before actual creation, distinguishing it from the sibling tool 'create_design_notes' which saves the notebook. It specifies the exact output (Jupyter notebook dictionary) and the workflow step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly outlines when to use the tool: for preview before creation, and then directing to call 'create_design_notes' after user approval. It also provides a numbered workflow explaining the sequence, giving clear context and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_rule_readme_previewA

Generate README.md preview for rule documentation before actual creation.

RULE README GENERATION:

This tool generates a complete README.md structure as a string for user review. The MCP will create comprehensive rule documentation with detailed sections based on rule context and metadata, then return it for user confirmation.

README TEMPLATE STRUCTURE REQUIREMENTS:

The MCP should generate a README.md with exactly these sections:

SECTION 1: Rule Header

DESCRIPTION: Rule identification and overview CONTENT REQUIREMENTS:

  • Rule name as main title (# {RULE_NAME})

  • Brief description from rule metadata

  • Status badges (Version, Application Type, Environment)

  • Purpose statement

  • Last updated timestamp FORMAT: Markdown header with badges and overview

SECTION 2: Overview

DESCRIPTION: High-level rule explanation CONTENT REQUIREMENTS:

  • What this rule does (purpose and description)

  • Target system/application

  • Compliance framework alignment

  • Key benefits and use cases

  • When to use this rule FORMAT: Markdown sections with bullet points

SECTION 3: Rule Architecture

DESCRIPTION: Technical architecture and flow CONTENT REQUIREMENTS:

  • Rule flow diagram (text-based)

  • Task sequence and dependencies

  • Data flow: Input → Processing → Output

  • Integration points

  • Architecture decisions FORMAT: Markdown with code blocks for diagrams

SECTION 4: Inputs

DESCRIPTION: Detailed input specifications CONTENT REQUIREMENTS:

  • Table of all rule inputs with:

    • Input Name

    • Data Type

    • Required/Optional

    • Description

    • Default Value

    • Example Value

  • Input validation rules

  • File format specifications (for FILE inputs) FORMAT: Markdown table with detailed explanations

SECTION 5: Tasks

DESCRIPTION: Individual task breakdown CONTENT REQUIREMENTS:

  • For each task in the rule:

    • Task name and alias

    • Purpose and functionality

    • Input requirements

    • Output specifications

    • Processing logic overview

    • Error handling

  • Task execution order

  • Dependencies between tasks FORMAT: Markdown subsections for each task

SECTION 6: Outputs

DESCRIPTION: Rule output specifications CONTENT REQUIREMENTS:

  • Table of all rule outputs with:

    • Output Name

    • Data Type

    • Description

    • Format/Structure

    • Example Value

  • Output file formats and schemas

  • Success/failure indicators FORMAT: Markdown table with examples

SECTION 7: Configuration

DESCRIPTION: Rule configuration and setup CONTENT REQUIREMENTS:

  • Application type and environment settings

  • Execution level and mode

  • Required permissions and access

  • System prerequisites

  • Configuration examples

  • Environment-specific settings FORMAT: Markdown with code blocks

SECTION 8: Usage Examples

DESCRIPTION: Practical usage scenarios CONTENT REQUIREMENTS:

  • Basic usage example

  • Advanced configuration example

  • Common use cases

  • Best practices

  • Troubleshooting tips FORMAT: Markdown with code examples

SECTION 9: I/O Mapping

DESCRIPTION: Data flow mapping details CONTENT REQUIREMENTS:

  • Complete I/O mapping visualization

  • Rule input to task input mappings

  • Task output to task input mappings

  • Task output to rule output mappings

  • Data transformation explanations FORMAT: Markdown with formatted mapping table

SECTION 10: Troubleshooting

DESCRIPTION: Common issues and solutions CONTENT REQUIREMENTS:

  • Common error scenarios

  • Input validation failures

  • Task execution errors

  • Output generation issues

  • Performance considerations

  • Support and contact information FORMAT: Markdown FAQ-style sections

SECTION 11: Version History

DESCRIPTION: Change log and versioning CONTENT REQUIREMENTS:

  • Current version information

  • Version history table

  • Change descriptions

  • Migration notes

  • Deprecation warnings FORMAT: Markdown table with version details

SECTION 12: References

DESCRIPTION: Additional resources and links CONTENT REQUIREMENTS:

  • Related documentation links

  • Compliance framework references

  • API documentation

  • Support resources

  • Contributing guidelines FORMAT: Markdown bullet list with links

MARKDOWN FORMATTING REQUIREMENTS:

  • Use proper Markdown syntax

  • Include table of contents with links

  • Use code blocks for examples

  • Include badges and shields

  • Proper heading hierarchy (H1, H2, H3)

  • Use tables for structured data

  • Include horizontal rules for section separation

MCP CONTENT POPULATION INSTRUCTIONS: The MCP should extract the following information from the rule context:

  • Rule name, purpose, description from rule metadata

  • System name from appType (clean by removing connector suffixes)

  • Task details from spec.tasks array (name, alias, purpose, appTags)

  • Input specifications from spec.inputs object

  • Output specifications from spec.outputsMeta__

  • I/O mappings from spec.ioMap array

  • Environment and execution settings from labels

  • Application type and integration details

PLACEHOLDER REPLACEMENT RULES:

  • {RULE_NAME} = meta.name

  • {RULE_PURPOSE} = meta.purpose

  • {RULE_DESCRIPTION} = meta.description

  • {SYSTEM_NAME} = extracted from appType

  • {VERSION} = meta.version or "1.0.0"

  • {ENVIRONMENT} = meta.labels.environment[0]

  • {APP_TYPE} = meta.labels.appType[0]

  • {EXEC_LEVEL} = meta.labels.execlevel[0]

  • {TASK_COUNT} = len(spec.tasks)

  • {INPUT_COUNT} = len(spec.inputs)

  • {OUTPUT_COUNT} = len(spec.outputsMeta__)

  • {TIMESTAMP} = current ISO timestamp

CONTENT GUIDELINES:

  • Use clear, technical language

  • Include practical examples

  • Provide comprehensive coverage

  • Make it developer-friendly

  • Include troubleshooting help

  • Keep sections well-organized

  • Use consistent formatting

WORKFLOW:

  1. MCP retrieves rule context using fetch_rule() (ensure only the fetch_rule tool is called, not fetch_cc_rule)

  2. MCP extracts metadata and technical details

  3. MCP generates complete README.md content using template above

  4. MCP populates all placeholders with actual rule data

  5. MCP returns complete README content as string for user review

  6. User reviews and confirms the content

  7. If approved, call create_rule_readme() to actually save the README

Args: rule_name: Name of the rule for which to generate README preview

Returns: Dict containing complete README.md content as string for user review

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It exhaustively discloses the tool's behavior: it generates a complete README.md structure as a string for user review, does NOT save anything (deferred to create_rule_readme), retrieves rule context using fetch_rule(), and follows a specific template with placeholders. It also specifies the return format as 'Dict containing complete README.md content as string.' There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and includes the full 12-section README template, which is more appropriate for external documentation than a tool description. While it is well-structured with headings, lists, and a front-loaded purpose statement, much of the content is redundant for an AI agent's selection and invocation. The description could be significantly more concise by referencing the template rather than reproducing it entirely.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's single parameter and the presence of an output schema (described as returning a dict with README content), the description is very complete. It covers the full workflow, dependencies (fetch_rule), and exact output format. However, the inclusion of extensive MCP instructions (e.g., 'The MCP should generate a README.md with exactly these sections:') blurs the line between tool description and usage guide, slightly reducing completeness for the tool's own definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. The only parameter is 'rule_name'. The description includes a minimal 'Args: rule_name: Name of the rule for which to generate README preview' at the end, which adds basic context but no additional semantics like format or validation. Given that it is a single string parameter, this is adequate but not exceptional; the description does not significantly enhance understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Generate README.md preview for rule documentation before actual creation.' It specifies the verb 'generate' and the resource 'README preview for rule documentation.' It distinguishes itself from sibling tools like 'create_rule_readme' (which actually saves) and 'fetch_rule_readme_documentaion' (which fetches existing) by noting the workflow step 'If approved, call create_rule_readme() to actually save the README.' Thus, the purpose is highly specific and distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides extensive usage guidelines, including a detailed workflow: use fetch_rule() first, generate preview, then if approved call create_rule_readme. It explicitly mentions 'ensure only the fetch_rule tool is called, not fetch_cc_rule' and outlines the steps. However, it does not explicitly state scenarios when not to use this tool, such as when the rule already has a README. Yet the workflow and sibling differentiation are clear enough to guide appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_application_infoA

Get detailed information about an application, including supported credential types.

APPLICATION CREDENTIAL CONFIGURATION WORKFLOW:

  1. User selects "Configure new application credentials".

  2. Call this tool to retrieve application details and supported credential types.

  3. Present credential options to the user with:

    • Required attributes

    • Data type

    • If type is bytes → must be Base64-encoded

  4. Collect credential values for the selected type.

  5. Validate that all required attributes are provided.

  6. Verify that each credential value matches its expected data type.

  7. Build the credential configuration and append it to the apps_config array.

DATA VALIDATION REQUIREMENTS:

  • All required attributes must be present.

  • Data type must match specification.

  • Bytes values must be Base64-encoded before saving.

Args: tag_name: The app tag name for retrieving application information

Returns: Dict containing application details and supported credential types

ParametersJSON Schema
NameRequiredDescriptionDefault
tag_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility. It does not disclose behavioral traits such as side effects, required permissions, rate limits, or error responses. It only vaguely mentions the return type and includes a long workflow irrelevant to the tool's own behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is overly long, including an entire credential configuration workflow and data validation requirements that are not directly about the tool itself. The first sentence is concise, but the rest is wasteful and should be in separate documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While an output schema exists, the description adds a workflow and validation notes, but it still lacks details about the return structure beyond 'Dict containing application details and supported credential types.' It is adequate for a simple get tool but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter (tag_name) is described as 'The app tag name for retrieving application information,' adding meaning beyond the schema which only specifies type string. This is sufficient given the low schema coverage (0%).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get detailed information about an application, including supported credential types.' It uses a specific verb (get) and resource (application information), and is distinct from sibling tools like fetch_applications or get_applications_for_tag.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a detailed step-by-step workflow for configuring application credentials, explicitly stating when to call this tool (step 2). However, it does not mention when not to use it or suggest alternative tools for similar tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_applications_for_tagA

Get available applications for a specific app tag.

APPLICATION RETRIEVAL:

  • Fetches all existing applications configured for the specified app tag.

  • Returns a list of applications with ID, name, and app type.

  • Used during rule execution to present application choices to the user.

  • Optionally filters by additional tags (e.g., purpose, sourceSystem) for precise matching.

Args: tag_name (str): The app tag name to get applications for. This parameter is mandatory and must not be empty. additional_tags (Dict[str, List[str]]): Optional additional tags to filter applications. Example: {"purpose": ["source-repo"]} to find apps with specific purpose.

Returns: dict: A dictionary containing available applications for the specified tag.

Raises: ValueError: If tag_name is not provided or is empty.

ParametersJSON Schema
NameRequiredDescriptionDefault
tag_nameYes
additional_tagsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It describes a read operation that fetches applications and raises ValueError for empty tag_name. However, it does not mention whether results are paginated, what happens if no applications exist for the tag, or any authorization requirements. The description is adequate but lacks some behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections ('APPLICATION RETRIEVAL:', 'Args:', 'Returns:', 'Raises:') and uses bullet points for clarity. It is concise—no redundant sentences—and front-loads the main purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists (not shown but known), the description appropriately focuses on input behavior. It covers parameters, return type (dictionary), and an error case. Missing details like behavior on empty results or tag not found are minor; overall complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds essential meaning: tag_name is mandatory and must not be empty; additional_tags is optional with an example format. This compensates for the schema's lack of descriptions, though it does not detail all possible tag keys or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get available applications for a specific app tag.' It specifies what is returned (ID, name, app type) and optionally allows filtering by additional tags. This distinguishes it from sibling tools like 'fetch_applications' or 'get_application_info'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes the tool is 'used during rule execution to present application choices to the user,' providing clear context. However, it does not explicitly state when not to use this tool or suggest alternatives among siblings, which would improve guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_asset_control_hierarchyB

Retrieve the complete control hierarchy for an asset with nested plan controls. Returns only id and name for each control while preserving the full hierarchical structure.

Args: - assetId (str): Asset id.

Returns: - success (bool): Indicates if the operation completed successfully. - planControls (List[dict]): Nested hierarchy of controls with only id and name. Each control contains: - id (str): Control id. - name (str): Name of the control. - planControls (List[dict]): Nested child controls ( - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that only id and name are returned while preserving hierarchy, and includes a structured Args/Returns section. However, it lacks information on authentication requirements, error handling, or whether the operation is read-only (no annotations provided).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose and uses a structured Args/Returns format for clarity. While it is moderately sized, some minor redundancy in the Returns section could be trimmed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter, the description covers the return structure well, especially with the nested planControls format. However, it omits usage context, error behavior, and any prerequisites, leaving gaps for an agent to select the tool appropriately.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The parameter 'assetId' is described only as 'Asset id,' which is essentially a restatement of the schema field name. With 0% schema description coverage, the description offers minimal added meaning and does not clarify the expected format or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve the complete control hierarchy for an asset with nested plan controls,' specifying the verb and resource. It distinguishes from sibling tools by emphasizing the hierarchical structure and limited return fields (id and name only).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, such as other fetch tools that return control details or different hierarchical views. There is no mention of preconditions or context for appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboard_common_controls_detailsA

Function accepts compliance period as 'period'. Period donates for which quarter of year dashboard data is needed. Format: Q1 2024. Use this tool to get Common Control Framework (CCF) dashboard data for a specific compliance period with filters. This function provides detailed information about common controls, including their compliance status, control status, and priority. Use pagination if controls count is more than 50 then use page and pageSize to get control data pagewise, Once 1st page is fetched,then more pages available suggest to get next page data then increase page number. Args: - period (str): Compliance period for which dashboard data is needed. Format: 'Q1 2024'. (Required) - complianceStatus (str): Compliance status filter (Optional, possible values: 'COMPLIANT', 'NON_COMPLIANT', 'NOT_DETERMINED"). Default is empty string (fetch all Compliance statuses). - controlStatus (str): Control status filter (Optional, possible values: 'Pending', 'InProgress', 'Completed', 'Unassigned', 'Overdue'). Default is empty string (fetch all statuses). - priority (str): Priority of the controls. (Optional, possible values: 'High', 'Medium', 'Low'). Default is empty string (fetch all priorities). - controlCategoryName (str): Control category name filter (Optional). Default is empty string (fetch all categories). - page (int): Page number for pagination (Optional). Default is 1 (fetch first page). - pageSize (int): Number of items per page (Optional). Default is 50.

