ComplianceCow MCP Server
Enables compliance checks and resource monitoring for GitHub repositories to ensure adherence to security standards and internal policies.
Supports automated remediation by creating Jira tickets for non-compliant resources or security vulnerabilities identified during assessments.
Allows for the verification of compliance and security controls within Kubernetes clusters and associated resources.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ComplianceCow MCP ServerShow me the compliance dashboard for PCI DSS 4.0"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ComplianceCow MCP Servers
Table of Contents
Related MCP server: Fianu Compliance Intelligence MCP Server
Introduction
MCP (Model Context Protocol) servers are designed to process structured requests from AI agents, perform domain-specific operations, and return context-aware responses. The ComplianceCow MCP servers enable seamless integration with MCP-compatible hosts like Claude Desktop and Goose Desktop/CLI for secure, modular, and intelligent compliance automation.
Glossary
Keyword | Description | Example |
Control | A compliance or security control that needs to be implemented to ensure adherence to regulations, standards, and policies | Ensure MFA is enabled for all users |
Assessment | A collection of controls organized hierarchically, representing an industry standard or cybersecurity framework | PCI DSS 4.0 |
Assessment Run | The verification of controls in an assessment for a given time period, including evidence collection | - |
Check | A rule or verification for compliance or conformance | Check if MFA is enabled for all AWS users |
Resource Type | Category or class of resources | AWS EC2, AWS S3 |
Resource | Instance of a resource type for which checks are performed | Specific EC2 instances, GitHub repositories |
Asset | A group of resources of various types | AWS services, Kubernetes, GitHub |
Evidence | Data aggregated through checks against resources for a given control | CSV file with AWS users and their MFA status |
Action | Activity (automated or manual) to respond or remediate based on conditions | Create a JIRA ticket for non-compliant EC2 instance |
Rule | A reusable automation unit that executes tasks and generates evidence | AWS MFA Compliance Check Rule |
Workflow | An event-driven automation sequence with conditions and activities | Alert workflow on critical finding |
Architecture
The ComplianceCow MCP servers support the STDIO transport mechanism for seamless local integration with your MCP host. At the core is the Compliance Graph, which continuously ingests data such as assessment runs, evidence, and compliance status. The server actively pulls information from:
Vector stores for semantic search
Relational databases for structured data
Graph databases for relationship queries
File storage systems for evidence artifacts
MCP Servers
We have organized ComplianceCow’s MCP tools into 4 distinct servers.
Why multiple MCP servers? In the MCP ecosystem, using fewer tools per server yields better results and better performance. Each server can be enabled independently via the
MCP_TOOLS_TO_BE_INCLUDEDenvironment variable. Important: Enable only one server at a time in the MCP Host to avoid tool name conflicts. Some tools share the same name across servers but have different implementations based on the use case.
1. ComplianceCow-Rules
The Rules server enables creating, managing, and executing compliance rules. It provides a comprehensive toolkit for rule creation with guided input collection, task orchestration, and ComplianceCow integration.
Use Cases:
Create custom compliance rules with multiple tasks
Execute rules against cloud infrastructure
Publish rules to ComplianceCow and attach to controls
Generate rule documentation (design notes, README)
2. ComplianceCow-Insights
The Insights server provides comprehensive access to compliance data, dashboards, assessments, and evidence through the Compliance Graph. Ideal for querying and analyzing compliance posture.
Use Cases:
Query dashboard data for compliance overview
Explore assessments and their runs
Retrieve evidence and compliance status
Execute Cypher queries on the Compliance Graph
Perform actions on controls and evidence
3. ComplianceCow-Workflow
The Workflow server enables building and executing automated compliance workflows with event-driven triggers, conditions, and activities.
Use Cases:
Create automated compliance workflows
Define event triggers and conditions
Execute multi-step workflow sequences
Manage workflow states and transitions
4. ComplianceCow-Assistant
The Assistant server specializes in assessment configuration, control setup, and SQL-based evidence collection. It provides tools for configuring compliance assessments and managing control evidence.
Use Cases:
Create and configure assessments
Set up control configurations with context entities
Create SQL-based evidence collection
Manage control citations and documentation
Getting Started
Prerequisites
MCP Host: You need an MCP-compatible host:
Python: Version 3.11 or higher
uv Package Manager: Required to run the MCP server
Authentication
The ComplianceCow MCP servers use OAuth 2.0 with client_credentials grant type.
To obtain credentials:
Sign up at ComplianceCow (or your dedicated instance)
Click "Manage Client Credentials" in the top-right user profile menu
Fill out the form to obtain your Client ID and Client Secret
Installation
Clone the repository:
git clone https://github.com/ComplianceCow/cow-mcp.git cd cow-mcpCreate virtual environment and install dependencies:
uv venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate uv pip install .Find your uv binary path (needed for configuration):
which uv # On macOS/Linux where uv # On Windows
Configuration
Environment Variables
Variable | Description | Required |
| ComplianceCow API host URL (Ex: https://partner.compliancecow.live) | Yes |
| Your Client ID (see Authentication section above) | Yes |
| Your Client Secret (see Authentication section above) | Yes |
MCP Host Setup
Claude Desktop
Configuration file location:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
For detailed setup instructions, see Claude Desktop MCP Setup.
Configuration template for all 4 servers:
{
"mcpServers": {
"ComplianceCow-Rules": {
"command": "<UV_BIN_PATH>",
"args": [
"--directory",
"<PATH_TO_COW_MCP_REPO>",
"run",
"main.py"
],
"env": {
"CCOW_HOST": "<YOUR_CCOW_HOST>",
"CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
"CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
"MCP_TOOLS_TO_BE_INCLUDED": "rules"
}
},
"ComplianceCow-Insights": {
"command": "<UV_BIN_PATH>",
"args": [
"--directory",
"<PATH_TO_COW_MCP_REPO>",
"run",
"main.py"
],
"env": {
"CCOW_HOST": "<YOUR_CCOW_HOST>",
"CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
"CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
"MCP_TOOLS_TO_BE_INCLUDED": "insights"
}
},
"ComplianceCow-Workflow": {
"command": "<UV_BIN_PATH>",
"args": [
"--directory",
"<PATH_TO_COW_MCP_REPO>",
"run",
"main.py"
],
"env": {
"CCOW_HOST": "<YOUR_CCOW_HOST>",
"CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
"CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
"MCP_TOOLS_TO_BE_INCLUDED": "workflow"
}
},
"ComplianceCow-Assistant": {
"command": "<UV_BIN_PATH>",
"args": [
"--directory",
"<PATH_TO_COW_MCP_REPO>",
"run",
"main.py"
],
"env": {
"CCOW_HOST": "<YOUR_CCOW_HOST>",
"CCOW_CLIENT_ID": "<YOUR_CLIENT_ID>",
"CCOW_CLIENT_SECRET": "<YOUR_CLIENT_SECRET>",
"MCP_TOOLS_TO_BE_INCLUDED": "assistant"
}
}
}
}Replace the following placeholders:
UV_BIN_PATH: Path to your uv binary (e.g.,/Users/username/.local/bin/uv). You can find this by runningwhich uv(macOS/Linux) orwhere uv(Windows).PATH_TO_COW_MCP_REPO: The absolute path to your cloned cow-mcp repository. After cloning and runningcd cow-mcp, usepwd(macOS/Linux) orcd(Windows) to get this path.YOUR_CCOW_HOST: https://partner.compliancecow.live (or <your_dedicated_instance_hosturl>)YOUR_CLIENT_ID: Your ComplianceCow Client ID (see Authentication)YOUR_CLIENT_SECRET: Your ComplianceCow Client Secret (see Authentication)
Goose Desktop/CLI
For detailed setup instructions, see Goose Extensions Documentation.