Returns: - controls (List[CommonControlVO]): A list of common controls. - id (str): Unique identifier of the control. - planInstanceID (str): ID of the associated plan instance. - alias (str): Alias or alternate name for the control. - displayable (str): Flag or content that indicates display eligibility. - controlName (str): Name of the control. - dueDate (str): Due date assigned to the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - status (str): Current status of the control. - complianceStatus (str): Compliance status of the control. - updatedAt (str): Timestamp when the control was last updated. - page (int): Current page number in the paginated result. - totalPage (int): Total number of pages available. - totalItems (int): Total number of control items. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodYes
complianceStatusNo
controlStatusNo
priorityNo
controlCategoryNameNo
pageNo
pageSizeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
pageNo
totalPageNo
totalItemsNo
errorNo

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries full burden. It is a read-only operation (implied by 'get' and 'dashboard data'), but it does not explicitly state the absence of side effects, authorization needs, or rate limits. It does disclose pagination behavior and return structure, which adds some transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with Args and Returns sections, but it contains some redundancy (e.g., multiple mentions of 'dashboard data') and could be shortened. The pagination instruction is clearly placed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters and an output schema, the description fully covers purpose, parameter semantics, pagination, and return fields. An agent can correctly invoke this tool with no additional context needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add all parameter meaning. It does so comprehensively: explains period format, provides possible values for complianceStatus, controlStatus, and priority, describes controlCategoryName as optional, and explains page/pageSize defaults and pagination usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves Common Control Framework (CCF) dashboard data with filters. It specifies the resource (common controls) and the action (get dashboard data), making it distinct from sibling tools like get_dashboard_data and get_top_non_compliant_controls_detail.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool (for CCF dashboard data) and includes pagination instructions (use page and pageSize for more than 50 controls). However, it does not mention when not to use it or compare with alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboard_dataA

Function accepts compliance period as 'period'. Period denotes for which quarter of year dashboard data is needed. Format: Q1 2024.

Dashboard contains summary data of Common Control Framework (CCF). For any related to contorl category, framework, assignment status use this function. This contains details of control status such as 'Completed', 'In Progress', 'Overdue', 'Pending'. The summarization levels are 'overall control status', 'control category wise', 'control framework wise', 'overall control status' can be fetched from 'controlStatus' 'control category wise' can be fetched from 'controlSummary' 'control framework wise' can be fetched from 'frameworks'

Args: - period (str) - Period denotes for which quarter of year dashboard data is needed. Format: Q1 2024.

Returns: - totalControls (int): Total number of controls in the dashboard. - controlStatus (List[ComplianceStatusSummaryVO]): Summary of control statuses. - status (str): Compliance status of the control. - count (int): Number of controls with the given status. - controlAssignmentStatus (List[ControlAssignmentStatusVO]): Assignment status categorized by control. - categoryName (str): Name of the control category. - controlStatus (List[ComplianceStatusSummaryVO]): Status summary within the category. - status (str): Compliance status. - count (int): Number of controls with this status. - compliancePCT (float): Overall compliance percentage across all controls. - controlSummary (List[ControlSummaryVO]): Detailed summary of each control. - category (str): Category name of the control. - status (str): Compliance status of the control. - dueDate (str): Due date for the control, if applicable. - compliancePCT (float): Compliance percentage for the control. - leafControls (int): Number of leaf-level controls in the category. - complianceStatusSummary (List[ComplianceStatusSummaryVO]): Summary of control statuses. - status (str): Compliance status. - count (int): Number of controls with the given status. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoQ1 2024

Output Schema

ParametersJSON Schema
NameRequiredDescription
totalControlsNo
controlStatusNo
controlAssignmentStatusNo
compliancePCTNo
controlSummaryNo
complianceStatusSummaryNo
frameworksNo
errorNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden. It clearly documents the return structure and the input parameter. However, it does not explicitly confirm read-only behavior or mention any side effects, but the tool name and context imply non-destructive data retrieval.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly detailed and structured, with the period parameter explained first, followed by a description of the dashboard content, and then the full output schema. It could be slightly more concise, but the length is justified by the complexity of the return data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter and a complex return structure, the description covers all aspects: input format, purpose, and full output fields with types and explanations. With no annotations or output schema provided, the description is complete enough for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'period' is explained in detail: the description specifies the format 'Q1 2024' and its purpose (quarter of year for dashboard data). This adds significant meaning beyond the schema's type definition, especially given 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves dashboard summary data for the Common Control Framework based on a compliance period. It mentions specific return fields and distinguishes from sibling tools by stating 'For any related to control category, framework, assignment status use this function.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides some guidance on when to use the tool ('For any related to control category, framework, assignment status use this function'), but does not explicitly mention alternatives or situations to avoid. It lacks a clear when-to-use/when-not-to-use structure.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_dashboard_review_periodsB

Fetch list of review periods Returns: - items (List[str]): list of review periods - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
itemsNo
errorNo

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description indicates a read operation ('fetch') but lacks disclosure of behavioral traits such as side effects, permissions, or rate limits. Without annotations, more transparency is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short (two sentences) and front-loaded. However, it repeats return structure that might be in output schema, slightly reducing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list-fetching tool with no parameters, the description is adequate but lacks usage guidance and behavioral details, making it complete only to a minimum degree.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so schema coverage is 100%. The description does not need to add parameter details, thus baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fetch list of review periods', specifying the verb (fetch) and resource (review periods). It is distinct from sibling tools due to the specific resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. With many sibling fetch tools, explicit usage context is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_rules_summaryA

Tool-based version of get_rules_summary for improved compatibility and prevention of duplicate rule creation.

This tool serves as the initial step in the rule creation process. It helps determine whether the user's proposed use case matches any existing rule in the catalog.

PURPOSE:

  • To analyze the user's use case and avoid duplicate rule creation by identifying the most suitable existing rule based on its name, description, and purpose.

  • NEW: Check for partially developed rules in local system before allowing new rule creation

  • NEW: Present resumption options if incomplete rules are found to prevent duplicate work

WHEN TO USE:

  • As the first step before initiating a new rule creation process

  • When the user wants to retrieve and review all available rules in the catalog

  • When verifying if a similar rule already exists that can be reused or customized

  • NEW: When checking for incomplete local rules that should be resumed instead of creating new ones

🚫 DO NOT USE THIS TOOL FOR:

  • Checking what rules are available in the ComplianceCow system.

  • This tool only works with the rule catalog (not the entire ComplianceCow system).

  • The catalog contains only rules that are published and available for reuse in the catalog.

  • For direct ComplianceCow system lookups, use dedicated system tools instead:

  • fetch_cc_rule_by_name

  • fetch_cc_rule_by_id

WHAT IT DOES:

  • Retrieves the full list of rules from the catalog with simplified metadata (name, purpose, description)

  • Performs intelligent matching using metadata (name, description, purpose) with user-provided use case details

  • Uses semantic pattern recognition to find similar rules, even across different systems (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)

IF A MATCHING RULE IS FOUND:

  • Retrieves complete details via fetch_rule().

  • If the readmeData field is available in the fetch_rule() response, Performs README-based validation using the readmeData field from the fetch_rule() response to assess its suitability for the user’s use case.

  • If suitable:

  • Returns the rule with full metadata, explanation, and the analysis report.

  • If not suitable:

  • Informs the user that the rule's README content does not align with the intended use case.

  • Prompts the user with clear next-step options:

    • "The rule's README content does not align with your use case. Please choose one of the following options:"

    • Customize the existing rule

    • Evaluate alternative matching rules

    • Proceed with new rule creation

  • Waits for the user's choice before proceeding.

IF A SIMILAR RULE EXISTS FOR AN ALTERNATE TECHNOLOGY STACK:

  • Detects rules with the same logic but built for a different platform or system (e.g., AzureUserUnusedPermission for SalesforceUserUnusedPermissions)

  • If the readmeData field is available in the fetch_rule() response, Retrieves and analyzes the readmeData from the fetch_rule() response to compare the implementation details against the user's proposed use case

  • Based on the comparison:

    • If the README content matches or is mostly reusable, suggest using the existing rule structure and logic as a foundation to create a new rule tailored to the user's target system

    • If the README content does not match or is not suitable, clearly inform the user and recommend either modifying the logic significantly or proceeding with a completely new rule from scratch

IF NO SUITABLE RULE IS FOUND:

  • Clearly informs the user that no relevant rule matches the proposed use case

  • Suggests continuing with new rule creation

  • Optionally highlights similar rules that can be used as a reference

MANDATORY STEPS: README VALIDATION:

  • Always retrieve and analyze readmeData from fetch_rule().

  • Ensure the rule's logic, behavior, and intended use align with the user's proposed use case.

README ANALYSIS REPORT:

  • Generate a clear and concise report for each readmeData analysis that classifies the result as a full match, partially reusable, or not aligned.

  • Present this report to the user for review.

USER CONFIRMATION BEFORE PROCEEDING: When analyzing a README file:

  • If no relevant rule matches the proposed use case, or if the README is deemed unsuitable, the tool must pause and request explicit user confirmation before proceeding further.

  • The tool should:

  • Clearly inform the user that no matching rule was found or the README is not appropriate.

  • Suggest creating a new rule as the next step.

  • Optionally recommend similar existing rules that can serve as references to help the user craft the new rule.

ITERATE UNTIL MATCH:

  • Repeat the above steps until a suitable rule is found or all options are exhausted.

CROSS-PLATFORM RULE HANDLING:

  • For rules from a different stack:

  • If reusable: suggest customization

  • If not reusable: recommend new rule creation

Returns:

  • A single rule object with full metadata and verified README match — if an exact match is found

  • A similar rule suggestion with customization options — if a cross-system match is found (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)

  • A message indicating no suitable rule found — with next steps and guidance to create a new rule

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses the workflow: retrieval, matching, calling fetch_rule(), README validation, analysis report, user confirmation, iteration, and cross-platform handling. No contradictions and thorough coverage of behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively long, with repetitive explanations (e.g., README validation described multiple times). It includes verbose sections like 'IF A MATCHING RULE IS FOUND' and 'ITERATE UNTIL MATCH' that could be condensed. This hinders quick scanning by the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite length, the description covers all necessary facets: matching logic, cross-platform handling, user confirmation, iteration, and edge cases. Since an output schema exists, return values need no extra detail. The tool's complexity is fully addressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so baseline is 4. The description does not need to explain parameters, and it doesn't add any, which is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's role as an initial step in rule creation to prevent duplicates by analyzing use cases against catalog rules. However, the name 'get_rules_summary' understates the extensive analysis and decision-making behavior, which could mislead about core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'WHEN TO USE' and 'DO NOT USE THIS TOOL FOR' sections provide clear context. It specifies using this tool as the first step before new rule creation and for catalog retrieval, and directs to alternative tools like 'fetch_cc_rule_by_name' for system lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_task_detailsB

Tool-based version of get_task_details for improved compatibility.

DETAILED TASK ANALYSIS REQUIREMENTS:

  • Use this tool if the tasks://details/{task_name} resource is not accessible

  • Extract complete input/output specifications with template information

  • Review detailed capabilities and requirements from the full README

  • Identify template-based inputs (those with the templateFile property)

  • Analyze appTags to determine the application type

  • Review all metadata and configuration options

  • Use this information for accurate task matching and rule structure creation

INTENTION-BASED OUTPUT CHAINING:

  • ANALYZE output purpose: Is this meant for direct user consumption or further processing?

  • ASSESS completion level: Does this output fulfill the user's end goal or serve as a stepping stone?

  • EVALUATE consolidation needs: Are multiple outputs meant to be combined for complete picture?

  • DETERMINE transformation requirements: Does raw output need formatting for usability?

WORKFLOW GAP DETECTION:

  • IDENTIFY outputs that represent partial solutions to user problems

  • DETECT outputs that split information requiring reunification

  • RECOGNIZE outputs that extract data without presenting insights

  • FLAG outputs that validate without providing actionable summaries

COMPLETION INTENTION MATCHING:

  • SUGGEST tasks that transform intermediate outputs into final deliverables

  • RECOMMEND tasks that consolidate split information into unified reports

  • PROPOSE tasks that add analysis layer to raw validation results

  • ENSURE suggested tasks align with user's stated end goals

IMPORTANT (MANDATORY BEHAVIOR): If the requested task is not found with the user's specification, the system MUST:

  1. Prompt the user to choose how to proceed including the below option.

  • Option: Create task development Ticket.

  1. Wait for the user's response before taking any further action.

  2. If the user chooses to create a task development ticket, call create_support_ticket() via the MCP tool, collecting the required input details from the user before submitting.

Args: task_name: The name of the task for which to retrieve details

Returns: A dictionary containing the complete task information if found, OR executes the user-selected alternative approach, OR creates a support ticket (with collected details) if chosen

ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It describes the return behavior (dictionary with task info or alternative actions) and the mandatory not-found process. However, much of the description comprises abstract workflow instructions (e.g., 'INTENTION-BASED OUTPUT CHAINING') that are not specific to the tool's behavior, reducing clarity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively long (over 300 words) and contains multiple verbose sections (e.g., 'DETAILED TASK ANALYSIS REQUIREMENTS', 'INTENTION-BASED OUTPUT CHAINING') that are not directly about the tool's operation. Much of this content seems like generic agent workflow guidance rather than tool-specific documentation. This lack of conciseness harms usability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema (not shown), the description covers basic usage and the important not-found case. It mentions aspects like template information and appTags in the analysis section, but the structure is cluttered. Overall, it provides sufficient context for an AI to use the tool, though not ideally.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage for the single parameter 'task_name'. The description adds a one-line explanation: 'The name of the task for which to retrieve details', which provides basic meaning. This is adequate but minimal, especially given the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool retrieves task details for a given task name, with the opening line establishing it as a tool-based version for improved compatibility. However, the main purpose is somewhat diluted by extensive workflow instructions that obscure the core functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'IMPORTANT (MANDATORY BEHAVIOR)' section that explains how to handle cases where the task is not found, including prompting the user and optionally creating a support ticket. It also mentions using this tool if the tasks://details resource is inaccessible. However, it lacks explicit guidance on when to use this tool over its many sibling tools and does not specify when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_tasks_summaryA

Resource containing minimal task information for initial selection.

This tool is also used as a fallback resource when fetch_tasks_suggestions is disabled or does not return suitable matches, ensuring the user always has access to a broader list of available tasks for manual selection.

This resource provides only the essential information needed for task selection:

  • Task name and display name

  • Brief description

  • Purpose and capabilities

  • Tags for categorization

  • Inputs/Outputs params with minimal details

  • Basic README summary

Use this for initial task discovery and selection. Detailed information can be retrieved later using tasks://details/{task_name} for selected tasks only.

AUTOMATIC OUTPUT ANALYSIS BY INTENTION:

  • MANDATORY: Analyze each task's output purpose and completion level during selection

  • IDENTIFY output intentions that require follow-up processing:

    • SPLITTING INTENTION: Outputs that divide data into separate categories → REQUIRE consolidation

    • EXTRACTION INTENTION: Outputs that pull raw data without formatting → REQUIRE transformation

    • VALIDATION INTENTION: Outputs that check compliance without final reporting → REQUIRE analysis/reporting

    • PROCESSING INTENTION: Outputs that transform data but don't create final deliverables → REQUIRE finalization

OUTPUT COMPLETION ASSESSMENT:

  • EVALUATE: Does this output serve as a final deliverable for end users?

  • ASSESS: Is this output consumable without additional processing?

  • DETERMINE: Does this output require combination with other outputs to be meaningful?

  • IDENTIFY: Is this output an intermediate step in a larger workflow?

WORKFLOW COMPLETION ENFORCEMENT:

  • NEVER present task selections that end with intermediate processing outputs

  • AUTOMATICALLY suggest tasks that fulfill incomplete intentions

  • ENSURE every workflow produces actionable final deliverables

  • RECOMMEND tasks that bridge gaps between current outputs and user goals

Mandatory functionality:

  • Retrieve a list of task summaries based on the user's request

  • Analyze task outputs and suggest additional tasks for workflow completion

  • If no matching task is found for the requested functionality, prompt user for confirmation

  • Based on user response, either proceed accordingly or create support ticket using create_support_ticket()

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must carry the burden. It covers basic return content but omits details like pagination or idempotency. The heavy mix of agent instructions confuses the tool's own behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long and includes entire sections of agent instructions (analysis, enforcement, etc.) that are not about the tool. It lacks conciseness and mixes concerns.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and an output schema, the description covers the basic context (what it returns and when to use). However, the extraneous instructions detract from completeness and clarity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has zero parameters and 100% coverage. The description adds nothing extra about parameters, but none are needed. Baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it provides minimal task information for initial selection and is a fallback when fetch_tasks_suggestions fails. The core purpose is clear, but it also includes extensive instructions that go beyond the tool's role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use it (initial discovery, fallback) and mentions an alternative (tasks://details/ for details). Good guidance on context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_template_guidanceA

Get detailed guidance for filling out a template-based input.

COMPLETE TEMPLATE HANDLING PROCESS:

STEP 1 - TEMPLATE IDENTIFICATION:

  • Called for inputs that have a templateFile property

  • Provides decoded template content and structure explanation

  • Returns required fields, format-specific tips, and validation rules

PREFILLING PROCESS:

  1. Analyze template structure for external dependencies

  2. Prefill template with realistic values based on the instructions

RELEVANCE FILTERING:

  • ANALYZE task description and user use case to create targeted search queries

  • EXTRACT key terms from rule purpose and task capabilities

  • COMBINE system name with specific functionality being configured

  • PRIORITIZE documentation that matches the exact use case scenario

STEP 3 - ENHANCED TEMPLATE PRESENTATION TO USER: Show the template with this EXACT format: "Now configuring: [X of Y inputs]

Task: {task_name} Input: {input_name} - {description}

You can:

  • Accept these prefilled values (type 'accept')

  • Modify specific sections (provide your modifications)

  • Replace entirely (provide your complete configuration)

Please review and confirm or modify the prefilled configuration:"

STEP 4 - FALLBACK TO ORIGINAL TEMPLATE: If no documentation found or prefilling fails:

  • Show original empty template with standard format

  • Include note: "No documentation found for prefilling. Please provide your configuration."

  • Continue with existing workflow

STEP 5 - COLLECT USER CONTENT:

  • Wait for the user to provide their response (accept/modify/replace)

  • Handle "accept" by using prefilled content

  • Handle modifications by merging with prefilled baseline

  • Handle complete replacement with user content

  • Do NOT proceed until the user provides content

  • NEVER use template content as default values without documentation analysis

STEP 6 - PROCESS TEMPLATE INPUT:

  • Call collect_template_input(task_name, input_name, user_content)

  • Include documentation source metadata

  • Validates content format, checks required fields, uploads file

  • Returns file URL for use in rule structure

TEMPLATE FORMAT HANDLING:

  • JSON: Must be valid JSON with proper brackets and quotes

  • TOML: Must follow TOML syntax with proper sections [section_name]

  • YAML: Must have correct indentation and structure

  • XML: Must be well-formed XML with proper tags

VALIDATION RULES:

  • Format-specific syntax validation

  • Required field presence checking

  • Data type validation where applicable

  • Template structure compliance

  • Documentation standard compliance (when applicable)

CRITICAL TEMPLATE RULES:

  • ALWAYS call get_template_guidance() for inputs with templates

  • ALWAYS analyze documentation before showing template to user

  • ALWAYS show the prefilled template (or original if no docs found) with exact presentation format

  • ALWAYS wait for the user to provide response (accept/modify/replace)

  • ALWAYS call collect_template_input() to process user content

  • NEVER use template content directly - always use documentation-enhanced or user-provided content

  • ALWAYS use returned file URLs in rule structure

PROGRESS TRACKING:

  • Show "Now configuring: [X of Y inputs]" for user progress

  • Include clear task and input identification

  • Provide format-specific guidance and tips

  • Include documentation analysis results and source citations

Args: task_name: Name of the task input_name: Name of the input that has a template

Returns: Dict containing template content, documentation analysis, prefilled values, and guidance

ParametersJSON Schema
NameRequiredDescriptionDefault
task_nameYes
input_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It thoroughly discloses behavior: returns decoded content, prefills, handles user responses, and chains to collect_template_input. No contradictions or hidden side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very detailed with steps and repeated 'ALWAYS' constraints. While structured, it is verbose and could be shortened. Some redundancy reduces conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and simple schema, description fully covers the tool's purpose, process, and output. Output schema is mentioned, so return details are handled. Complete for agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage 0%, but description explicitly documents parameters in Args section, adding context (task_name as task name, input_name as template input name). Provides enough meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides detailed guidance for filling template-based inputs, with a specific verb ('get') and resource ('guidance'). It distinguishes from siblings like collect_template_input by focusing on analysis and prefilling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit CRITICAL TEMPLATE RULES stating to always call this tool for templates, and details when to use vs. when to fallback. It provides step-by-step process and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_top_non_compliant_controls_detailC

Function overview: Fetch control with low compliant score or non compliant controls. Arguments:

  1. period: Compliance period which denotes quarter of the year whose dashboard data is needed. By default: Q1 2024.

  2. count:

  3. page: If the user asks of next page use smartly decide the page.

Returns:

  • controls (List[NonCompliantControlVO]): A list of non-compliant controls.

    • name (str): Name of the control.

    • lastAssignedTo (List[UserVO]): List of users to whom the control was last assigned.

      • emailid (str): Email ID of the assigned user.

    • score (float): Score assigned to the control.

    • priority (str): Priority level of the control.

  • error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodYes
countNo
pageNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It mentions the function overview and return structure but lacks details on side effects, authentication, rate limits, or what happens with pagination beyond a vague note about 'smartly decide the page.'

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with sections but is somewhat verbose and includes unclear phrasing like 'If the user asks of next page use smartly decide the page.' It could be more concise and directly informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description includes a detailed return structure, complementing the output schema. However, it lacks information on error handling, prerequisites, or typical usage scenarios, making it moderately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning for 'period' (compliance quarter) but for 'count' only provides the field name, and for 'page' gives a vague instruction. Overall, it provides some but insufficient detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool fetches controls with low compliant scores or non-compliant controls, which is specific. However, it does not differentiate from similar sibling tools like 'fetch_controls' or 'get_top_over_due_controls_detail', so clarity is slightly reduced.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description does not mention prerequisites or when not to use, which is a significant gap given the many sibling tools for fetching controls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_top_over_due_controls_detailB

Fetch controls with top over due (over-due) Function accepts count as 'count' Function accepts compliance period as 'period'. Period donates for which quarter of year dashboard data is needed. Format: Q1 2024.

Args: - period (str, required) - Compliance period - count (int, required) - page content size, defaults to 10

Returns: - controls (List[OverdueControlVO]): A list of overdue controls. - name (str): Name of the control. - assignedTo (List[UserVO]): List of users assigned to the control. - emailid (str): Email ID of the assigned user. - assignmentStatus (str): Assignment status of the control. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
periodNoQ1 2024
countNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
controlsNo
errorNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. The description indicates a read-only fetch operation and details the return structure, but does not disclose potential side effects, authentication needs, or limitations. Adequate for a simple fetch.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise but uses a mixture of prose and docstring format (Args/Returns). The opening line is duplicated. Could be streamlined while retaining key info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given output schema is provided, the description covers purpose, parameters, and return values. It explains the period format and count default. However, it does not explain how 'top' is determined or any ordering, which might be needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds meaning beyond schema: explains period format ('Q1 2024') and count as page size with default. Schema has 0% description coverage, so this compensation is valuable. However, the description mixes parameter details with return format, causing slight confusion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches controls with top overdue, distinguishing it from siblings like 'get_top_non_compliant_controls_detail' and 'fetch_controls'. However, the term 'top' is not explicitly defined (e.g., sorted by score or duedate).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., fetch_controls, get_dashboard_common_controls_details). It only describes parameters and return values without context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_workflow_by_nameA

Get a workflow configuration by its name (exact, case-sensitive match).

Args: - name (str): workflow name to search

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It indicates a read operation but does not explicitly declare it as read-only or safe. No disclosure of side effects or error behaviors is given.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences: a clear main action followed by a minimal parameter list. No extraneous words, and the primary purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with an output schema, the description covers the essential purpose and parameter. However, it could mention the uniqueness of the name and suggest alternative tools for different scenarios. Overall, it is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must add meaning. The 'Args' section restates the parameter name and type, adding 'workflow name to search' which provides basic context but lacks depth, examples, or format constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'workflow configuration', and the method 'by its name (exact, case-sensitive match)'. It distinguishes this tool from siblings like 'fetch_workflow_details' (likely by ID) and 'list_workflows' (list all).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you have the exact name, but it does not explicitly state when to use this versus alternatives like 'fetch_workflow_details' or 'list_workflows'. No when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

helpA

Important: This tool should execute when user asks for help or guidance on using ComplianceCow functions. ComplianceCow Help Tool - Provides guidance on how to use ComplianceCow functions.

Args: category: Help category to display. Options: - "all": Show all available help - "assessments": Assessment-related functions - "controls": Control-related functions - "evidence": Evidence-related functions - "dashboard": Dashboard and reporting functions - "assets": Asset management functions - "actions": Action execution functions - "queries": Database query functions

Returns: Formatted help text for the specified category

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryNoall

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that the tool returns formatted help text for a category and has no side effects. While it doesn't explicitly state safety or idempotency, the nature of a help tool implies read-only behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly concise for a help tool, with clear bullet points for categories. It could be slightly more terse but is well-structured and not overly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema needed beyond mentioned return), the description covers all needed context: trigger condition, parameter options, and return type. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines a string type with a default, but the description significantly adds meaning by listing all valid category options with descriptions, practically serving as an enum. This goes well beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides guidance on using ComplianceCow functions and lists specific categories. It distinguishes itself from all other tools as the dedicated help function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states 'This tool should execute when user asks for help or guidance on using ComplianceCow functions', clearly defining when to use it. However, it does not include when not to use it or mention alternatives, but since there are no sibling help tools, this is less critical.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_assessment_categoriesA

Get all assessment categories

Returns: - categories (List[Category]): A list of category objects, where each category includes: - id (str): Unique identifier of the assessment category. - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
categoriesNo
errorNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description must convey behavioral traits. It mentions the return structure and potential error, but does not disclose side effects, authentication requirements, rate limits, or whether the list is static or dynamic.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the primary action. The bulleted return details are well-structured and concise, with no unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and a detailed output description, the tool is adequately documented for a simple retrieval. However, it lacks context on potential limitations or prerequisites, which would make it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters and 100% coverage. With zero parameters, baseline is 4. The description adds no parameter info, which is acceptable since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get all assessment categories', specifying the verb and resource. It distinguishes from sibling tools like list_all_assessments and list_all_assets by focusing on categories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Usage is implied by the tool's simplicity and uniqueness among siblings, but the lack of exclusions or context for alternatives reduces clarity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_assessmentsC

Get all assessments Args: categoryId: assessment category id (Optional) categoryName: assessment category name (Optional) assessmentName: assessment name (Optional) Returns: - assessments (List[Assessments]): A list of assessments objects, where each assessment includes: - id (str): Unique identifier of the assessment. - name (str): Name of the assessment. - categoryName (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
categoryIdNo
categoryNameNo
assessmentNameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
assessmentsNo
errorNo

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behavior. It mentions return values but does not state if the tool is read-only, any side effects, rate limits, or authentication requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description uses a structured Args/Returns format but includes redundancy (e.g., 'Get all assessments' followed by return description). It is reasonably concise but not maximally efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple operation and presence of output schema (return structure described), the description covers the key aspects: purpose, parameters, and return format. Lacks examples or edge cases but is sufficient for basic use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and description merely lists parameter names (categoryId, categoryName, assessmentName) without explaining their purpose, format, or how they filter results. For example, it does not clarify if parameters are mutually exclusive or combined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get all assessments', which clearly indicates the action and resource. However, it does not distinguish itself from the sibling tool 'fetch_assessments'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like 'fetch_assessments'. No exclusions or context about filtering or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_assetsB

Get all assets

Returns: - assets (List[AssetsVo]): A list of assets. - id (str): Asset id. - name (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
assetsNo
errorNo

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description only specifies return format, missing behavioral traits such as authentication needs, rate limits, or side effects. For a tool without annotations, more transparency is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise and front-loaded. The description is a single line plus return fields, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and presence of an output schema, the description covers the basics. However, it could specify the scope of 'all assets' (e.g., tenant-wide) and any limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist (0 params), so the description cannot provide parameter-level meaning. Baseline of 4 is appropriate since no additional info is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get all assets' and lists return fields, but does not differentiate from sibling tools like list_assets_cc or fetch_assets_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over alternatives. The description provides no context for selection among the many list-related siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_assets_ccA

Retrieve all available assets (integration plans).