Configuration file location:
macOS/Linux:
~/.config/goose/config.yamlWindows:
%APPDATA%\goose\config.yaml
Configuration template for all 4 servers:
extensions:
ComplianceCow-Rules:
enabled: true
type: stdio
name: Compliancecow-Rules
description: 'ComplianceCow Rules - Create and manage compliance rules'
cmd: <UV_BIN_PATH>
args:
- --directory
- <PATH_TO_COW_MCP_REPO>
- run
- main.py
envs:
CCOW_HOST: <YOUR_CCOW_HOST>
CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
MCP_TOOLS_TO_BE_INCLUDED: rules
timeout: 300
ComplianceCow-Insights:
enabled: true
type: stdio
name: Compliancecow-Insights
description: 'ComplianceCow Insights - Query compliance data and dashboards'
cmd: <UV_BIN_PATH>
args:
- --directory
- <PATH_TO_COW_MCP_REPO>
- run
- main.py
envs:
CCOW_HOST: <YOUR_CCOW_HOST>
CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
MCP_TOOLS_TO_BE_INCLUDED: insights
timeout: 300
ComplianceCow-Workflow:
enabled: true
type: stdio
name: Compliancecow-Workflow
description: 'ComplianceCow Workflow - Build and execute compliance workflows'
cmd: <UV_BIN_PATH>
args:
- --directory
- <PATH_TO_COW_MCP_REPO>
- run
- main.py
envs:
CCOW_HOST: <YOUR_CCOW_HOST>
CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
MCP_TOOLS_TO_BE_INCLUDED: workflow
timeout: 300
ComplianceCow-Assistant:
enabled: true
type: stdio
name: Compliancecow-Assistant
description: 'ComplianceCow Assistant - Configure assessments and controls'
cmd: <UV_BIN_PATH>
args:
- --directory
- <PATH_TO_COW_MCP_REPO>
- run
- main.py
envs:
CCOW_HOST: <YOUR_CCOW_HOST>
CCOW_CLIENT_ID: <YOUR_CLIENT_ID>
CCOW_CLIENT_SECRET: <YOUR_CLIENT_SECRET>
MCP_TOOLS_TO_BE_INCLUDED: assistant
timeout: 300Replace the following placeholders:
UV_BIN_PATH: Path to your uv binary (e.g.,/Users/username/.local/bin/uv). You can find this by runningwhich uv(macOS/Linux) orwhere uv(Windows).PATH_TO_COW_MCP_REPO: The absolute path to your cloned cow-mcp repository. After cloning and runningcd cow-mcp, usepwd(macOS/Linux) orcd(Windows) to get this path.YOUR_CCOW_HOST: https://partner.compliancecow.live (or <your_dedicated_instance_hosturl>)YOUR_CLIENT_ID: Your ComplianceCow Client ID (see Authentication)YOUR_CLIENT_SECRET: Your ComplianceCow Client Secret (see Authentication)
Running Locally
To verify the MCP server is properly set up before configuring your MCP host:
# Navigate to the cow-mcp directory
cd /path/to/cow-mcp
# Set required environment variables
export CCOW_HOST="https://partner.compliancecow.live"
export CCOW_CLIENT_ID="<your_client_id>"
export CCOW_CLIENT_SECRET="<your_client_secret>"
export MCP_TOOLS_TO_BE_INCLUDED="rules" # or insights, workflow, assistant
# Run the server
uv run main.pyIf the server starts without errors, you're ready to configure your MCP host.
Tools Reference
Rules Server Tools
Tool | Description |
Retrieve available tasks for rule creation | |
Get detailed task information including inputs/outputs | |
Intelligent task suggestions based on requirements | |
List all available rules in the catalog | |
Suggest matching rules to avoid duplicates | |
Create a new rule with tasks and I/O mapping | |
Retrieve complete rule structure by name | |
Check rule completion level | |
Overview of required inputs before collection | |
Guidance for template-based inputs | |
Collect file/template inputs with validation | |
Confirm and process template input | |
Collect primitive parameter values | |
Confirm and store parameter values | |
Upload files with format validation | |
Verify all inputs before execution | |
Execute a specific task with collected inputs | |
Execute complete rule with credentials | |
Monitor live execution progress | |
Fetch output files from execution | |
Fetch rule from ComplianceCow by ID | |
Fetch rule from ComplianceCow by name | |
List published ComplianceCow rules | |
Publish rule to ComplianceCow | |
Retrieve available assessments | |
Fetch attachable controls from assessment | |
Verify control is attachable | |
Attach published rule to control | |
Get applications for specific tag | |
Get application details and credential types | |
Fetch all available applications | |
Prepare application configuration | |
Check application publication status | |
Publish applications for rule execution | |
Add unique identifier to task | |
Configure standard/extended output schema | |
Generate Jupyter notebook design notes | |
Save design notes | |
Fetch existing design notes | |
Generate comprehensive README | |
Save README | |
Update existing README | |
List integration plans/assets | |
List checks for an asset | |
Get control hierarchy for asset | |
Create asset with initial check | |
Add check to existing asset | |
Schedule automated asset execution | |
List schedules for an asset | |
Delete asset schedule | |
Suggest control citations | |
Attach citation to control | |
Verify control automation status | |
Create documentation note on control | |
List control notes | |
Update control note | |
Create support tickets | |
Check rule publication status | |
Read local file content | |
Read resource URI content | |
Create downloadable file URL |
Insights Server Tools
Tool | Description |
List all assessment categories | |
List assessments by category/name | |
Fetch recent assessment runs | |
Fetch runs with pagination | |
Get control details from run | |
Get leaf controls from run | |
Get controls by name | |
Get control metadata | |
Get evidence for controls | |
Fetch control information | |
Get evidence records with filtering | |
Get evidence schema | |
Fetch available control actions | |
Fetch assessment actions | |
Fetch evidence actions | |
Fetch general actions | |
Fetch automated controls | |
Execute action on control/evidence | |
List all assets | |
Get asset summary statistics | |
Get resource types with pagination | |
Get checks for resource type | |
Get resources with pagination | |
Get resources by check name | |
Get checks summary statistics | |
Get resources summary statistics | |
Get resources summary by check | |
Get resource types summary | |
Get available review periods | |
Get comprehensive dashboard data | |
Get framework controls | |
Get framework summary | |
Get common control details | |
Get top overdue controls | |
Get top non-compliant controls | |
Fetch graph node data and schema | |
Execute Cypher query on graph | |
Get help information | |
Read local file content | |
Read resource URI content | |
Create downloadable file URL |
Workflow Server Tools
Tool | Description |
List workflow event categories | |
List available trigger events | |
List available activity types | |
List function categories | |
List available functions | |
List available workflow tasks | |
List condition categories | |
List available conditions | |
List predefined variables | |
List available workflow rules | |
Create workflow from YAML | |
List all workflows | |
Get workflow by name | |
Fetch complete workflow details | |
Update workflow implementation | |
Update workflow description | |
Update workflow diagram | |
Fetch resource data for execution | |
Create custom trigger event | |
Trigger workflow execution | |
Fetch workflow rule by name | |
Fetch task README | |
Fetch rule README |
Assistant Server Tools
Tool | Description |
Create assessment from YAML | |
List all assessments | |
List control configurations | |
Create control configuration | |
Update control context entities | |
Attach citation to control | |
Suggest relevant citations | |
Mark control ready for execution | |
Create SQL-based evidence | |
List SQL evidence for control | |
Update SQL evidence | |
Validate SQL query syntax | |
Get sample evidence data | |
Fetch evidence source summary | |
Create control config note | |
List control config notes | |
Update control config note | |
Get entity hierarchy | |
Get available context tables | |
Fetch rule README |
FAQ
1. How do I sign up for ComplianceCow?
Visit ComplianceCow Signup to create an account using various sign-up options including Google, Microsoft, and OTP.
2. What value does ComplianceCow deliver?
ComplianceCow helps with automated security compliance evidence collection, analysis, and remediation challenges. It's a security GRC controls automation studio for custom controls and workflows. Learn more at compliancecow.com.
3. Why are there 4 separate servers?
MCP works best with fewer tools per server. Splitting into 4 servers (Rules, Insights, Workflow, Assistant) ensures optimal performance and allows you to enable only the tools you need for specific use cases.
4. What if some tools have the same name across servers?
Some tools share the same name but have different implementations. Enable only one server at a time to avoid conflicts. The tool behavior is determined by the MCP_TOOLS_TO_BE_INCLUDED env.
5. How do I update the MCP server?
cd /path/to/cow-mcp
git pull origin main
uv pip install .Then restart your MCP host (Claude Desktop or Goose).
6. Where can I get help?
Create an issue on GitHub
Contact ComplianceCow support through the platform
Available Tools
118 toolsadd_check_to_assetA
Add a new control and a new check to an asset under a specified parent control. The check will be attached to newly created control beneath the parent control.
Args: - assetId (str): Asset id. - parentControlId (str): Parent control id under which the check will be added. - checkName (str): Name of the check to be added. - checkDescription (str): Description of the check to be added.
Returns: - success (bool): Indicates if the check was added successfully. - error (Optional[str]): An error message if any issues occurred during the addition.
| Name | Required | Description | Default |
|---|---|---|---|
| assetId | Yes | ||
| parentControlId | Yes | ||
| checkName | Yes | ||
| checkDescription | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool creates a new control and attaches a check to it, which implies a write operation, but does not specify permissions, idempotency, or side effects like what happens if the parent control doesn't exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with separate 'Args' and 'Returns' sections. It is front-loaded with the core purpose and uses minimal but sufficient text, earning its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, the description covers the return values (success, error) and the basic behavior. However, it could include more context about error conditions, duplicate checks, or required permissions. Still, it provides a solid foundation for an agent to understand the tool's function.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. The 'Args' section adds context for each parameter (e.g., 'parentControlId' is described as the parent control under which the check will be added), which goes beyond the basic type definitions in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Add a new control and a new check to an asset under a specified parent control.' It uses specific verbs and identifies the resources (asset, control, check), distinguishing it from siblings like create_asset_and_check which creates the asset itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear purpose but lacks explicit guidance on when to use this tool versus alternatives. No mention of prerequisites, exclusions, or when not to use it. The context with siblings is not leveraged to differentiate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_citation_to_asset_controlD
Create a new asse with an initial control and check structure. The asset will be created with a hierarchical structure: asset -> control -> check.