Returns: - success (bool): Indicates if the operation completed successfully. - assets (List[dict]): A list of assets. - id (str): Asset id. - name (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes return fields (success, assets list, error) clearly. No annotations provided, but the description carries the burden well, indicating a read-only retrieval without side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise, with clear structure using dashes for return fields. Could be slightly more organized (e.g., separate lines), but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Sufficient for a parameterless list tool: explains what it returns and error handling. Lacks differentiation from sibling 'list_all_assets', but otherwise complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has no parameters, so description adds value by explaining the output schema in detail. Schema coverage is 100%, but the description compensates with return field documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it retrieves all available assets, specifying they are 'integration plans'. Provides return structure. However, it does not explicitly differentiate from sibling 'list_all_assets', which may cause confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage when needing all integration plan assets, but no explicit when-to-use or comparison with alternatives like 'list_all_assets'. No usage exclusions provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_asset_schedulesA

List schedules for a given asset.

Args: - assetId (str): Asset ID whose schedules need to be listed

Returns: - success (bool) - items (list): List of schedules - error (Optional[str])

ParametersJSON Schema
NameRequiredDescriptionDefault
assetIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It only mentions return fields but does not reveal side effects, authentication needs, rate limits, or any constraints beyond listing. This is minimal for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: one line for purpose, then a clear list of arguments and returns. No extraneous words, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with an output schema (implicit), the description covers the return structure (success, items, error). It lacks details like whether pagination is supported or what a schedule object contains, but these are reasonable omissions given the output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to the sole parameter 'assetId' by explaining it as 'Asset ID whose schedules need to be listed'. Since schema description coverage is 0%, this clarification is valuable and fills the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description directly states 'List schedules for a given asset' with a clear verb+resource structure. It distinguishes from sibling tools like delete_asset_schedule and schedule_asset_execution by focusing only on listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., list_checks, list_workflows, or other listing tools). The description only lists parameters and returns without context on prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_checksB

Retrieve all checks associated with an asset.

Args: - assetId (str): Asset id (plan id).

Returns: - success (bool): Indicates if the operation completed successfully. - checks (List[dict]): A list of checks. - id (str): Check id. - name (str): Name of the check. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation ('Retrieve') but does not explicitly state safety, permissions, or side effects. The return structure is documented, but behavioral traits like rate limits or prerequisites are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured using Args/Returns format, which is clear but slightly verbose. It is not overly long, but could be more concise for a simple single-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one parameter and an output schema (implied by the Returns section), the description covers the essential inputs and outputs. It could mention prerequisites like the asset existing, but overall it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds critical meaning: 'assetId (str): Asset id (plan id).' This clarifies the parameter's purpose beyond the bare schema type, compensating well for the lack of annotation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve all checks associated with an asset' with a specific verb and resource. It explicitly mentions the sole required parameter 'assetId' and distinguishes itself from sibling tools like 'fetch_checks' by focusing on checks for a single asset.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It lacks explicit when-to-use, when-not-to-use, or mentions of sibling tools, leaving the agent to infer usage context without support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_control_notesC

List all notes for a given control.

This tool retrieves all notes associated with a control.

Args: controlId (str): The control ID to list notes for (required).

Returns: Dict with success status and notes: - success (bool): Whether the request was successful - notes (List[dict]): List of note objects, each containing: - id (str): Note ID - topic (str): Note topic - notes (str): Note content - totalCount (int): Total number of notes found - error (str, optional): Error message if request failed

ParametersJSON Schema
NameRequiredDescriptionDefault
controlIdYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the return format but does not explicitly state that the operation is read-only, does not describe authorization needs, rate limits, or side effects. The description implies a safe read but lacks explicit behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with Args and Returns sections, but it is verbose for a simple one-parameter tool. The detailed return structure is informative, though some redundancy exists with the available output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one parameter and a documented return structure, the description covers the purpose, input, and output sufficiently. However, it lacks edge case handling (e.g., empty results) and usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description simply restates the parameter name and that it is required, adding no extra meaning beyond the input schema. It does not clarify format, constraints, or example values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List all notes for a given control' with a specific verb (list), resource (notes), and scope (control). It distinguishes from sibling tools like create_control_note and update_control_note, but does not explicitly contrast with other list tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides basic usage instructions (required controlId) but no guidance on when to use this tool versus alternatives, no when-not-to-use, and no prerequisites or context for choosing this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_activity_typesA

Get available workflow activity types.

Activity types define what kind of actions can be performed in workflow nodes:

  • Pre-build Function: Execute predefined logic

  • Pre-build Rule: Execute a rule

  • Pre-build Task: Trigger a predefined task

Returns: List of available activity types

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose key behaviors. It indicates a read-only retrieval but does not explicitly mention that no changes are made, nor does it discuss permissions or limitations. The simple nature of the tool mitigates the lack of detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably short but includes bullet points that could be integrated into a single line. It is front-loaded with the primary action but has some redundancy (e.g., 'Returns:' line).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with no parameters and an output schema, the description covers the purpose and the contents of the returned list adequately. No additional information is necessary for proper invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, and schema coverage is 100% (trivially). The description adds no parameter information because none exist. Baseline score of 4 is appropriate for a no-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves available workflow activity types and distinguishes itself from sibling list tools by specifying that these are for actions in workflow nodes. It uses specific verbs and context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for getting activity types but does not explicitly state when to use this tool versus sibling tools like list_workflow_functions or list_workflow_conditions. No exclusion criteria or alternatives are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_condition_categoriesA

Retrieve available workflow condition categories.

Condition categories help organize workflow decision points by type. This is useful for filtering and selecting appropriate conditions when building workflows.

Returns: - Condition categories (List[WorkflowConditionCategoryItemVO]): List of condition categories - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
conditionCategoriesNo
errorNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It describes the return value (list of categories with name) and potential error, but does not disclose any behavioral traits such as read-only nature, rate limits, or side effects. This is adequate for a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loading the verb and resource, and includes a clear returns section. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and a provided output schema, the description sufficiently explains the purpose, use case, and return format. It is complete for a simple retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, and schema coverage is 100% (empty schema). The description adds value by explaining the return structure (name and error), which is not present in the input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves available workflow condition categories and explains their purpose in organizing decision points. The name and description distinguish it from sibling list tools (e.g., list_workflow_conditions, list_workflow_event_categories).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes this is useful for filtering and selecting conditions when building workflows, providing context. However, it does not explicitly state when to use this tool versus alternatives, nor does it exclude any scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_conditionsA

Retrieve available workflow conditions.

Conditions are decision points in workflows that evaluate expressions or functions to determine the flow path. They can use CEL expressions or predefined functions to make branching decisions. Only active conditions are returned.

Returns: - conditions (List[WorkflowConditionVO]): List of active workflow conditions with input/output specifications - categoryId (str) - desc (str) - displayable: (str) - inputs: [List[WorkflowInputsVO]] - outputs: [List[WorkflowOutputsVO]] - status: (str)

- error (Optional[str]): An error message if any issues occurred during retrieval.
ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
conditionsNo
errorNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Describes that only active conditions are returned and includes output structure. However, does not explicitly declare read-only nature or mention any side effects, authorization needs, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured, front-loaded with action verb, concise explanation of conditions, and clear return specification. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately describes the return data including error field. Could mention pagination or result limits, but for a simple list tool without parameters, it is mostly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, baseline is 4. Description adds meaning by explaining the purpose and what is returned, which compensates for the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Retrieve available workflow conditions' and explains what conditions are. While it doesn't explicitly differentiate from siblings like 'list_workflow_condition_categories', the name and description make the purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, filters, or contextual cues for selection among similar list operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_event_categoriesA

Retrieve available workflow event categories.

Event categories help organize workflow triggers by type (e.g., assessment events, time-based events, user actions). This is useful for filtering and selecting appropriate events when building workflows.

Returns: - eventCategories: List of event categories with type and displayable name - error: Error message if retrieval fails

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
eventCategoriesNo
errorNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the return structure (eventCategories and error) and implies a safe read operation. It is transparent about expected behavior, though it omits potential edge cases like auth requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with three short sentences, front-loading the purpose. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple parameterless retrieval tool with an output schema, the description is fully complete: it states the action, purpose, and return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the baseline is 4. The description adds value by explaining the output structure, which goes beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource: 'Retrieve available workflow event categories.' It explains the purpose and gives examples, clearly distinguishing from sibling tools like list_workflow_activity_types by focusing on event categories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states it is 'useful for filtering and selecting appropriate events when building workflows,' which provides context but does not explicitly compare to alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_eventsB

Retrieve available workflow events that can trigger workflows.

Events are the starting points of workflows. Each event has a payload that provides data to subsequent workflow nodes. Events are categorized into two types:

System Events: Automatically triggered by the system when specific actions occur. Examples include:

  • Assessment run completed

  • Form submitted

  • Scheduled time-based triggers

Custom Events: Manually triggered events that can be used to:

  • Trigger workflows from within other workflows

  • Integrate with external systems

  • Enable manual workflow execution

Returns: - systemEvents (List[WorkflowEventVO]): A list of system events that are automatically triggered. - id (str) - categoryId (str) - desc (str) - displayable (str) - payload [List[WorkflowPayloadVO]] - status (str) - type (str) - customEvents (List[WorkflowEventVO]): A list of custom events that can be manually triggered. - id (str) - categoryId (str) - desc (str) - displayable (str) - payload [List[WorkflowPayloadVO]] - status (str) - type (str) - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
systemEventsNo
customEventsNo
errorNo

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, but the description details the output structure including systemEvents, customEvents, and an error field. It implies a read-only operation but does not explicitly state safety or authorization requirements. The description adds moderate value over annotations (none).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately detailed with a bulleted list of return fields. It is not overly verbose but could be more concise by shortening the examples and field definitions, which are already partially captured in the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and the output schema exists, the description provides sufficient context about what the tool does and what it returns. It covers both system and custom events and includes error handling, making it complete for a retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters in the input schema. Since schema_description_coverage is 100% and the tool has zero parameters, the description adds no param info, but baseline for 0 params is 4. The description does not need to add parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves available workflow events, specifying two types (system and custom). It uses a specific verb 'Retrieve' and resource 'workflow events', but does not explicitly differentiate from sibling list tools like 'list_workflow_activity_types'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool over other list tools or context for usage. The description only explains what it returns, not when it is appropriate to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_function_categoriesA

Retrieve available workflow function categories.

Function categories help organize workflow activities by type. This is useful for filtering and selecting appropriate functions when building workflows.

Returns: - activity categories (List[WorkflowActivityCategoryItemVO]): List of activity categories. - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
activityCategoriesNo
errorNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It indicates a read operation via 'Retrieve' and mentions return types and error handling, but lacks explicit statements about safety, authentication, or side effects. For a simple list tool, this is adequate but not exceptional.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of three short sentences. The bullet list for returns is clear and efficient. Every sentence adds value without unnecessary repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no annotations, output schema exists), the description covers purpose, usage, and return structure. It includes an error field mention. It is mostly complete, though might benefit from noting that it returns all categories without filtering.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so schema description coverage is 100% trivially. According to the rubric, 0 parameters yields a baseline of 4. The description does not need to add parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve available workflow function categories', using specific verb and resource. It explains function categories organize workflow activities by type, distinguishing it from sibling tools like list_workflow_activity_types and list_workflow_conditions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says this tool is useful for filtering and selecting functions when building workflows, providing clear context. However, it does not explicitly mention when not to use it or list alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_functionsA

Retrieve available workflow functions (activities).

Functions are the core actions that can be performed in workflow nodes. They take inputs and produce outputs that can be used by subsequent nodes. Only active functions are returned.

Returns: - activities (List[WorkflowActivityVO]): List of active workflow functions with input/output specifications - id: Optional[str] = "" - categoryId (str) - desc (str) - displayable Optional[str] = "" - name (str) - inputs [List[WorkflowInputsVO]] - outputs [List[WorkflowOutputsVO]] - status (str)

- error (Optional[str]): An error message if any issues occurred during retrieval. 
ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
activitiesNo
errorNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the burden. It states only active functions are returned and provides return structure, but does not disclose potential side effects, permissions, or rate limits. It is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with purpose, and includes necessary return field details without redundancy. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and a complex output, the description provides return structure and explains function behavior (active only, inputs/outputs). It is mostly complete but could mention error handling or permissions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has zero parameters, so baseline is 4. The description adds no parameter info, but none is needed. Schema coverage is trivially 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves available workflow functions (activities) and explains they are core actions taking inputs and producing outputs. It distinguishes from siblings like 'list_workflow_activity_types' by specifying it returns functions with input/output specifications.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving functions for workflow nodes but lacks explicit guidance on when to use versus alternatives or when not to use. No exclusion or preference is stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_predefined_variablesA

Retrieve available predefined variables for workflow configuration.

Predefined variables are system-level variables that can be used in workflow configurations. These system-level variables are mapped to specific operations. When you set a value for a predefined variable, it automatically triggers the associated system operation (like sending workflow failure notifications). Example: - Sending workflow failure notifications to specific users - Sending workflow failure notifications to admin Returns: - items (List[WorkflowPredefinedVariableVO]): A list of predefined variables. - id (str): Unique identifier of the predefined variable - type (str): Data type of the variable (e.g., Text, Boolean) - name (str): Name of the predefined variable - error (Optional[str]): An error message if any issues occurred during retrieval.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
itemsNo
errorNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states the tool retrieves data and returns items/error, but lacks details on rate limits, authentication needs, or any side effects. It is adequately transparent for a read-only operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with clear structure: purpose statement, explanation, example, and return schema. Every sentence adds value and is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no parameters and an output schema described, the description provides sufficient context: it explains what predefined variables are, gives examples, and lists return fields. It is complete for a simple retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so parameter semantics are not applicable. The description adds value by explaining the return structure and providing examples, meeting the baseline expectation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves available predefined variables for workflow configuration. The verb 'retrieve' and resource 'predefined variables' are specific, and the purpose distinguishes it from sibling list_workflow_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides examples of use cases (e.g., sending notifications) but does not explicitly state when to use this tool vs alternatives or exclude other tools. Usage is implied by context and examples.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_rulesA

Retrieve available workflow rules.

Rules are predefined logic that can be executed in workflow nodes. They typically handle data processing, validation, or business logic. Rules have inputs and outputs that can be mapped to other workflow components.

Returns: - rules (List[WorkflowRuleVO]): List of available workflow rules with input/output specifications - id (str) - name: (str) - description (str) - ruleInputs: [List[WorkflowRuleInputsVO]] - ruleOutputs: [List[WorkflowRuleOutputsVO]]

- error (Optional[str]): An error message if any issues occurred during retrieval. 
ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
rulesNo
errorNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the return format and error field, confirming it's a read operation. However, it lacks details on authentication, rate limits, or side effects, which is acceptable for a simple list tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description includes a definition of workflow rules that might be redundant for an AI agent familiar with the domain. The return spec is formatted as a list, which is clear but somewhat verbose. Could be more concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of parameters and annotations, the description is fairly complete. It explains the tool's purpose and return structure. However, it doesn't mention pagination or filtering possibilities, which are not needed here. Minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The schema coverage is 100% (empty schema), and the description adds no parameter details because none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Retrieve available workflow rules,' clearly stating the verb and resource. It distinguishes from sibling tools like fetch_workflow_rule by being a list operation, and provides context on what workflow rules are.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not specify when to use this tool versus alternatives like fetch_workflow_rule or fetch_rule. No guidance on when not to use it or prerequisites, leaving the agent to infer usage from context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflowsA

Retrieve a list of all available workflow configurations.

Returns: - List of workflow configuration items : Each item contains workflow metadata - Error message (str): If retrieval fails or an error occurs

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden. It only mentions return types and error cases but does not disclose behavioral traits like read-only nature, rate limits, or behavior when no workflows exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences covering purpose and returns. No wasted words, and key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and presence of an output schema, the description adequately covers purpose and return format. Minor missing details (e.g., sorting order) but sufficient for a list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so schema coverage is trivially 100%. The description adds no parameter info (none needed), meeting baseline for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Retrieve' and the resource 'all available workflow configurations.' It distinguishes itself from sibling tools like fetch_workflow_details and list_workflow_rules by focusing on listing all configurations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., fetch_workflow_details) or when not to use it. No explicit context or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workflow_tasksA

Retrieve available workflow tasks.

Tasks are predefined operations that can be executed in workflow nodes. They typically handle external integrations, notifications, or complex operations. Tasks have inputs and outputs that can be mapped to other workflow components.

Returns: - tasks (List[WorkflowTaskVO]): List of available workflow tasks with input/output specifications - id (str) - name (str) - displayable (str) - description (str) - inputs: [List[WorkflowTaskInputsVO]] - outputs: [List[WorkflowTaskOutputsVO]]

- error (Optional[str]): An error message if any issues occurred during retrieval. 
ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
tasksNo
errorNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must cover behavioral aspects. It describes the return structure but lacks details on safety (e.g., read-only), authentication, or side effects. For a simple retrieval tool, this is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description includes a lengthy returns section that largely duplicates the output schema. Could be more concise by omitting redundant field listings.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description explains the purpose and high-level content. It provides enough context for a simple list tool, though usage guidelines are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. Description adds no parameter info, but the baseline for zero-param tools is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Retrieve available workflow tasks' and explains what tasks are, distinguishing from sibling tools like list_workflow_conditions or list_workflow_events by focusing on 'tasks' as predefined operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. Does not mention exclusions or prerequisites. Given many sibling list tools, explicit usage context is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

modify_workflowA

Modify an existing workflow using YAML definition.

The workflow ID (UUID) is required to identify which workflow to modify. This function updates an existing workflow with a new YAML specification. The YAML should define the workflow structure including states, activities, conditions, and transitions. Always display the workflow diagram and confirm with the user before executing this tool.

BEFORE using 'modify_workflow' tool, you MUST check:

  • Do I have the complete CCow workflow YAML schema?

  • Do I know the exact state configuration requirements?

  • Do I understand the data flow and variable reference patterns? If the answer to ANY of these is "no", respond with: "I need CCow workflow schema knowledge to properly implement this workflow. Please provide the workflow YAML specification, state definitions, and integration patterns before I proceed with modify_workflow."

Args: workflow_yaml: YAML string defining the updated workflow structure workflow_id: ID of the workflow to modify

Returns: Success message or error message

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_yamlYes
workflow_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries full burden. It discloses the requirement to confirm with user and display diagram, but does not cover side effects, permissions, or locking. The behavioral detail is minimal but present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, but then includes a lengthy checklist and fallback response script which could be more concise. It sacrifices brevity for guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 0% schema coverage and no output schema in description, it only vaguely mentions return values. It does not address error handling or prerequisites beyond the checklist. With many sibling workflow tools, more detail on when to use this versus others would help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It lists both parameters with explanations: workflow_id as identifier and workflow_yaml as YAML definition. This adds meaning beyond the raw schema, though format constraints are not detailed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Modify an existing workflow using YAML definition', specifying the action and resource. It distinguishes from sibling tools like create_workflow and trigger_workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a checklist for prerequisites and instructs to display diagram and confirm with user before execution, guiding when and how to use the tool. It does not explicitly mention alternatives but the context implies distinct tools for creation and triggering.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

prepare_applications_for_executionA

Analyze rule tasks and prepare application configuration requirements for execution.

This tool helps users understand what applications are needed and whether they can share applications across multiple tasks.

WHEN TO USE:

  • Before calling execute_rule() to understand application requirements

  • To identify if multiple tasks can share the same application

  • To determine if unique identifiers are needed when using different applications for same appType

NOTE: This tool is optional. Rules with only 'nocredapp' tasks can be executed directly without any application configuration. Use this tool only when tasks require credentials.

APPLICATION SHARING SCENARIOS (when applications are needed):

  1. Shared Application: User wants same credentials for all tasks of an appType

    • Single application config with basic appTags (just appType)

    • One application covers multiple tasks

  2. Separate Applications: User needs different credentials per task

    • Must add unique identifier key (e.g., "purpose") to task appTags

    • Each application config must include matching unique identifier

  3. No Application Needed: All tasks have 'nocredapp' appType

    • Skip application configuration entirely

    • Call execute_rule() with an empty applications list

WORKFLOW:

  1. Call this tool with rule_name

  2. Review which tasks need applications (if any)

  3. If no tasks need applications (all nocredapp): Skip to step 6

  4. For tasks with same appType, decide: share or separate?

  5. If sharing: Provide one application config per appType If separate: Add unique identifiers and provide separate configs

  6. Call execute_rule() with configured applications (or empty list for nocredapp rules)

Args: rule_name: Name of the rule to analyze

Returns: Dict with analysis results and configuration guidance

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It transparently describes the tool's behavior: analyzing tasks, identifying sharing possibilities, and guiding configuration. It also clarifies the optional nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with headings, bullets, and scenarios, but somewhat lengthy. Front-loaded with purpose and clear organization.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input and output schema, the description covers all necessary context: when to use, scenarios, workflow, and return type. Adequately completes the picture for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter 'rule_name' with 0% schema coverage. The description adds 'Name of the rule to analyze', which is minimal but adequate for a single string parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool analyzes rule tasks and prepares application configuration requirements for execution. It specifies the verb 'analyze' and 'prepare' and distinguishes from sibling tools like execute_rule.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides WHEN TO USE sections, including when not to use (optional for nocredapp tasks), and a detailed WORKFLOW with decision points.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

prepare_input_collection_overviewA

INPUT COLLECTION OVERVIEW & RULE CREATION

Prepare and present input collection overview before starting any input collection.

MANDATORY FIRST STEP - INPUT OVERVIEW PROCESS (Enhanced): This tool MUST be called before collecting any inputs. It analyzes all selected tasks and presents a complete overview of what inputs will be needed.

ENHANCED WITH AUTOMATIC RULE CREATION: After user confirms the input overview, this tool automatically creates the initial rule structure with selected tasks. The rule will be saved with DRAFT status and can be progressively updated as inputs are collected.

MANDATORY WORKFLOW ENFORCEMENT - CRITICAL INSTRUCTION:

  • AFTER user confirms the input overview, IMMEDIATELY call create_rule() with initial structure.

  • This call is MANDATORY and CANNOT be skipped or deferred.

  • The initial rule structure MUST be created before any input collection begins.

  • BLOCK all subsequent input collection if initial rule creation fails.

  • NEVER proceed to input collection without successful initial rule creation.

  • If create_rule() fails, STOP workflow and resolve the issue before continuing.

  • The rule creation establishes the foundation for progressive updates during input collection.

ENFORCEMENT STEPS:

  1. Present overview to user

  2. Get user confirmation

  3. IMMEDIATELY call create_rule() with initial structure that MUST INCLUDE inputs and inputsMeta__ sections WITH ACTUAL INPUT DATA - DO NOT LEAVE inputs and inputsMeta__ SECTION EMPTY - INPUTS AND INPUTSMETA__ ARE MANDATORY CORE COMPONENTS THAT MUST CONTAIN THE REQUIRED INPUT MAPPINGS - THIS IS NON-NEGOTIABLE - NO EXCEPTIONS

  4. Verify rule creation success before proceeding

  5. Only then allow input collection to begin

TASK-BY-TASK INPUT COLLECTION & VALIDATION (CRITICAL ENFORCEMENT): ═══════════════════════════════════════════════════════════════════ MANDATORY WORKFLOW FOR EACH TASK:

FOR EACH TASK in selected_tasks: STEP 1: Collect ALL inputs for current task - Use collect_template_input() for file/template inputs - Use collect_parameter_input() for parameter inputs - Wait for the current task inputs to be collected

STEP 2: **MANDATORY EXECUTION** (CANNOT BE SKIPPED)
        ⛔ THIS STEP CANNOT BE SKIPPED ⛔
        - Call execute_task(task_name, collected_inputs_for_this_task, application_config)
        - This MUST happen IMMEDIATELY after all task inputs are collected
        - BLOCK progression if execution fails
        - If execution fails:
          * Show execution errors to user
          * Allow input correction
          * Re-execute with corrected inputs
          * Only proceed when execution succeeds
        - On success:
          * Store the REAL outputs from this task
          * Use these outputs as inputs for dependent tasks
          * Display output files to user

STEP 3: Move to next task ONLY after the task execution succeeds
        - Task Execution success = prerequisite for next task
        - No task can start input collection without previous task execution completing successfully
        - Use the REAL outputs from the executed task as inputs for dependent tasks

❌ PROHIBITED ACTIONS:

  • Collecting inputs for Task N+1 without executing Task N

  • Skipping execution "to save time"

  • Assuming execution will happen "later"

  • Moving to final rule creation without executing all tasks

✅ CORRECT WORKFLOW: Task1 Inputs → Execute Task1 → Show Results → Task2 Inputs → Execute Task2 → Show Results → Task3 Inputs → Execute Task3 → Show Results → Complete Rule

❌ WRONG WORKFLOW: Task1 Inputs → Task2 Inputs → Task3 Inputs → [Try to execute later]

SELECTIVE INPUT INCLUSION:

  • DO NOT automatically include ALL task inputs in initial rule creation.

  • Only include inputs that are REQUIRED or explicitly needed for the user's use case.

  • Skip optional inputs unless user specifically requests them.

  • Additional inputs can be added later if needed during execution or refinement.

FAILURE HANDLING:

  • If user confirms but create_rule() fails → STOP and fix issue.

  • If user declines → End workflow, no rule creation needed.

  • If create_rule() succeeds → Proceed to task-wise input collection and execution.

  • NEVER skip the create_rule() call after user confirmation.

HANDLES DUPLICATE INPUT NAMES WITH TASK ALIASES (Preserved):

  • Creates unique identifiers for each task-alias-input combination.

  • Format: "{task_alias}.{input_name}" for uniqueness.

  • Prevents conflicts when multiple tasks have same input names or same task used multiple times.

  • Maintains clear mapping between task aliases and their specific inputs.

  • Task aliases should be simple, meaningful step indicators (e.g., "step1", "validation", "processing").