Args: - assetControlId (str): Id of the control in asset. - authorityDocument (str): Authority document name of the citation. - authorityDocumentControlId (str): Id of the control in authority document.
Returns: - success (bool): Indicates if the citation was created successfully. - error (Optional[str]): An error message if any issues occurred during creation.
| Name | Required | Description | Default |
|---|---|---|---|
| assetControlId | Yes | ||
| authorityDocument | Yes | ||
| authorityDocumentControlId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states returns (success, error) without detailing behavioral traits such as idempotency, permissions, or effects of duplicate citations. The typo 'asse' further undermines clarity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is of moderate length but includes irrelevant information about asset hierarchy. It could be more concise if focused on the actual citation action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and 3 parameters, the description fails to accurately describe the tool's purpose (mismatch with name) and lacks essential context about citations and controls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 0%, and the description merely repeats parameter names with vague one-line descriptions (e.g., 'Id of the control in asset'). It does not explain formats, constraints, or relationships between parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Create a new asset with an initial control and check structure,' which contradicts the tool name 'add_citation_to_asset_control.' The parameters are about linking a citation to an existing asset control, not creating an asset. This is misleading.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings like 'suggest_control_citations' or 'attach_rule_to_control.' The description does not clarify the context of use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
add_unique_identifier_to_taskA
Add a unique identifier key-value pair to a specific task's appTags.
Use this when multiple tasks share the same appType but need DIFFERENT applications. The unique identifier allows the system to match each application to its specific task.
WHEN TO USE:
After prepare_applications_for_execution() identifies tasks needing differentiation
When user chooses "separate applications" option for tasks with same appType
Before configuring separate applications for same appType tasks
NOT NEEDED WHEN:
User wants to SHARE the same application across multiple tasks
Task already has a unique appType (no other tasks share it)
WORKFLOW:
Call prepare_applications_for_execution()
If user chooses separate applications for an appType:
Call this tool for each task to add unique identifier
Use same key but different values (e.g., "purpose": "source" vs "purpose": "target")
Configure applications with matching identifiers
Args: rule_name: Name of the rule containing the task task_alias: Alias of the task to update identifier_key: Unique identifier key (e.g., "purpose", "sourceSystem") identifier_value: Value for the identifier (e.g., "source-repo", "production-db")
Returns: Dict with update status and guidance
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| task_alias | Yes | ||
| identifier_key | Yes | ||
| identifier_value | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It explains the effect (adding an identifier to appTags) and the purpose (matching applications to tasks). However, it does not disclose potential side effects like overwriting existing keys, error conditions (e.g., task not found), or authentication requirements. A score of 3 reflects adequate but incomplete disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but well-organized into sections (purpose, when/not to use, workflow, args, returns). It is front-loaded with the main action. While every section earns its place, the length could be slightly reduced without losing clarity. A score of 4 reflects good structure and efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 required parameters, part of a multi-step workflow), the description provides sufficient context: it references the preceding step (prepare_applications_for_execution) and explains the return type. The absence of an output schema is mitigated by stating 'Dict with update status and guidance'. Overall, it is complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, meaning the schema provides no parameter documentation. The description compensates by listing all four parameters with examples and context in an 'Args' section. This adds significant meaning beyond the raw schema, guiding the agent on how to populate them correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Add', the resource 'task's appTags', and the specific action 'unique identifier key-value pair'. It is precise and distinguishes itself from siblings like 'create_control_note' or 'update_control_note', which do not add identifiers to tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides 'WHEN TO USE' and 'NOT NEEDED WHEN' sections, including a workflow that references a specific sibling tool (prepare_applications_for_execution). This gives clear context and alternatives, making it easy for an agent to decide when to invoke this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attach_rule_to_controlA
Attach a rule to a specific control in an assessment.
🚨 CRITICAL EXECUTION BLOCKERS — DO NOT SKIP 🚨 Before any part of this tool can run, five preconditions MUST be met:
Control Verification:
You MUST verify the control exists in the assessment by calling
verify_control_in_assessment().Verification must confirm the control is present, valid, and a leaf control.
If verification fails → STOP immediately. Do not proceed.
Rule ID Resolution:
If
rule_idis a valid UUID → proceed.If
rule_idis an alphabetic string → treat it as the rule name and resolve it to a UUID usingfetch_cc_rule_by_name().If resolution fails or
rule_idis still not a UUID after this step → STOP immediately.Execution is STRICTLY PROHIBITED with a plain name.
Rule Publish Validation:
You MUST check if the rule is published in ComplianceCow before proceeding.
If the rule is not published → STOP immediately.
Published status is a hard requirement for attachment.
Evidence Creation Acknowledgment:
Before proceeding, you MUST request confirmation from the user about
create_evidence.Ask: "Do you want to auto-generate evidence from the rule output? (default: True)"
Only proceed after the user explicitly acknowledges their choice.
Override Acknowledgment:
If the control already has a rule attached, you MUST request user confirmation before overriding.
Ask: "This control already has a rule attached. Do you want to override it? (yes/no)"
Only proceed if the user explicitly confirms.
RULE ATTACHMENT WORKFLOW:
Perform control verification using
verify_control_in_assessment()(MANDATORY).Resolve rule_id using the CRITICAL EXECUTION BLOCKERS above (use
fetch_cc_rule_by_name()when needed).Validate that the rule is published in ComplianceCow.
Confirm evidence creation preference from the user (acknowledgment REQUIRED).
Check for existing rule attachments and request override acknowledgment if needed.
Attach rule to control.
Optionally create evidence for the control.
ATTACHMENT OPTIONS:
create_evidence: Whether to create evidence along with rule attachment. Must be confirmed by the user before proceeding.
VALIDATION REQUIREMENTS:
Control must be verified and confirmed as a leaf control.
Rule must be published.
Rule ID must be a valid UUID.
Assessment and control must exist.
User must acknowledge override before replacing an existing rule.
Args:
rule_id: ID of the rule to attach (UUID). If an alphabetic string is provided,
it MUST be resolved to a UUID using fetch_cc_rule_by_name() before the tool proceeds.
assessment_name: Name of the assessment.
control_id: ID of the control.
create_evidence: Whether to create auto-generated evidence from the rule output (default: True).
⚠️ MUST be confirmed by user acknowledgment before execution.
Returns: Dict containing attachment status and details.
| Name | Required | Description | Default |
|---|---|---|---|
| rule_id | Yes | ||
| assessment_name | Yes | ||
| control_id | Yes | ||
| create_evidence | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavioral traits: it requires user confirmation for override and evidence creation, performs validation steps, and may fail if preconditions aren't met. However, it doesn't explicitly state side effects or rollback behavior, keeping it from a perfect score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long and detailed, with headers and bullet points for structure. While thorough, it could be more concise; some repetition exists (e.g., 'CRITICAL EXECUTION BLOCKERS' reiterated in workflow). The length may overwhelm the agent, earning a middle score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple preconditions, user confirmations, workflow steps), the description is highly complete. It covers control verification, rule resolution, publish validation, evidence creation, override handling, and return value expectations. An output schema exists but doesn't reduce the need for this rich context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no descriptions (0% coverage), so the description compensates by explaining each parameter's usage, especially rule_id (UUID or name resolution) and create_evidence (needs user acknowledgment). It adds context about resolution logic, but lacks details on format constraints for assessment_name and control_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence clearly states 'Attach a rule to a specific control in an assessment,' which provides a specific verb and resource. This differentiates it from sibling tools like 'add_check_to_asset' or 'add_citation_to_asset_control' by focusing on rule-control attachment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly lists critical execution blockers and a detailed workflow, including preconditions like control verification, rule ID resolution, and user confirmations. It mentions using related tools (verify_control_in_assessment, fetch_cc_rule_by_name) for prerequisite steps, offering clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_applications_publish_statusA
Check publication status for each application in the provided list.
app_info structure is [{"name":["ACTUAL application_class_name"]}]
Args: app_info: List of application objects to check
Returns: Dict with publication status for each application. Each app will have 'published' field: True if published, False if not.
| Name | Required | Description | Default |
|---|---|---|---|
| app_info | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It states 'Check publication status', which implies a read-only operation, but does not explicitly confirm no side effects, authentication needs, or rate limits. Minimal but acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at 5 lines, including args and returns. The structure hint could be clearer with formatting, but overall it is efficient without extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (expected), the description covers input format and return structure. However, it does not address error handling or edge cases, leaving minor gaps for a tool with a single parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the tool description provides detailed structure: 'app_info structure is [{"name":["ACTUAL application_class_name"]}]' and 'List of application objects to check'. This goes beyond the schema's minimal object type array.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Check publication status for each application', specifying the verb (check) and resource (application publish status). It distinguishes from sibling tools like 'check_rule_publish_status' and 'publish_application' by targeting applications and only checking status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly mention when to use this tool versus alternatives. It implies usage via the action 'check', but lacks explicit context such as 'Use this to verify publication status before publishing' or exclusion of sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_rule_publish_statusC
Check if a rule is already published.