OVERVIEW REQUIREMENTS (Preserved):

  1. Analyze ALL selected tasks with their aliases for input requirements.

  2. Categorize inputs: templates vs parameters.

  3. Create unique identifiers for each task-alias-input combination.

  4. Count total inputs needed.

  5. Present clear overview to user.

  6. Get user confirmation before proceeding.

  7. Return structured overview for systematic collection.

  8. NEW: Automatically create initial rule after user confirmation.

OVERVIEW PRESENTATION FORMAT (Enhanced with Validation):

INPUT COLLECTION OVERVIEW:

I've analyzed your selected tasks. Here's what we need to configure:

TASK 1: [TaskAlias] ([TaskName]) ─────────────────────────────────── Template Inputs: • [InputName] ([Format] file) - [Description] Unique ID: [TaskAlias.InputName]

Parameter Inputs: • [InputName] ([DataType]) - [Description] Unique ID: [TaskAlias.InputName] Required: [Yes/No]

⚠️ EXECUTION CHECKPOINT: After collecting all Task 1 inputs, execute_task() will be called to execute the task with real data before proceeding to Task 2.

TASK 2: [TaskAlias] ([TaskName]) ─────────────────────────────────── [... similar structure ...]

⚠️ EXECUTION CHECKPOINT: After collecting all Task 2 inputs, execute_task() will be called to execute the task with real data before proceeding to Task 3.

SUMMARY:

  • Total inputs needed: X

  • Template files: Y ([formats])

  • Parameter values: Z

  • Estimated time: ~[X] minutes

  • Execution checkpoints: [number of tasks]

WORKFLOW:

  1. For each task in the rule:

    • Collect all required inputs for the task

    • Execute the task with real data using execute_task()

    • Mark the task as executed (✓)

    • Store REAL outputs for use by dependent tasks

  2. After all tasks are executed → proceed to final rule completion

Ready to start task-by-task input collection with execution checkpoints?

CRITICAL WORKFLOW RULES:

  • ALWAYS call this tool first before any input collection.

  • NEVER start collecting inputs without user seeing overview.

  • NEVER proceed without user confirmation.

  • Create unique task_alias.input identifiers to avoid conflicts.

  • Show clear task-alias-input relationships to user.

  • NEW: Collect inputs task-by-task and execute each task immediately after collection.

  • NEW: Use REAL outputs from executed tasks as inputs for dependent tasks.

  • NEW: Create initial rule structure after user confirmation.

CRITICAL REQUIREMENTS:

  • Input names: alphanumeric + underscore only (auto-sanitize with re.sub(r'[^a-zA-Z0-9_]', '_', name))

  • Collection order: Complete ALL inputs for each task one by one (Task 1 → execute Task 1 → Task 2 → execute Task 2 → Task 3 → execute Task 3)

  • Within each task: collect all inputs, then execute using 'execute_task()' to get real outputs before proceeding

  • If a task (e.g., Task 2) has input files or other inputs that depend on a previous task, use the REAL output from the executed previous task as the input. Do NOT generate sample data.

  • If the previous task has not been executed yet, execute it first to obtain real outputs.

ARGS:

  • selected_tasks: List of dicts with 'task_name' and 'task_alias' Example: [ {"task_name": "data_validation", "task_alias": "step1"}, {"task_name": "data_processing", "task_alias": "step2"}, {"task_name": "data_validation", "task_alias": "final_check"} ]

Returns: Dict containing structured input overview and collection plan with unique identifiers, plus automatic rule creation capability after user confirmation, with explicit execution checkpoints for each task

ParametersJSON Schema
NameRequiredDescriptionDefault
selected_tasksYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavioral traits: it creates rules automatically after confirmation, handles duplicate names, enforces task-by-task execution ordering, and includes state changes. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively verbose, repeating workflow instructions multiple times with heavy formatting. While well-structured, it could be significantly shortened without losing meaning, and many sentences are redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the availability of an output schema, the description fully covers return value structure, side effects (rule creation), and workflow integration. It addresses all scenarios including failure handling and dependent task execution.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by detailing the parameter structure (list of dicts with task_name and task_alias), providing examples, explaining naming conventions, and specifying auto-sanitization rules.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool prepares and presents an input collection overview as a mandatory first step. It distinguishes itself from sibling tools by being the overview and rule creation step, with no other tool providing this functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance (mandatory first step before any input collection) and detailed workflow steps, including enforcement, prohibitions, and failure handling. It clearly states when not to proceed and what actions to take alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publish_applicationB

Publish applications to make them available for rule execution.

Args: rule_name: Name of the rule these applications belong to app_info: List of application objects to publish

Returns: Dict with publication results for each application

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
app_infoYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only states the action without explaining side effects, required permissions, error conditions, or whether the operation is reversible. This is insufficient for an AI agent to understand the impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the purpose. It uses a structured docstring format with clear sections for args and returns, making it easy to parse. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has moderate complexity (2 params, array of objects) and an output schema. The description covers the basic purpose and parameters but omits details on error handling, idempotency, or constraints. It is adequate but feels incomplete for production use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It briefly explains both parameters ('Name of the rule these applications belong to', 'List of application objects to publish'), adding meaning beyond the schema. However, it does not specify the structure of the application objects, limiting helpfulness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Publish applications') and the goal ('make them available for rule execution'). It is specific and distinguishes from siblings that publish rules or check status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context (for a specific rule) but offers no guidance on when to use this tool versus alternatives like publish_rule or check_applications_publish_status. No prerequisites or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

publish_ruleA

Publish a rule to make it available for ComplianceCow system.

CRITICAL WORKFLOW RULES:

  • MANDATORY: Check rule status to ensure rule is fully developed before publishing

  • MUST FOLLOW THESE STEPS EXACTLY

  • DO NOT ASSUME OR SKIP ANY STEPS

  • APPLICATIONS FIRST, THEN RULE

  • WAIT FOR USER AT EACH STEP

  • NO SHORTCUTS OR BYPASSING ALLOWED

RULE PUBLISHING HANDLING:

WHEN TO USE:

  • After successful rule creation

  • User wants to make rule available for others

  • Rule has been tested and validated

WORKFLOW (step-by-step with user confirmation):

  1. Fetch applications and check status

  • Call fetch_applications() to get available applications

  • Extract appTypes from ALL tasks in rule spec.tasks[].appTags.appType - MUST TAKE ALL THE TASKS APPTYPE AND REMOVE DUPLICATES - CRITICAL: DO NOT SKIP ANY TASK APPTYPES

  • Match ALL task appTypes with applications app_type to get application_class_name

  • Call check_applications_publish_status() for ALL matched applications

  1. Present consolidated applications with meaningful format Applications for your rule: [1] App Name | Type: xyz | Status: Published | Action: Republish [2] App Name | Type: abc | Status: Not Published | Action: Publish

Select applications to publish: ___

  • MANDATORY: WAIT for user selection before proceeding to next step

  • DO NOT CONTINUE without explicit user input

  • BLOCK execution until user provides selection

  • STOP HERE: Cannot proceed to step 3 without user response

  • HALT WORKFLOW: Wait for user to select application numbers

  • NEVER SKIP THIS STEP: User must select applications first

  • ALWAYS ASK FOR SELECTION EVEN IF ALL APPLICATIONS ARE PUBLISHED

  1. Publish selected applications (BLOCKED until step 2 complete)

  • ENTRY REQUIREMENT: User selection from step 2 must be provided

  • PREREQUISITE CHECK: Verify user provided application numbers

  • CANNOT EXECUTE: Without completing step 2 user selection

  • Get user selection numbers

  • Call publish_application() for selected applications only

  • Inform user whether successfully published or not

  • CHECKPOINT: All applications must be published before rule steps

  1. Check rule publication status (APPLICATIONS MUST BE COMPLETE FIRST)

  • GATE KEEPER: Cannot proceed without application publishing completion

  • MANDATORY PREREQUISITE: All application steps finished

  • BLOCKED ACCESS: No rule operations until applications handled

  • Call check_rule_publish_status()

  • Check response valid field:

    • True = Already published

    • False = Not published

  1. Handle rule publishing based on status If valid=False (not published):

  • Show: "Rule is not published. Do you want to publish it? (yes/no)"

  • If yes: Proceed with publishing using current name

If valid=True (already published):

  • Show: "Rule is already published. Choose option:"

    • [1] Republish with same name

    • [2] Publish with another name

  • Get user choice

  1. Handle alternative name logic If "another name" chosen:

    1. Ask: "Enter new rule name: ___"

    2. Call check_rule_publish_status(new_name)

    3. If name exists: "Name already exists. Choose option:"

      • [1] Use same name (republish)

      • [2] Enter another name

    4. If name available: Proceed with new name

    5. Keep checking until user chooses available name or decides to republish existing

  2. Final publication

  • Call publish_rule() with confirmed name

  • Inform user: "Published successfully" or "Publication failed"

  1. Rule Association:

    • Publishes the rule to make it available for control attachment

    • Ask user: "Do you want to attach this rule to a ComplianceCow control? (yes/no)"

    • If yes: Proceed to associate the rule with control and request assessment name and control alias from the user

    • If no: End workflow

EXECUTION CONTROL MECHANISMS:

  • STEP GATE: Each step requires completion before next

  • USER GATE: Each step requires user input/confirmation

  • EXECUTION BLOCKER: No tool calls without user response

  • WORKFLOW ENFORCER: Steps cannot be skipped or assumed

  • SEQUENTIAL LOCK: Must complete in exact order

Args: rule_name: Name of the rule to publish cc_rule_name: Optional alternative name for publishing

Returns: Dict with publication status and details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
cc_rule_nameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It transparently discloses the multi-step orchestration, user gating, and execution blockers. However, it does not explicitly warn about destructive side-effects of publishing, only implies caution via status checks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is excessively long and repetitive, with multiple identical cautions and blockages. While structured, it could be condensed significantly without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is very thorough about the procedural workflow, but it lacks a precise output schema (just 'Dict with publication status and details') and does not cover error handling scenarios. Given the complexity, this is a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It explains rule_name as the primary name and cc_rule_name as an optional alternative, with detailed logic for alternative name handling in step 6. Adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it publishes a rule to make it available for ComplianceCow, which is clear. It distinguishes from siblings by including a multi-step workflow that calls other tools, but the composite nature blurs the tool's specific action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (after successful rule creation, rule tested) and mandates checking rule status first. Provides step-by-step workflow with alternatives (e.g., handle existing name) and enforces user interaction, making usage guidance very strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

schedule_asset_executionA

Schedule automated execution for a asset.

IMPORTANT WORKFLOW & SAFETY RULES:

  • User inputs (runPrefixName, cronTab) are mandatory and cannot be bypassed or assumed.

  • The cronTab string MUST be constructed explicitly from the user's schedule instructions (e.g., frequency, time-of-day, timezone). Never auto-generate it without user confirmation.

  • controlPeriod MUST be one of the supported values.

  • controlDuration MUST be a positive integer provided by the user. Args:

    • assetId (str): Id of the asset to be scheduled.

    • runPrefixName (str): Human-readable name/prefix for this scheduled run.

    • description (str): Description for the scheduled run.

    • cronTab (str): Full cron expression including timezone (e.g. TZ=Asia/Calcutta 0 0 * * *), explicitly provided/confirmed by the user. Must not be assumed or defaulted.

    • controlPeriod (str): Control period for the assessment run, type selected by the user. Allowed values: - DAY → Last few days - WEEK → Last few weeks - MONTH → Last few months - CAL_WEEK → Last few calendar weeks - CAL_MONTH → Last few calendar months

    • controlDuration (int): Duration count for the selected control period Returns:

    • success (bool): Indicates if the schedule was created successfully.

    • scheduleId (str): ID of the created schedule (only present if successful).

    • error (Optional[str]): An error message if any issues occurred during creation.

ParametersJSON Schema
NameRequiredDescriptionDefault
assetIdYes
runPrefixNameYes
descriptionYes
cronTabYes
controlPeriodYes
controlDurationYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It covers the return values (success, scheduleId, error) but does not explain side effects (e.g., whether the schedule starts immediately, if it can overwrite existing schedules, or if validation occurs). The input constraints are detailed, but behavioral aspects are lacking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a header, bullet points, and a clear args list. It is somewhat repetitive (cronTab requirements appear twice) and could be more concise, but the organization aids readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 required params, no annotations, output schema referenced), the description covers inputs and outputs well. It lacks edge-case behavior (e.g., duplicate schedules) and could elaborate on error scenarios, but overall provides sufficient context for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides detailed semantics for all 6 parameters, including examples (e.g., cronTab format with timezone), allowed values for controlPeriod, and type requirements. This fully clarifies the parameters beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Schedule automated execution for a asset'. It distinguishes itself from siblings like delete_asset_schedule and list_asset_schedules by focusing on creation. The purpose is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes a dedicated 'IMPORTANT WORKFLOW & SAFETY RULES' section that mandates user input and provides explicit instructions for constructing cronTab and selecting controlPeriod/controlDuration. However, it does not explicitly state when not to use this tool or mention alternatives like delete_asset_schedule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

suggest_control_citationsA

Suggest control citations for a given control name or description.

WORKFLOW: When user provides a requirement, ask which assessment they want to use. Get assessment name from user, then resolve to assessmentId (mandatory). For control: offer two options - select from existing control on selected assessment OR create new control. If selecting existing control, get control name from user and resolve to controlId. If creating new control, controlId will be empty.

This function provides suggestions for control citations based on control names or descriptions. The user can select from the suggested controls to attach citations to their assessment controls.

Args: controlName (str): Name of control to get suggestions for (required). assessmentId (str): Assessment ID - resolved from assessment name (required). description (str, optional): Description of the control to get suggestions for. controlId (str, optional): Control ID - resolved from control name if selecting existing control, empty if creating new control.