If not published → publish the rule so it becomes available for control attachment
Once published, prompt the user:
"Do you want to attach this rule to a ComplianceCow control? (yes/no)"If yes → ask for assessment name and control alias to proceed with association
If no → end workflow
Args: rule_name: Name of the rule to check
Returns: Dict with publication status and details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Lacks annotations; the description is ambiguous about side effects. The bullet 'If not published → publish the rule' suggests a write operation, but the tool name and return type imply read-only. No disclosure of actual behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with bullets and an Args section, but includes verbose workflow instructions that are not part of the tool's direct behavior, reducing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Does not describe the return dict structure, error cases, or side effects. For a simple tool with no annotations or output schema detail, the description is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description explains 'rule_name: Name of the rule to check'. This adds basic meaning beyond the schema's type-only definition, but is minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Check if a rule is already published' which is clear, but then includes workflow steps that suggest the tool may also publish or prompt the user, creating ambiguity about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs siblings like 'publish_rule' or 'check_rule_status'. The workflow steps imply subsequent actions but do not explicitly differentiate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_rule_statusA
Quick status check showing what's been collected and what's missing. Perfect for resuming in new chat windows.
ENHANCED WITH AUTO-INFERENCE STATUS ANALYSIS:
Ignores stored status/phase fields and analyzes actual rule structure
Auto-detects completion status based on rule content (same logic as create_rule)
Calculates real-time progress percentage from actual components
Determines next actions based on what's actually missing
Provides accurate resumption guidance regardless of stored metadata
Perfect for cross-chat resumption with reliable state detection
AUTO-INFERENCE LOGIC:
Analyzes spec.tasks, spec.inputs, spec.inputsMeta__, spec.ioMap, spec.outputsMeta__
Calculates completion based on actual content, not stored fields
Determines status: DRAFT → READY_FOR_CREATION → ACTIVE
Provides accurate progress: 5% → 25% → 85% → 100%
Identifies exactly what components are missing
Args: rule_name: Name of the rule to check status for
Returns: Dict with auto-inferred status information and accurate next action recommendations
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description thoroughly explains the tool's behavior beyond annotations: it ignores stored status/phase fields, analyzes actual rule structure, auto-detects completion status, calculates progress percentages, and provides resumption guidance. This ensures the agent understands exactly how it operates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose, with repeated emphasis on auto-inference and a long list of auto-inference logic details. While structured with headings, it could be more concise without losing critical information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and the description explains the output (dict with status information), it covers the essential aspects. The description also addresses resumption use cases, making it sufficiently complete for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, rule_name, is described simply as 'Name of the rule to check status for.' With 0% schema description coverage, the description adds minimal value but covers the necessary context. For a single string parameter, this is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a quick status check on a rule, showing what's collected and missing. It distinguishes itself from sibling tools by emphasizing auto-inference status analysis, making its unique purpose evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions the tool is 'Perfect for resuming in new chat windows,' providing clear guidance on when to use it. However, it does not explicitly state when not to use it or list alternatives, though the unique auto-inference feature implies scenarios where other status tools might not be suitable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
collect_parameter_inputA
Collect user input for non-template parameter inputs.
PARAMETER INPUT PROCESSING:
Collects primitive data type values (STRING, INT, FLOAT, BOOLEAN, DATE, DATETIME)
Stores values in memory (NEVER uploads files for primitive types)
Handles optional vs required inputs based on 'required' attribute
Supports default value confirmation workflow
Validates data types and formats
MANDATORY: Gets final confirmation for EVERY input before proceeding
INPUT REQUIREMENT RULES:
MANDATORY: Only if input.required = true
OPTIONAL: If input.required = false, user can skip or provide value
DEFAULT VALUES: If user requests defaults, must get confirmation
FINAL CONFIRMATION: Always required before proceeding to next input
DEFAULT VALUE WORKFLOW:
User requests to use default values
Show default value to user for confirmation
"I can fill this with the default value: '[default_value]'. Confirm?"
Only proceed after explicit user confirmation
Store confirmed default value in memory
FINAL CONFIRMATION WORKFLOW (MANDATORY):
After user provides value (or confirms default)
Show final confirmation: "You entered: '[value]'. Is this correct? (yes/no)"
If 'yes': Store value and proceed to next input
If 'no': Allow user to re-enter value
NEVER proceed without final confirmation
DATA TYPE VALIDATION:
STRING: Any text value
INT: Integer numbers only
FLOAT: Decimal numbers
BOOLEAN: true/false, yes/no, 1/0
DATE: YYYY-MM-DD format
DATETIME: ISO 8601 format
COLLECTION PRESENTATION: "Now configuring: [X of Y inputs]
Task: {task_name} Input: {input_name} ({data_type}) Description: {description} Required: {Yes/No} Default: {default_value or 'None'}
Please provide a value, type 'default' to use default, or 'skip' if optional:"
CRITICAL RULES:
NEVER upload files for primitive data types
Store all primitive values in memory only
Always confirm default values with user
ALWAYS get final confirmation before proceeding to next input
Respect required vs optional based on input.required attribute
Validate data types before storing
Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter user_value: Value provided by user (optional) use_default: Whether to use default value (requires confirmation)
Returns: Dict containing parameter value and storage info
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes | ||
| input_name | Yes | ||
| user_value | No | ||
| use_default | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It extensively discloses behaviors: collects only primitive types, stores in memory, never uploads files, validates types, requires mandatory confirmation, and details the default value workflow. This is comprehensive and transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively long with repeated information, multiple sections, bullet points, and numbered lists. While structured, it is not concise; many details like the final confirmation workflow are reiterated. Every sentence does not earn its place, reducing efficiency for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity and lack of annotations, the description covers purpose, parameters, workflows, validation rules, and critical rules comprehensively. It also mentions return type. However, the verbosity slightly hinders quick understanding, but overall completeness is high.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It lists the four parameters (task_name, input_name, user_value, use_default) in an 'Args' section with brief descriptions, adding meaning beyond the schema. However, the descriptions are somewhat terse and could provide more detail on formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool collects user input for non-template parameter inputs, specifies it handles primitive types, and distinguishes from sibling tool 'collect_template_input' by explicitly mentioning 'non-template'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use (for parameter inputs) and includes critical rules, but does not explicitly list alternatives or when not to use, though the distinction from template inputs is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
collect_template_inputA
Collect user input for template-based task inputs.
TEMPLATE INPUT PROCESSING (Enhanced with Progressive Saving):
Validates user content against template format (JSON/TOML/YAML)
Handles JSON arrays and objects properly
Checks for required fields from template structure
Uploads validated content as file (ONLY for FILE dataType inputs)
Returns file URL for use in rule structure
MANDATORY: Gets final confirmation for EVERY input before proceeding
CRITICAL: Only processes user-provided content, never use default templates
NEW: Prepared for automatic rule updates in confirm step
JSON ARRAY HANDLING (Preserved):
Properly validates JSON arrays: [{"key": "value"}, {"key": "value"}]
Validates JSON objects: {"key": "value", "nested": {"key": "value"}}
Handles complex nested structures with arrays and objects
Validates each array element and object property
VALIDATION REQUIREMENTS (Preserved):
JSON: Must be valid JSON (arrays/objects) with proper brackets and quotes
TOML: Must follow TOML syntax with proper sections [section_name]
YAML: Must have correct indentation and structure
XML: Must be well-formed XML with proper tags
Required fields: All template fields must be present in user content
STREAMLINED WORKFLOW:
User provides template content
Validate and process immediately
Auto-proceed if validation passes
FILE NAMING CONVENTION (Preserved):
Format: {task_name}_{input_name}.{extension}
Extensions: .json, .toml, .yaml, .xml, .txt based on format
WORKFLOW INTEGRATION (Enhanced):
Called after get_template_guidance() shows template to user
User provides their actual configuration content
This tool validates content (including JSON arrays)
Shows content preview and asks for confirmation
Only after confirmation: uploads file or stores in memory
Returns file URL or memory reference for rule structure
NEW: Prepared for rule update in confirm_template_input()
CRITICAL RULES (Preserved):
ONLY upload files for inputs with dataType = "FILE" or "HTTP_CONFIG"
Template inputs and HTTP_CONFIG inputs are typically file types and need file uploads
Store non-FILE template content in memory
ALWAYS get final confirmation before proceeding
Handle JSON arrays properly: validate each element
Never use template defaults - always use user-provided content
MANDATORY: Task-sequential collection only. Sanitize input names (alphanumeric + underscore).
Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter user_content: Content provided by the user based on the template
Returns: Dict containing validation results and file URL or memory reference, prepared for progressive rule updates
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes | ||
| input_name | Yes | ||
| user_content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses validation behavior, file upload condition (only for FILE dataType), mandatory confirmation, and rule updates. It covers error-prone details like JSON array handling and sanitization. Lacks details on error handling or idempotency, but overall transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy and contains redundancy (e.g., 'Preserved' repeated, 'NEW:' temporal markers). It is well-structured with sections, but could be more concise. Some sentences are wordy (e.g., 'MANDATORY: Task-sequential collection only.' could be shorter). Adequate but not optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (3 parameters, no annotations, output schema only described in text), the description covers workflow integration, validation requirements, file naming convention, and return values. It includes critical rules and workflow steps. Missing some edge case handling (e.g., validation failure behavior), but overall complete for a template input collection tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It provides clear semantics for each parameter: `task_name` (task identifier), `input_name` (name of input), and `user_content` (content based on template). It also explains validation formats (JSON/TOML/YAML/XML) and required fields, adding significant meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Collect user input for template-based task inputs.' It provides specific actions (validate, upload, store) and distinguishes from siblings like `collect_parameter_input` and `confirm_template_input` by focusing on template-based inputs. The verb 'collect' and resource 'template input' are precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit context on when to use: 'Called after get_template_guidance() shows template to user' and 'Task-sequential collection only.' It also includes critical rules like 'Never use template defaults' and that it is for template inputs, not parameter inputs. However, it does not explicitly list alternatives or when not to use, so slightly incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
configure_rule_output_schemaA
PREREQUISITE — MUST RUN FIRST (NON-SKIPPABLE)
This tool is a hard prerequisite and MUST be executed successfully before the prepare_input_collection_overview() tool (and any downstream rule-creation or evaluation steps).
If this tool has not run or did not complete, the workflow MUST fail fast with an explicit error.
PURPOSE Establish the rule's output schema policy for ComplianceCow and apply any required transformations. In ComplianceCow, we maintain a standard format for storing evidence records. The user MUST choose one of the following rule output options:
Standard schema only (ComplianceCow structured response fields)
Extended schema only (all fields from the source response)
Both standard + extended
USER PROMPT (MANDATORY — NEVER SKIPPABLE)
The workflow MUST always pause and explicitly prompt the user before proceeding.
This step CANNOT be bypassed, defaulted, auto-selected, or inferred.
If the user has not actively selected one of (a), (b), or (c), this tool MUST fail fast with a clear error message and stop execution.
VALIDATION & ENFORCEMENT
This tool is NON-SKIPPABLE. If not executed, or if the user does not provide an explicit choice (a/b/c), the workflow MUST stop immediately with an error.
No implicit defaults, assumptions, or auto-selections are allowed.
Mandatory Key mapping rules still apply if Standard schema is chosen.
BEHAVIOR BY SELECTION
A) If user selects STANDARD ONLY:
If the pipeline already ends with a Transformation task, reuse the existing Transformation task instead of appending a new one.
Otherwise, append a Transformation task at the END of the selected task pipeline.
In the Transformation task, map ALL Mandatory Keys (listed below).
Values for these keys MUST be taken from the pipeline's input file(s) and/or upstream task outputs, following the Deeper Analysis Rules.
Continue collecting inputs for the Transformation task using:
collect_template_input()orcollect_parameter_input().For each input that requires user guidance, call:
get_template_guidance('{task.name}', '<input_name>')to display the expected input format to the user.Ask the user to review and confirm OR edit the configuration before proceeding.
Do not proceed unless all Mandatory Keys are mapped and the configuration is confirmed (fail fast with guidance).
B) If user selects EXTENDED ONLY:
The Extended schema is a NON-STANDARD structure. It preserves the raw fields from the source response without enforcing ComplianceCow's standard schema format or mandatory key order.
Use the LAST task's output directly as the Extended schema output.
No mandatory field ordering or schema enforcement is applied — the structure is kept as-is for completeness and traceability.
C) If user selects BOTH:
Perform all steps from (A) to create the Standard schema:
Append a Transformation task at the END of the selected task pipeline.
Map ALL Mandatory Keys in the exact required order.
Include as needed for compliance.
Also add the Extended schema as a NON-STANDARD structure:
Create exactly ONE output field named: ExtendedData_. MUST be determinable from the use case (e.g., source, resource, or input artifact name).
Map the SAME LAST task output that is used as the input to the Transformation task into ExtendedData_.
Do NOT create duplicate extended outputs (for example, do not add both ExtendedData_JSONToCSV and ConvertedCSVFile if they contain the same data). Only ExtendedData_ must exist.
Continue collecting inputs for the Transformation task using: collect_template_input() or collect_parameter_input().
For each input that requires user guidance, call: get_template_guidance('{task.name}', '') to display the expected input format to the user.
Ask the user to review and confirm OR edit the configuration before proceeding.
Do not proceed unless:
All Mandatory Keys are mapped and validated in order
Configuration is confirmed by the user
DEEPER ANALYSIS RULES
Always extract and map the core Mandatory Keys required for compliance.
For , determine the minimal required fields based on the user's specific use case and map them under the Standard schema.
If additional fields are critical for the use case, map them explicitly into the Standard schema.
If fields are non-critical but useful, preserve them under
ExtendedData_<filename>.If MCP cannot store certain fields, the tool MUST explain the omission clearly to the user before proceeding and request confirmation if needed.
MANDATORY KEYS (MUST ALWAYS BE MAPPED — IN THIS EXACT ORDER)
System
Source
ResourceID
ResourceName
ResourceType
ResourceLocation
ResourceTags
<Important Keys Based On User's Use Case> (for example: fields from the response file such as user_id, username, email, license_type, assigned_date, last_login_date, last_activity_date)
ValidationStatusCode
ValidationStatusNotes
ComplianceStatus
ComplianceStatusReason
EvaluatedTime
UserAction
ActionStatus
ActionResponseURL
VALIDATION & ENFORCEMENT
This tool is NON-SKIPPABLE. If not executed, or if any Mandatory Key mapping is missing for the chosen Standard schema path, the workflow MUST stop with an error.
Key names are case-sensitive and MUST NOT be renamed.
The tool MUST persist the chosen option and mappings so that downstream tools consume a consistent schema contract.
The workflow MUST NOT proceed to
prepare_input_collection_overview()until:Inputs are collected via
collect_template_input()orcollect_parameter_input()get_template_guidance()has been used for each input needing guidanceThe user has confirmed or edited the configuration
All Mandatory Keys are mapped and validated in order
Mandatory, a JS chart (Mermaid/D3) MUST be generated to visualize the rule's I/O field structure. The chart must be displayed in this chat immediately after user input, and no further processing is allowed until this step is completed.
EXECUTION ORDER GUARANTEE
On success, and ONLY after input collection and configuration confirmation,
the next tool to run MUST be prepare_input_collection_overview().
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It thoroughly discloses all behavioral traits: it requires mandatory user prompt, is non-skippable, and details three selection options (standard, extended, both) with specific actions for each. It also mentions chart generation and mapping persistence.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy and contains redundant phrasing (e.g., 'NON-SKIPPABLE' repeated multiple times). It is well-structured with clear sections, but could be more concise. The front-loading of the prerequisite warning is good.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the tool (setting up output schema with user interaction), the description is highly detailed and covers all necessary aspects: purpose, prerequisites, user prompt requirement, behavior per selection, validation rules, and follow-up steps. However, the output schema is mentioned but not fully detailed in the description (though context says it exists).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, and schema description coverage is 100%. The description explains that the tool requires a user choice (a/b/c), which is not a formal parameter but is effectively the tool's input. It adds meaning beyond the schema by describing the three options and their implications.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the purpose: 'Establish the rule's output schema policy for ComplianceCow and apply any required transformations.' It explicitly positions itself as a mandatory prerequisite that must run before `prepare_input_collection_overview()`, distinguishing it from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: it MUST run first and is non-skippable. It also states when-not-to-use: if not executed or user does not provide explicit choice, the workflow must fail. It names the next tool (`prepare_input_collection_overview()`) and sets the ordering.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_parameter_inputA
Confirm and store parameter input after user validation.
CONFIRMATION PROCESSING (Enhanced with Automatic Rule Updates):
Handles final confirmation of parameter values
Stores confirmed values in memory
Supports both default value confirmation and final value confirmation
MANDATORY step before proceeding to next input
NEW: Automatically updates rule with parameter if rule_name provided
CONFIRMATION TYPES (Preserved):
"default": User confirmed they want to use default value
"final": User confirmed their entered value is correct
Both types require explicit user confirmation
STORAGE RULES (Enhanced):
Store all confirmed values in memory (never upload files)
Only store after explicit user confirmation
Include metadata about confirmation type and timestamp
NEW: Automatic rule update with parameter data
AUTOMATIC RULE UPDATE PROCESS: If rule_name is provided, this tool automatically:
Fetches the current rule structure
Adds the parameter to spec.inputs
Updates spec.inputsMeta__ with parameter metadata
Calls create_rule() to save the updated rule
Rule status will be auto-detected based on completion
Args: task_name: Name of the task this input belongs to input_name: Name of the input parameter rule_input_name: Must be one of the values defined in the rule structure's inputs confirmed_value: The value user confirmed explanation: Add explanation only if dataType is JQ_EXPRESSION or SQL_EXPRESSION. This field provides details about the confirmed_value. confirmation_type: Type of confirmation ("default" or "final") rule_name: Optional rule name for automatic rule updates
Returns: Dict containing stored value confirmation and rule update status
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes | ||
| input_name | Yes | ||
| rule_input_name | Yes | ||
| confirmed_value | Yes | ||
| explaination | Yes | ||
| confirmation_type | No | final | |
| rule_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses storing in memory, not uploading files, requiring explicit user confirmation, and the automatic rule update process including steps like fetching current rule structure and calling create_rule(). It lacks details on error handling or idempotency but covers essential behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections but is verbose. It repeats information (e.g., confirmation types and storage rules appear in multiple sections). While front-loaded with the main purpose, it could be more concise without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters (5 required) and an output schema, the description covers behavior, parameter semantics, and output format ('Dict containing stored value confirmation and rule update status'). There are no significant gaps for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning. The Args section explains each parameter, including constraints like rule_input_name must be one of the rule structure's inputs and explanation is only for JQ/SQL expressions. It adds context beyond the schema, though some parameters like task_name are not elaborated beyond their name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool confirms and stores parameter input after user validation. It specifies the action (confirm and store), the resource (parameter input), and the context (user validation). It distinguishes from siblings like 'collect_parameter_input' and 'confirm_template_input' by detailing automatic rule updates and memory storage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it is a 'MANDATORY step before proceeding to next input', providing clear when-to-use guidance. It mentions handling default and final confirmation types and automatic rule updates when rule_name is provided. However, it does not explicitly state when not to use this tool or what alternatives exist, though the sibling list provides context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
confirm_template_inputA
Confirm and process template input after user validation.
CONFIRMATION PROCESSING (Enhanced with Automatic Rule Updates):
Handles final confirmation of template content
Uploads files for FILE dataType inputs
Stores content in memory for non-FILE inputs
MANDATORY step before proceeding to next input
NEW: Automatically updates the rule with new input after processing
Skips confirmation if the user accepts the suggested template
PROCESSING RULES (Enhanced):
FILE dataType: Upload content as file, return file URL
HTTP_CONFIG dataType: Upload content as file, return file URL
Non-FILE dataType: Store content in memory
Include metadata about confirmation and timestamp
NEW: Automatic rule update with new input data
AUTOMATIC RULE UPDATE PROCESS: After successful input processing, this tool automatically:
Fetches the current rule structure
Adds the new input to spec.inputs
Updates spec.inputsMeta__ with input metadata
Calls create_rule() to save the updated rule
Rule status will be auto-detected (DRAFT → collecting_inputs → READY_FOR_CREATION)
UI DISPLAY REQUIREMENT:
The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.
Args: rule_name: Descriptive name for the rule based on the user's use case. Note: Use the same rule name for all inputs that belong to this rule. Example: rule_name = "MeaningfulRuleName" task_name: Name of the task this input belongs to input_name: Name of the input parameter rule_input_name: Must be one of the values defined in the rule structure's inputs confirmed_content: The content user confirmed
Returns: Dict containing processing results (file URL or memory reference) and rule update status
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| task_name | Yes | ||
| rule_input_name | Yes | ||
| input_name | Yes | ||
| confirmed_content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It comprehensively discloses the processing flow (file upload for FILE/HTTP_CONFIG, memory storage for others), automatic rule updates (including the step-by-step process), and UI display requirement. It does not mention error handling or permissions, but the detail is sufficient for transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly verbose with multiple sections in ALL CAPS, bullet points, and repetition (e.g., 'NEW' and 'Enhanced' markers). While it contains necessary information, the structure is not concise and could be streamlined to improve readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, no enums, output schema present), the description covers the processing steps, side effects (automatic rule updates), and UI requirement. It mentions the return type as a dict with file URL/memory reference and rule update status. It lacks error handling details or prerequisites, but is otherwise complete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage for its 5 parameters. The description's 'Args' section adds valuable context: it specifies that rule_name should be consistent across inputs, task_name identifies the task, rule_input_name must match rule structure, confirmed_content is the validated content. This compensates for the schema's lack of descriptions, though not all parameters are equally detailed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Confirm and process template input after user validation.' It clearly states the verb (confirm/process) and the resource (template input). It distinguishes from siblings like confirm_parameter_input by specifying it's for template inputs, and it details sub-actions like file uploads and memory storage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it is a 'MANDATORY step before proceeding to next input' and mentions it skips confirmation if the user accepts the suggested template. This provides clear context on when to use. However, it does not explicitly compare to sibling tools like collect_template_input or confirm_parameter_input, nor does it specify when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_asset_and_checkA
Create a new asse with an initial control and check structure. The asset will be created with a hierarchical structure: asset -> parentcontrol -> control -> check.
Args: - assetName (str): Name of the asset to be created. - controlName (str): Name of the initial control to be created within the asset. - checkName (str): Name of the initial check to be created under the control. (letters and numbers only, no spaces) - checkDescription (str): Description of the initial check.
Returns: - success (bool): Indicates if the asset was created successfully. - assetId (str): ID of the created asset (only present if successful). - error (Optional[str]): An error message if any issues occurred during creation.
| Name | Required | Description | Default |
|---|---|---|---|
| assetName | Yes | ||
| controlName | Yes | ||
| checkName | Yes | ||
| checkDescription | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the burden. It details the hierarchical creation, parameter constraints (checkName format), and return values. It lacks info on idempotency or error details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with bullet under 'Args', front-loaded with main purpose. Minor typo ('asse' instead of 'asset') slightly reduces clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 params, no annotations, and implied output schema, description is quite complete. Covers hierarchy, parameters, and returns. Missing context like authentication or error scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It provides clear meaning for all four parameters, including format constraint for checkName, adding value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it creates a new asset with a hierarchical control and check structure. It distinguishes from sibling 'add_check_to_asset' by emphasizing creation of the full hierarchy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for creating a new asset with initial structure, but does not explicitly state when to use this tool vs alternatives like 'add_check_to_asset'. No when-not or exclusion conditions provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_control_noteA
Create a documentation note on a control.
This tool creates a markdown documentation note that is attached to a control.
✅ CONFIRMATION-BASED SAFETY FLOW
When confirm=False: → The tool returns a PREVIEW of the generated markdown note. → The user may edit the note before confirming.
When confirm=True: → The note is permanently created and attached to the control.
Args:
controlId (str): The control ID where the note will be attached (required).
assessmentId (str): The assessment ID or asset ID that contains the control (required).
notes (str): The documentation content in MARKDOWN format (required).
topic (str, optional): Topic or subject of the note.
confirm (bool, optional):
- False → Preview only (default, no persistence)
- True → Create and permanently attach the note
Returns: Dict with success status and note data: - success (bool): Whether the request was successful - note (dict, optional): Created note object containing: - id (str): Note ID - topic (str): Note topic - notes (str): Note content in markdown format - controlId (str): Control ID the note is attached to - assessmentId (str): Assessment ID - error (str, optional): Error message if request failed - next_action (str, optional): Recommended next action
| Name | Required | Description | Default |
|---|---|---|---|
| controlId | Yes | ||
| assessmentId | Yes | ||
| notes | Yes | ||
| topic | Yes | ||
| confirm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description fully discloses the dual behavior: preview mode vs. permanent creation. It explains the return values and that the note is attached to a control. It does not mention permissions or side effects, but the core behavioral split is well-covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but well-organized with sections, bullet points, and formatting. Each part serves a purpose, though it is slightly longer than necessary. The main purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (confirmation flow, five parameters, detailed return schema), the description is complete. It explains the preview behavior, the creation mode, and the full return object, making it self-sufficient even without annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description lists all five parameters with their purposes, required status, and the confirm parameter's boolean options. It also explains the return structure, adding significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool creates a documentation note attached to a control, specifying the verb 'create' and the resource 'control note'. It distinguishes itself from siblings like 'update_control_note' and 'list_control_notes' by focusing on creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on the confirmation-based safety flow with confirm=False for preview and confirm=True for persistence. While it does not explicitly mention when to use this tool versus alternatives, the flow is clearly explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_design_notesA
Create and save design notes after user confirmation.