Returns: Dict with success status and suggestions: - success (bool): Whether the request was successful - items (List[dict]): List of suggestion items, each containing: - inputControlName (str): The input control name - controlId (str): The control ID (empty if control doesn't exist yet) - suggestions (List[dict]): List of suggested controls, each containing: - Name (str): Control name - Control ID (int): Control ID number - Control Classification (str): Classification type - Impact Zone (str): Impact zone category - Control Requirement (str): Requirement level - Sort ID (str): Sort identifier - Control Type (str): Type of control - Score (float): Similarity score - authorityDocument (str): Name of the authorityDocument - error (str, optional): Error message if request failed

ParametersJSON Schema
NameRequiredDescriptionDefault
controlNameYes
descriptionYes
controlIdNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It explains the suggestion generation process and return structure, but could explicitly state that it is a read-only operation with no side effects. The mention of 'suggestions' implies non-mutating behavior, but direct declaration would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (WORKFLOW, Args, Returns). It is detailed but not excessively verbose. Minor redundancy exists (e.g., repeating the suggestion context), but overall it efficiently conveys the necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the description covers workflow, parameters, and return schema adequately. However, the omission of assessmentId from the input schema is a significant gap that undermines completeness. Error handling and permissions are not mentioned, but with output schema present, return values are sufficiently documented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains controlName and controlId well, but mentions assessmentId as mandatory despite it not being in the input schema. This inconsistency reduces clarity. The description adds value by describing the optional description parameter and the workflow, but the gap regarding assessmentId is notable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Suggest control citations for a given control name or description.' It also explains the workflow, differentiating it from sibling tools like fetch_controls by focusing on suggestions based on input. The verb 'suggest' and resource 'control citations' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit workflow guidance: 'When user provides a requirement, ask which assessment they want to use...' It details prerequisites (assessmentId resolution), two options (select existing or create new), and the role of each parameter. This fully informs when and how to use the tool vs alternatives like fetch_controls.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trigger_workflowA

Trigger a workflow by the given workflow config id.

Args: - workflowConfigId: The workflow config id - event: Start event name. - inputs: Additional input payload for the event. IMPORTANT: Input values must be obtained from the user only - do not pass random/placeholder values. Each field requires meaningful user-provided values. - confirm: If False, shows a preview of required inputs and does not execute. If True, executes.

Returns: - JSON string containing execution acknowledgement or error message

ParametersJSON Schema
NameRequiredDescriptionDefault
workflowConfigIdYes
eventYes
inputsNo
confirmNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses the execution behavior (confirm flag controls preview vs actual execution), return type (JSON string with acknowledge/error), and that inputs should come from the user. Does not cover potential side effects or permissions, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with 'Args' and 'Returns' sections, front-loads the main purpose, and every sentence adds value. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a trigger tool with no annotations and no output schema, the description covers parameters, behavior of confirm, and return value. Could mention prerequisites (e.g., valid workflow config id) or error conditions, but the main functionality is sufficiently documented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, yet description provides meaningful semantics for all 4 parameters: workflowConfigId (the id), event (start event name), inputs (additional payload with user-only constraint), confirm (preview vs execute). Adds critical usage instructions beyond schema structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('trigger'), the resource ('workflow by the given workflow config id'), and directly supports the tool's name. It distinguishes itself from sibling tools like list_workflows or create_workflow by specifying the exact trigger action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: 'Input values must be obtained from the user only - do not pass random/placeholder values.' Also explains the confirm parameter's behavior (preview vs execute). Does not explicitly contrast with alternatives like execute_rule, but the trigger context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_control_noteA

Update an existing documentation note on a control.

✅ PURPOSE This tool updates an existing note that was previously created on a control. It allows modification of the note content, topic, or both.

✅ CONFIRMATION-BASED SAFETY FLOW

  • When confirm=False: → The tool returns a PREVIEW of the updated markdown note. → The user may edit the note before confirming.

  • When confirm=True: → The note is permanently updated and saved.

Args: controlId (str): The control ID where the note exists (required). noteId (str): The note ID to update (required). assessmentId (str): The assessment ID or asset ID that contains the control (required). notes (str): The updated documentation content in MARKDOWN format (required). topic (str, optional): Updated topic or subject of the note. confirm (bool, optional):
- False → Preview only (default, no persistence) - True → Update and permanently save the note

Returns: Dict with success status and note data: - success (bool): Whether the request was successful - message (str, optional): Success or error message - noteId (str, optional): Updated note ID - error (str, optional): Error message if request failed

ParametersJSON Schema
NameRequiredDescriptionDefault
controlIdYes
noteIdYes
assessmentIdYes
notesYes
topicYes
confirmNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must cover all behavioral traits. It discloses the preview vs. save behavior, the markdown format requirement, and the return structure. It is transparent but could mention potential error conditions (e.g., invalid IDs).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections, bullet points, and emoji highlights. It is slightly lengthy but every sentence adds value. The most critical information (purpose and safety flow) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, no annotations, and an output schema, the description covers the safety flow, parameter meanings, and return format. It is fairly comprehensive but could clarify error handling or preconditions (e.g., note existence). Still, it provides sufficient context for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description fully compensates by explaining each parameter in the Args section, including purpose, required status, and optional details (e.g., topic, confirm defaults). This adds significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states 'Update an existing documentation note on a control.' It uses a specific verb ('update'), identifies the resource ('documentation note on a control'), and clearly distinguishes from sibling tools like 'create_control_note' and 'list_control_notes.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on the confirm parameter, explaining when to use preview vs. permanent save. It also describes a 'confirmation-based safety flow.' However, it does not explicitly mention when not to use this tool or suggest alternative tools for related tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_rule_readmeA

Update existing README.md file with new content.

README UPDATE:

This tool updates an existing README.md file with new content. Useful for making changes after initial creation or updating documentation as rules evolve.

Args: rule_name: Name of the rule for which to update README updated_readme_content: Updated README.md content as string

Returns: Dict containing README update status and details

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
updated_readme_contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It notes the tool updates a file and returns a dict with status, but does not disclose whether it overwrites entirely, appends, or what happens if the README does not exist (it says 'update existing', implying failure if missing).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise but includes a redundant header 'README UPDATE:' and repeats itself somewhat. It has a clear structure with an Args section, but could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, no nesting), the description covers purpose, parameters, and return, and references an output schema. It misses error scenarios and prerequisites, but is largely complete for typical usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description is the sole source for parameter meaning. It provides clear names and types for both parameters: 'rule_name: Name of the rule...' and 'updated_readme_content: Updated README.md content as string', adding value beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('update') and resource ('existing README.md file'), and distinguishes from the sibling tool 'create_rule_readme' by specifying 'update existing' and mentioning it is for making changes after initial creation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for updating an existing README (as opposed to creating), which is reinforced by the sibling tool 'create_rule_readme'. However, it does not explicitly state when not to use it or list prerequisites like the README must already exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_workflow_mermaid_diagramC

Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output - mermaidDiagram (str): workflow mermaid diagram

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
mermaidDiagramYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavioral disclosure. It only lists arguments and hints at id source, but fails to mention if the update is destructive, whether it overwrites the entire diagram, any side effects on related data, or the return value. The presence of an output schema is not referenced.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short, using a compact 'Args:' format. It efficiently conveys the parameter explanations in two lines. However, it lacks a proper sentence or introductory phrase that states what the tool does.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 required parameters and no annotations, the description is inadequate. It does not state the tool's purpose explicitly, describe return values, or indicate any behavioral constraints. The output schema exists but is unmentioned, leaving the agent without complete context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning: id is 'workflow id' and can be fetched from get_workflows output; mermaidDiagram is 'workflow mermaid diagram'. This goes beyond the property names but lacks constraints like format, allowed values, or examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The tool name 'update_workflow_mermaid_diagram' clearly indicates the action, and the description lists the parameters with explanations (id is workflow id, mermaidDiagram is the diagram). However, it does not explicitly state 'Updates the mermaid diagram of a workflow' or differentiate from sibling tools like modify_workflow, so clarity is good but not perfect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a specific usage hint: the id can be fetched from the output of get_workflows. This guides the agent on how to obtain the required id. However, it does not mention when to use this tool over alternatives (e.g., modify_workflow) or any prerequisites or conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_workflow_summaryC

Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output - summary (str): workflow summary, preferably ReadMe.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
summaryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only states it 'updates' the summary but does not mention side effects, overwrite behavior, required permissions, error handling, or what happens if the id is invalid. This is insufficient for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief, listing the two parameters with a short explanation each. It is front-loaded and wastes no words. However, the structure reads like a code comment rather than natural language, which could be improved.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the large number of sibling tools, the description does not provide sufficient context for an agent to choose this tool over similar ones like 'modify_workflow'. It also fails to mention the output schema or describe the update behavior, leaving the tool's effect underdefined.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must add meaning. It explains that 'id' can be fetched from a specific path, and 'summary' is 'preferably ReadMe'. This adds value beyond the bare schema but lacks detail on format or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description indicates that the tool updates a workflow summary by specifying the id and summary parameters. It is clear that it targets a specific field, differentiating it from sibling tools like 'modify_workflow' which likely updates the entire workflow. However, it could be more explicit about the action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as 'modify_workflow'. It does not specify context, prerequisites, or when not to use it, leaving the agent without selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_evidenceA

Upload evidence file to ComplianceCow assessment run control

Purpose: Create evidence in an executed assessment run by attaching a file

Args:

  • runId (str): Assessment run(aka Plan instance) ID from the executed assessment run

  • runControlId (str): Leaf control ID in the Assessment run where evidence will be attached

  • filePath (str, optional): Full file system path to the evidence file to upload

  • fileBytes (str, optional): Base64 encoded file content

  • fileName (str, optional): Name of the file when using fileBytes

Returns:

  • str: Success message with evidence ID, or error message

Note: Either provide filePath OR both fileBytes and fileName must be provided.

ParametersJSON Schema
NameRequiredDescriptionDefault
runIdYes
runControlIdYes
filePathNo
fileBytesNo
fileNameNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description discloses the return (success message with evidence ID or error) and the file provision options. However, it fails to specify side effects (e.g., overwrite behavior), permissions needed, file constraints (size, format), or behavior when both filePath and fileBytes are provided. This is adequate but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a title, Purpose, Args, Returns, and Note sections. Each sentence is relevant and concise, with no redundancy or fluff. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 params, file upload) and the presence of sibling upload_file, the description provides enough context for correct invocation, including parameter alternatives and return format. It lacks details like size limits or duplicate handling, but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds meaning by explaining each parameter's role and the logical grouping of filePath vs fileBytes+fileName. It does not specify formats for runId/runControlId, but the mutual exclusivity note adds significant value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Upload evidence file to ComplianceCow assessment run control' and 'Create evidence in an executed assessment run by attaching a file', specifying the verb (upload/create), resource (evidence on assessment run control), and context. It distinguishes from sibling 'upload_file' by its specific purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on required parameters (runId, runControlId) and the mutual exclusivity of filePath vs fileBytes+fileName via the note. However, it does not explicitly state when to use this tool over the sibling 'upload_file', which could be clarified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_fileA

Upload file content and return file URL for use in rules.

ENHANCED FILE UPLOAD PROCESS:

  • Automatically detects file format from filename and content

  • Validates and fixes common formatting issues for JSON, YAML, TOML, CSV, XML

  • Accepts JSON arrays in various formats: raw, single-line, multi-line, or escaped (auto-formatted).

  • Normalizes CSV delimiters and whitespace

  • Reformats content with proper indentation/structure

  • No user preview required - validation happens automatically

  • Returns detailed validation results and file URL

SUPPORTED INPUT FORMATS:

  • Raw JSON: {"key": "value"} or [{"key": "value"}]

  • Escaped JSON: "{"key": "value"}"

  • Complex escaped: "[{"repository":"name","owner":"org"}]"

  • Standard strings for other formats (YAML, TOML, CSV, XML)

AUTOMATIC FORMAT PROCESSING:

  • JSON: Detects escaped strings, unescapes, validates syntax, reformats with indentation

  • Raw JSON objects/arrays: Automatically converts to proper JSON string format

  • YAML: Validates structure, reformats with proper indentation

  • TOML: Validates sections and key-value pairs, reformats

  • CSV: Detects delimiter, strips cell whitespace, normalizes format

  • XML: Validates well-formed structure

  • Other formats: Pass through as-is

VALIDATION RESULTS:

  • Returns success/failure status with detailed error messages

  • Provides format-specific validation feedback

  • Indicates if content was automatically reformatted

  • Includes file metadata (size, format, etc.)

Args: rule_name: Descriptive name for the rule (same across all rule inputs) file_name: Name of the file to upload
content: File content (text or base64 encoded) CRITICAL: Must be stringified if JSON content
content_encoding: Encoding of the content (utf-8, base64)

Returns: Dict containing upload results: { success: bool, file_url: str, filename: str, unique_filename: str, file_id: str, file_format: str, content_size: int, validation_status: str, was_formatted: bool, message: str, error: Optional[str] }

ParametersJSON Schema
NameRequiredDescriptionDefault
rule_nameYes
file_nameYes
contentYes
content_encodingNoutf-8

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries full burden. It details automatic format detection, validation, reformatting, and return of validation results. It also mentions no user preview is required, providing useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long with bullet points and sections, which is well-structured but verbose. Some content could be condensed, but the structure aids scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all aspects: input parameters, supported formats, automatic processing, validation results, and output structure (including the return dict). Given the complexity, it is thorough and leaves no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description's Args section adds critical meaning: rule_name context, content encoding instructions, and the critical note that JSON must be stringified. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool uploads file content and returns a URL for use in rules, with a specific verb and resource. It distinguishes the tool as an enhanced file upload with auto-detection and validation, which is distinct from simpler uploads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the tool is for use in rules but does not explicitly state when to use it over alternatives like upload_evidence. It lacks exclusions or context about prerequisites, leaving usage partially implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_collected_inputsA

Verify all collected inputs with user before rule creation.

MANDATORY VERIFICATION STEP (Enhanced):

This tool MUST be called after all inputs are collected but before final rule completion. It presents a comprehensive summary of all collected inputs for user verification.