DESIGN NOTES CREATION:
This tool actually creates and saves the design notes after the user has reviewed and confirmed the preview structure from generate_design_notes_preview().
WORKFLOW:
Before creating new design notes, call fetch_rule_design_notes() to check if already exist and continue the flow, if not then continue this flow
User has already reviewed notebook structure from preview
User confirmed the structure is acceptable
This tool receives the complete design notes dictionary structure
MCP saves the notebook and returns access details
Args: rule_name: Name of the rule for which to create design notes design_notes_structure: Complete Jupyter notebook structure as dictionary
Returns: Dict containing design notes creation status and access details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| design_notes_structure | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden for behavioral disclosure. It discloses that the tool creates and saves design notes and returns access details. However, it could be more transparent about side effects (e.g., overwriting) or permissions required, but the provided info is solid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections, front-loading the main purpose. While slightly verbose with repeated workflow steps, it is organized and clear, earning a high but not perfect score for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's role in a multi-step workflow, the description effectively explains how it fits: prerequisite calls, user confirmation, and return details. It references sibling tools and provides a comprehensive overview, making it complete for its context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so by explaining rule_name as 'Name of the rule' and design_notes_structure as 'Complete Jupyter notebook structure as dictionary', adding meaningful context beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create and save design notes after user confirmation', specifying the verb and resource. It also distinguishes itself from sibling tools like generate_design_notes_preview and fetch_rule_design_notes by outlining the workflow context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides usage guidelines: call fetch_rule_design_notes first to check existence, then proceed after user confirmation of the preview. It also lists the workflow steps, making it clear when to use this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_ruleA
Create a rule with the provided structure.
COMPLETE RULE CREATION PROCESS WITH PROGRESSIVE SAVING:
This tool now handles both initial rule creation and progressive updates during the rule creation workflow. It intelligently detects the completion status and sets appropriate metadata automatically. It returns the URL to view the rule in the UI once it is created display the URL in chat.
ENHANCED FOR PROGRESSIVE SAVING:
Automatically detects rule completion status based on rule structure content
Determines if rule is in-progress, ready for execution, or needs more inputs
Handles both initial creation and updates of existing rules
No additional parameters needed - analyzes rule structure intelligently
Maintains all existing validation and creation logic
Preserves all original docstring instructions and requirements
CRITICAL REQUIREMENT - INPUTS META:
spec.inputsMeta__is mandatory for all rules, and rule creation cannot proceed without it.
AUTOMATIC STATUS DETECTION:
DRAFT: Rule has tasks but missing inputs or I/O mapping (5-85% complete)
READY_FOR_CREATION: All inputs collected but I/O mapping incomplete (85% complete)
ACTIVE: Complete rule with tasks, inputs, and I/O mapping (100% complete)
RULE COMPLETION ANALYSIS:
Checks if tasks are defined in spec.tasks
Validates that
spec.inputsMeta__existsCounts collected inputs in spec.inputs vs spec.inputsMeta__
Validates I/O mapping presence and completeness in spec.ioMap
Analyzes outputsMeta__ for mandatory compliance outputs
Sets appropriate status and creation phase automatically
PROGRESSIVE CREATION PHASES (Auto-detected):
"initialized" - Basic rule info provided (5%)
"tasks_selected" - Tasks chosen and defined (25%)
"collecting_inputs" - Individual inputs being collected (25-85%)
"inputs_collected" - All inputs gathered, ready for I/O mapping (85%)
"completed" - Final rule creation complete with I/O mapping (100%)
ORIGINAL REQUIREMENTS MAINTAINED:
All existing validation rules still apply
Task alias validation in I/O mappings preserved
Primary app type determination logic maintained
Mandatory output requirements (CompliancePCT_, ComplianceStatus_, LogFile)
YAML preview and user confirmation workflow preserved
All existing error handling and validation checks
CRITICAL: This tool should be called:
After planning phase to create initial rule structure
After each input collection to update rule progressively
After input verification to finalize rule with I/O mapping
Rule status and progress automatically detected each time
PRE-CREATION REQUIREMENTS (Original):
spec.inputsMeta__must be defined and contain valid input definitionsAll inputs must be collected through systematic workflow
User must provide input overview confirmation
All template inputs processed via collect_template_input()
All parameter values collected and verified
User must confirm all input values before rule creation
Primary application type must be determined
Rule structure must be shown to user in YAML format for final approval
STEP 1 - PRIMARY APPLICATION TYPE DETERMINATION (Preserved): Before creating rule structure, determine primary application type:
Collect all unique appType tags from selected tasks
Filter out 'nocredapp' (dummy placeholder value)
Handle app type selection:
If only one valid appType: Use automatically
If multiple valid appTypes: Ask user to choose primary application
If no valid appTypes (all were nocredapp): Use 'generic' as default
Set primary app type for appType, annotateType, and app fields (single value arrays)
STEP 2 - RULE STRUCTURE WITH TASK ALIASES (Preserved):
apiVersion: rule.policycow.live/v1alpha1
kind: rule
meta:
name: MeaningfulRuleName # Simple name. Without special characters and white spaces
purpose: Clear statement based on user breakdown
description: Detailed description combining all steps
labels:
appType: [PRIMARY_APP_TYPE_FROM_STEP_1] # Single value array CRITICAL: Must be extracted from spec.tasks[].appTags.appType - NEVER use random values or user requirements
environment: [logical] # Array
execlevel: [app] # Array
annotations:
annotateType: [PRIMARY_APP_TYPE_FROM_STEP_1] # Same as appType - MUST match a task's appType
spec:
inputs:
InputName: [ACTUAL_USER_VALUE_OR_FILE_URL] # Use original or unique names based on conflicts, omit duplicates
inputsMeta__:
- name: InputName # unique name for the input
description: # purpose of the input
dataType: FILE|HTTP_CONFIG|STRING|INT|FLOAT|BOOLEAN|DATE|DATETIME
repeated: # true = multiple values allowed, false = single value
allowedValues: # if repeated=true: comma-separated input is split into array
required: # value must be taken from task details.
defaultValue: [ACTUAL_USER_VALUE] #values are collected from users, If the dataType is FILE or HTTP_CONFIG then the value should be filepath URL.
format: [ACTUAL_FILE_FORMAT] # only include for FILE types (json, yaml, toml, xml, etc.)
showField: true # true = most important field, false = optional/less important
outputsMeta__:
- name: FinalOutput
dataType: FILE|STRING|INT|FLOAT|BOOLEAN|DATE|DATETIME
required: true
defaultValue: [ACTUAL_RULE_OUTPUT_VALUE]
tasks:
- name: Step1TaskName # Original task names
alias: step1 # Meaningful task aliases (simple descriptors)
type: task
appTags:
appType: [COPY_FROM_TASK_DEFINITION] # Keep original task appType
environment: [logical] # Array
execlevel: [app] # Array
purpose: What this task does for Step 1
- name: Step2TaskName
alias: validation # Another meaningful alias
type: task
appTags:
appType: [COPY_FROM_TASK_DEFINITION]
environment: [logical] # Array
execlevel: [app] # Array
purpose: What this task does for validation
ioMap:
- step1.Input.TaskInput:=*.Input.InputName # Use task aliases in I/O mapping
- validation.Input.TaskInput:=step1.Output.TaskOutput
# MANDATORY: Always include these three outputs from the last task
- '*.Output.FinalOutput:=validation.Output.TaskOutput'
- '*.Output.CompliancePCT_:=validation.Output.CompliancePCT_' # Compliance percentage from last task
- '*.Output.ComplianceStatus_:=validation.Output.ComplianceStatus_' # Compliance status from last task
- '*.Output.LogFile:=validation.Output.LogFile' # Log file from last taskSTEP 3 - I/O MAPPING WITH TASK ALIASES (Preserved):
Use golang-style assignment: destination:=source
3-part structure: PLACE.DIRECTION.ATTRIBUTE_NAME
Always use EXACT attribute names from task specifications
Use meaningful task aliases instead of generic names
Ensure sequential data flow: Rule → Task1 → Task2 → Rule
Mandatory compliance outputs from last task
STEP 4 - inputsMeta__ Cleanup: In spec.inputsMeta__, retain only the entries whose keys exist in spec.inputs. Remove any fields in spec.inputsMeta__ that are not present in spec.inputs.