ENHANCED WITH AUTOMATIC RULE FINALIZATION: After user confirms verification, this tool can automatically finalize the rule by:

  1. Building complete I/O mapping based on task sequence and inputs

  2. Adding mandatory compliance outputs

  3. Setting rule status to ACTIVE

  4. Completing the rule creation process

HANDLES DUPLICATE INPUT NAMES WITH TASK ALIASES (Preserved):

  • Uses unique identifiers (TaskAlias.InputName) for each input

  • Properly maps each unique input to its specific task alias

  • Creates structured inputs for rule creation with unique names when needed

  • Maintains clear separation between inputs from different task instances

VERIFICATION REQUIREMENTS (Preserved):

  1. Show complete summary of ALL collected inputs with unique IDs

  2. Display both template files and parameter values

  3. Show file URLs for uploaded templates

  4. Present clear verification checklist

  5. Get explicit user confirmation

  6. Allow user to modify values if needed

  7. Prepare inputs for rule structure creation with proper task alias mapping

  8. NEW: Automatically finalize rule after user confirmation

VERIFICATION PRESENTATION FORMAT (Preserved): "INPUT VERIFICATION SUMMARY:

Please review all collected inputs before rule creation:

TEMPLATE INPUTS (Uploaded Files): ✓ Task Input: [TaskAlias.InputName] Task: [TaskAlias] ([TaskName]) → Input: [InputName] Format: [Format] File: [filename] URL: [file_url] Size: [file_size] bytes Status: ✓ Validated

PARAMETER INPUTS (Values): ✓ Task Input: [TaskAlias.InputName] Task: [TaskAlias] ([TaskName]) → Input: [InputName] Type: [DataType] Value: [user_value] Required: [Yes/No] Status: ✓ Set

VERIFICATION CHECKLIST: □ All required inputs collected □ Template files uploaded and validated □ Parameter values set and confirmed □ No missing or invalid inputs □ Ready for rule creation

Are all these inputs correct?

  • Type 'yes' to proceed with rule creation

  • Type 'modify [TaskAlias.InputName]' to change a specific input

  • Type 'cancel' to abort rule creation"

CRITICAL VERIFICATION RULES (Enhanced):

  • NEVER proceed to final rule creation without user verification

  • ALWAYS show complete input summary with unique identifiers

  • ALWAYS get explicit user confirmation

  • Allow input modifications using unique IDs

  • Validate completeness before approval

  • Prepare structured inputs for rule creation with proper task mapping

  • NEW: Automatically finalize rule with I/O mapping after confirmation

Args: collected_inputs: Dict containing all collected template files and parameter values with unique IDs

Returns: Dict containing verification status, user confirmation, and structured inputs for rule finalization

ParametersJSON Schema
NameRequiredDescriptionDefault
collected_inputsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description provides full behavioral transparency: it details automatic rule finalization, handling of duplicate names, verification format, and side effects (building I/O mapping, setting status to ACTIVE). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and repetitive with multiple sections (e.g., 'ENHANCED WITH AUTOMATIC RULE FINALIZATION' repeated). However, it is well-structured with headings and bullet points, aiding readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low schema coverage and no annotations, the description fully covers the tool's purpose, usage, behavior, parameter semantics, and return value (mentioning verification status and structured inputs). The presence of an output schema supports completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% coverage, but the description compensates by explaining the 'collected_inputs' parameter as a dict containing all collected files and values, and provides a detailed presentation format showing expected fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is for verifying collected inputs with the user before rule creation. It specifies the action (verify) and the resource (collected inputs), distinguishing it from siblings like collect_parameter_input and create_rule.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states it is a mandatory step after input collection and before rule finalization. It provides requirements, a format, and rules (e.g., 'NEVER proceed without user verification'), giving clear when-to-use and process guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_control_automationA

Verify if a control is automated or not based on the presence of ruleId. If ruleId exists, fetch and return basic rule information.

Args: control_id: The ID of the control to verify

Returns: Dictionary containing automation status and rule details if automated

ParametersJSON Schema
NameRequiredDescriptionDefault
control_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries the full burden. It explains the logic: check ruleId, fetch info if automated. However, it does not specify what 'basic rule information' includes or what happens when ruleId is absent, leaving some behavior ambiguous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with no unnecessary words, and uses a clear Args/Returns structure that aids readability. Every sentence contributes to understanding the tool's purpose and usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and an output schema, the description covers the core logic adequately. It could mention the case when ruleId is missing, but the output schema likely handles that, making the description sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to the lone parameter 'control_id' by stating it is the ID of the control to verify, overcoming the 0% schema coverage. This provides context beyond the schema's type-only indication.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool verifies automation status of a control by checking ruleId presence. It uses specific verbs ('verify', 'fetch') and resource ('control automation'), and distinguishes itself from sibling tools like 'fetch_rule' or 'attach_rule_to_control' by focusing on the automation check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking automation status, but does not explicitly state when to use this tool versus alternatives. No mention of prerequisites or when not to use it, leaving the agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_control_in_assessmentA

Verify the existence of a specific control by alias within an assessment and confirm it is a leaf control.

CONTROL VERIFICATION AND VALIDATION:

  • Confirms the control with the specified alias exists in the given assessment.

  • Validates that the control is a leaf control (eligible for rule attachment).

  • Checks if a rule is already attached to the control.

  • Returns control details and attachment status.

LEAF CONTROL IDENTIFICATION:

  • A control is considered a leaf control if:

  • leafControl = true, OR

  • has no planControls array, OR

  • planControls array is empty.

  • Only leaf controls can have rules attached.

  • If the control is not a leaf control, an error will be returned.

Args: assessment_name: Name of the assessment. control_alias: Alias of the control to verify.

Returns: Dict containing control details, leaf status, and rule attachment info.

ParametersJSON Schema
NameRequiredDescriptionDefault
assessment_nameYes
control_aliasYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the burden. It details that the tool confirms existence, validates leaf status (with specific conditions), checks if a rule is attached, and returns details. It also discloses that non-leaf controls cause an error. This is transparent and goes beyond the basic function.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into sections with bullet points, but it is somewhat verbose. The leaf control identification details could be condensed. The main purpose is front-loaded, but the extra details could be trimmed without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema, the description adequately explains what it does, what parameters are required, and what is returned (control details, leaf status, rule attachment info). It covers key behavioral aspects, though it could mention the error case for non-existent controls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides one-line descriptions for both parameters ('Name of the assessment' and 'Alias of the control to verify'), which adds meaning but is minimal. No additional constraints, examples, or format details are given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Verify the existence of a specific control by alias within an assessment and confirm it is a leaf control.' It lists specific sub-steps (confirms existence, validates leaf status, checks rule attachment) and distinguishes this from sibling tools like 'fetch_leaf_controls_of_an_assessment' (lists all leaf controls) and 'attach_rule_to_control' (attaches rules).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage before attaching rules ('Only leaf controls can have rules attached') but does not explicitly state when to use this tool versus alternatives like fetch_controls or fetch_leaf_controls_of_an_assessment. No direct comparison or triage guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 30 tool updatesv0.1.1
    • Changedcreate_workflow1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedcreate_workflow_custom_event1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedfetch_cc_rules_list1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Removedfetch_rule_readme
    • Addedfetch_rule_readme_documentaion
    • Changedfetch_workflow_details1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedfetch_workflow_resource_data1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedget_rules_summary1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedget_tasks_summary1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedget_workflow_by_name1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedhelp1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedlist_all_assessment_categories4 fields changed
      • addedOutput schema / $defs / CategoryVO / properties / id / default
        Added value: +""
      • addedOutput schema / $defs / CategoryVO / properties / name / default
        Added value: +""
      • removedOutput schema / $defs / CategoryVO / required
        Removed value: -[
        -  "id",
        -  "name"
        -]
      • changedOutput schema / properties / error / default
        Previous value: -""New value: +null
    • Addedlist_all_assessments
    • Addedlist_all_assets
    • Removedlist_assessments
    • Removedlist_assets
    • Addedlist_assets_cc
    • Changedlist_workflow_activity_types1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedlist_workflows1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedmodify_workflow1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Removedread_file
    • Removedread_resource
    • Addedsuggest_control_citations
    • Removedsuggest_control_config_citations
    • Changedtrigger_workflow1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Removedupdate_control_config_note
    • Addedupdate_control_note
    • Changedupdate_workflow_mermaid_diagram1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Changedupdate_workflow_summary1 field changed
      • addedOutput schema / description
        Added value: +"Generic wrapper for non-object return types."
    • Addedupload_evidence
  2. 118 tool updatesv0.1.0
    • First observedadd_check_to_asset
    • First observedadd_citation_to_asset_control
    • First observedadd_unique_identifier_to_task
    • First observedattach_rule_to_control
    • First observedcheck_applications_publish_status
    • First observedcheck_rule_publish_status
    • First observedcheck_rule_status
    • First observedcollect_parameter_input
    • First observedcollect_template_input
    • First observedconfigure_rule_output_schema
    • First observedconfirm_parameter_input
    • First observedconfirm_template_input
    • First observedcreate_asset_and_check
    • First observedcreate_control_note
    • First observedcreate_design_notes
    • First observedcreate_rule
    • First observedcreate_rule_readme
    • First observedcreate_support_ticket
    • First observedcreate_workflow
    • First observedcreate_workflow_custom_event
    • First observeddelete_asset_schedule
    • First observedexecute_action
    • First observedexecute_cypher_query
    • First observedexecute_rule
    • First observedexecute_task
    • First observedfetch_applications
    • First observedfetch_assessment_available_actions
    • First observedfetch_assessment_run_details
    • First observedfetch_assessment_run_leaf_control_evidence
    • First observedfetch_assessment_run_leaf_controls
    • First observedfetch_assessment_runs
    • First observedfetch_assessments
    • First observedfetch_assets_summary
    • First observedfetch_automated_controls_of_an_assessment
    • First observedfetch_available_control_actions
    • First observedfetch_cc_rule_by_id
    • First observedfetch_cc_rule_by_name
    • First observedfetch_cc_rules_list
    • First observedfetch_checks
    • First observedfetch_checks_summary
    • First observedfetch_controls
    • First observedfetch_dashboard_framework_controls
    • First observedfetch_dashboard_framework_summary
    • First observedfetch_evidence_available_actions
    • First observedfetch_evidence_record_schema
    • First observedfetch_evidence_records
    • First observedfetch_execution_progress
    • First observedfetch_general_available_actions
    • First observedfetch_leaf_controls_of_an_assessment
    • First observedfetch_output_file
    • First observedfetch_recent_assessment_runs
    • First observedfetch_resource_types
    • First observedfetch_resources
    • First observedfetch_resources_by_check_name
    • First observedfetch_resources_by_check_name_summary
    • First observedfetch_resources_summary
    • First observedfetch_rule
    • First observedfetch_rule_design_notes
    • First observedfetch_rule_readme
    • First observedfetch_rules_suggestions
    • First observedfetch_run_control_meta_data
    • First observedfetch_run_controls
    • First observedfetch_task_readme
    • First observedfetch_unique_node_data_and_schema
    • First observedfetch_workflow_details
    • First observedfetch_workflow_resource_data
    • First observedfetch_workflow_rule
    • First observedgenerate_design_notes_preview
    • First observedgenerate_rule_readme_preview
    • First observedget_application_info
    • First observedget_applications_for_tag
    • First observedget_asset_control_hierarchy
    • First observedget_dashboard_common_controls_details
    • First observedget_dashboard_data
    • First observedget_dashboard_review_periods
    • First observedget_rules_summary
    • First observedget_task_details
    • First observedget_tasks_summary
    • First observedget_template_guidance
    • First observedget_top_non_compliant_controls_detail
    • First observedget_top_over_due_controls_detail
    • First observedget_workflow_by_name
    • First observedhelp
    • First observedlist_all_assessment_categories
    • First observedlist_assessments
    • First observedlist_asset_schedules
    • First observedlist_assets
    • First observedlist_checks
    • First observedlist_control_notes
    • First observedlist_workflow_activity_types
    • First observedlist_workflow_condition_categories
    • First observedlist_workflow_conditions
    • First observedlist_workflow_event_categories
    • First observedlist_workflow_events
    • First observedlist_workflow_function_categories
    • First observedlist_workflow_functions
    • First observedlist_workflow_predefined_variables
    • First observedlist_workflow_rules
    • First observedlist_workflow_tasks
    • First observedlist_workflows
    • First observedmodify_workflow
    • First observedprepare_applications_for_execution
    • First observedprepare_input_collection_overview
    • First observedpublish_application
    • First observedpublish_rule
    • First observedread_file
    • First observedread_resource
    • First observedschedule_asset_execution
    • First observedsuggest_control_config_citations
    • First observedtrigger_workflow
    • First observedupdate_control_config_note
    • First observedupdate_rule_readme
    • First observedupdate_workflow_mermaid_diagram
    • First observedupdate_workflow_summary
    • First observedupload_file
    • First observedverify_collected_inputs
    • First observedverify_control_automation
    • First observedverify_control_in_assessment

TDQS

C2.7/5.0

Scored across 118 tools

Disambiguation2/5

Many tools have overlapping purposes (e.g., multiple fetch rule, multiple create rule, multiple list assessment tools) making it difficult for an agent to select the correct one. Long descriptions with embedded workflows further blur boundaries.

Naming Consistency3/5

Most tools use snake_case, but verbs vary widely (add, attach, check, collect, configure, create, delete, execute, fetch, get, list, modify, prepare, publish, schedule, suggest, trigger, update, upload, verify) without a consistent pattern. Some tools have very long names.

Tool Count1/5

118 tools is excessive for a single MCP server. This indicates poor scoping and likely many overlapping or unnecessary tools, overwhelming the agent and user.

Completeness3/5

The tool set covers a broad range of compliance management functions (assets, rules, workflows, evidence, reporting). However, there are notable gaps (no delete rule, limited update tools) and the domain is not comprehensively covered given the large number of tools.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Connects AI agents with the CrowdStrike Falcon platform to enable intelligent security analysis, providing programmatic access to detections, incidents, threat intelligence, vulnerabilities, and other security capabilities for advanced security operations and automation.
    250
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to query software supply chain compliance data, including asset status, security vulnerabilities, and evidence lineage. It allows for natural language analysis of compliance posture, policy violations, and deployment blockers across an organization.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables authorized compliance verification and security auditing through natural language, bridging AI assistants with industry-standard security tools for enterprise audits.
    24
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Connects AI agents with the CrowdStrike Falcon platform to programmatically access detections, threat intelligence, host management, and other security capabilities for intelligent security analysis and automation.
    MIT