VALIDATION CHECKLIST (Preserved): □ Rule structure validation against schema □ Task alias validation in I/O mappings □ Primary app type determination □ Input/output specifications validation □ Mandatory compliance outputs present □ Sequential data flow in I/O mappings
Args: rule_structure: Complete rule structure with any level of completion
Returns: Result of rule creation including auto-detected status and completion level
| Name | Required | Description | Default |
|---|---|---|---|
| rule_structure | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully details behavior: it handles creation and updates, auto-detects status, has progressive phases, and returns a URL. It does not mention auth needs or rate limits, but covers the primary behavioral aspects comprehensively.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long and repetitive, with multiple sections repeating similar information (e.g., progressive saving, phases). While important details are present, conciseness is lacking; it could be streamlined without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of rule creation, the description is extremely complete. It covers all phases, validation, examples, and requirements. It also references an output schema (though not provided), so return values need not be described. The description leaves no critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has only one parameter (rule_structure) with 0% schema description coverage. The description compensates extensively by documenting the structure with a YAML example, steps, validation checklist, and all required fields, providing far more meaning than the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a rule with the provided structure' and elaborates on progressive saving and automatic status detection. It distinguishes from sibling tools (e.g., fetch_rule, publish_rule) by specifying it is for creation and progressive updates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly specifies when to call the tool: after planning, after each input collection, and after input verification. It lists pre-creation requirements and workflow steps, but does not explicitly state when not to use it or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_rule_readmeA
Create and save README.md file after user confirmation.
README CREATION:
This tool actually creates and saves the README.md file after the user has reviewed and confirmed the preview content from generate_rule_readme_preview().
WORKFLOW:
User has already reviewed README content from preview
User confirmed the content is acceptable
This tool receives the complete README.md content as string
MCP saves the README file and returns access details
Args: rule_name: Name of the rule for which to create README readme_content: Complete README.md content as string
Returns: Dict containing README creation status and access details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| readme_content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It explains the tool saves the file and returns access details, but does not address potential overwrites, permissions, or side effects. The behavior is adequately disclosed but lacks deeper safety context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections (README CREATION, WORKFLOW, Args, Returns). It is front-loaded with purpose, each sentence adds value, and there is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with 2 string parameters and an output schema, the description covers the workflow and return details. It lacks error scenarios (e.g., invalid content), but is largely sufficient for an AI agent to understand the tool's role.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% description coverage. The description adds 'Name of the rule' and 'Complete README.md content as string', which clarifies the parameters beyond the schema. This compensates well, though more detail (e.g., format constraints) would improve.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create and save README.md file after user confirmation.' It explicitly differentiates from the sibling tool generate_rule_readme_preview and update_rule_readme by specifying it is the final step after preview and confirmation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear workflow: user must have reviewed preview and confirmed. It implies usage only after preview, but does not explicitly state when not to use or list alternatives. The context is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_support_ticketA
PURPOSE:
Create structured support tickets only after strict user review and explicit approval of all descriptions.
Ticket creation MUST NOT occur without explicit user confirmation at every required step.
Reduce user input errors and rework by ensuring clarity and completeness before ticket submission.
MANDATORY CONDITIONS — NO STEP MAY BE SKIPPED OR BYPASSED:
BEFORE TOOL ENTRY:
The tool MUST generate a detailed, pre-filled plain-text description for the task or workflow.
The user MUST review this description carefully.
Ticket creation MUST be blocked until the user explicitly APPROVES this description.
USER VERIFICATION:
The user MUST be presented with the full pre-filled description.
The user MUST either confirm its correctness or provide feedback for changes.
The tool MUST update the description and priority per feedback and repeat this verification step as many times as needed.
Skipping or auto-approving this step is strictly prohibited.
FINAL APPROVAL & FORMATTING:
After user approval of the plain text, the description MUST be converted into professional HTML format (bold headings, clear structure, spacing).
The user MUST explicitly approve this final HTML-formatted description.
The tool MUST block ticket creation until this final approval is given.
Only the fully user-approved, HTML-formatted description MAY be used to create the support ticket.
IMPORTANT:
Under no circumstances shall the tool proceed to ticket creation without explicit user approval at all mandatory steps.
The process must strictly enforce these approvals, preventing any premature or automatic ticket submissions.
MANDATORY USER INPUTS:
subject(str) — ticket title.description(str) — final user-approved, HTML-formatted description.priority(str) — ticket priority level.
Valid values:"High","Medium","Low"(case-sensitive).
The user MUST provide one of these values to proceed.
RETURNS:
A dictionary simulating the ticket creation response for integration or testing purposes.
| Name | Required | Description | Default |
|---|---|---|---|
| subject | Yes | ||
| description | Yes | ||
| priority | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It describes intended agent behavior (generating descriptions, blocking creation) rather than actual tool behavior, which may mislead. It adds some context but is more about process than tool capabilities.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose and repetitive, with multiple bullet sections. It is structured but could be more concise. Several sentences rephrase the same idea of mandatory user approval.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 parameters and no enums, the description thoroughly covers the workflow and output. It mentions the return type (dictionary) and provides all necessary context for correct usage, though it overemphasizes process.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description compensates by explaining each parameter: subject as title, description as HTML-formatted and user-approved, priority with valid case-sensitive values (High, Medium, Low). This adds meaningful guidance beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates support tickets after user review. It differentiates from sibling tools by emphasizing a strict approval workflow, though no direct sibling comparison is made.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit mandatory conditions and steps, including when to use (after user approval) and when not to use (without approval). It does not compare to alternatives but offers clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_workflowA
Create a new workflow using YAML definition. Always display the workflow diagram. Before creation confirm workflow name and creation with the user before executing this tool. Later use 'modify_workflow' tool to update states, activities, conditions, and transitions.
yaml struct:
metadata: name: description: summary: mermaidDiagram:
This function creates a workflow from a YAML specification.
Create workflow (establishes the ID) Update summary (document what we're building) Update mermaid diagram (visualize the flow) Then modify workflow (implement the actual logic)
Args: workflow_yaml: YAML string defining the workflow structure
Returns: Success message with workflow ID or error message
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_yaml | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose side effects, permissions, or safety concerns. It mentions displaying a diagram and a confirmation step but does not address reversibility, overwrite behavior, or error cases. The YAML struct hint adds some context, but behavioral traits are insufficiently covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat verbose, containing redundant statements (e.g., 'Create a new workflow using YAML definition' and 'This function creates a workflow from a YAML specification'). It includes an Args/Returns section and a code block, but could be more tightly written without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema (not shown), the description reasonably covers the tool's purpose, usage, and parameter format. However, it lacks detail on expected behavior, error states, or prerequisites, and does not fully differentiate from the many sibling tools that exist on the server.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides a YAML struct example and states that the parameter is a 'YAML string defining the workflow structure,' which adds meaning beyond the schema's type-only definition. However, it does not fully specify all YAML fields or constraints, leaving gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a new workflow using a YAML definition, and distinguishes it from the similarly named 'modify_workflow' tool, which handles updates. The verb 'create' and resource 'workflow' are specific, and the YAML format is explicitly referenced.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance: confirm with user before execution and later use 'modify_workflow' for updates. It outlines a multi-step process for workflow creation, which helps the agent decide when to use this tool, though it could also note when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_workflow_custom_eventA
Create a Workflow Catalog Custom Event. Show a preview of the event configuration and ask for user confirmation before proceeding. Only create the event after explicit confirmation from user (confirm=True) This tool validates payload item types against allowed values and requires explicit user confirmation before creating the event.
Args: - displayable: Event display name - desc: Event description - categoryId: Event category identifier - payload: List of payload items. Each item must have {name, type, desc} and type must be one of: Text, MultilineText, TextArray, DynamicTextArray, Number, File, Boolean, Json - eventType: Event type. Default: "CUSTOM_EVENT" - confirm: Boolean flag. If False, will show a preview for user confirmation. Only returns True after user explicitly accepts the preview. Returns: - Success or error message
| Name | Required | Description | Default |
|---|---|---|---|
| displayable | Yes | ||
| desc | Yes | ||
| payload | Yes | ||
| categoryId | No | 7 | |
| eventType | No | CUSTOM_EVENT | |
| confirm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: it validates payload item types, requires explicit user confirmation, and returns a success or error message. It explains that when confirm=False, it returns a preview without creating the event. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a purpose statement, usage instructions, and parameter list. It is front-loaded with the key confirmation requirement. While it is fairly detailed, it could be slightly more concise, but the structure aids readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, nested schema), the description covers the main behavior and all parameters. It explains the confirmation workflow and validation. The return value is vaguely described as 'Success or error message,' but since the context indicates an output schema exists, this is acceptable. It adequately supports an agent's decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains all six parameters in the Args section, adding meaning beyond the schema. For example, it lists the allowed types for payload items, which the schema references via $defs. Schema coverage is 0%, so the description carries the full burden and does so effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Create a Workflow Catalog Custom Event.' It uses a specific verb (create) and resource (Workflow Catalog Custom Event), and the tool name is self-explanatory. Among siblings, there is no other creation tool for custom events, so differentiation is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidelines: 'Show a preview of the event configuration and ask for user confirmation before proceeding. Only create the event after explicit confirmation from user (confirm=True).' It instructs the agent to first call with confirm=False to show a preview, then only proceed with confirm=True after user acceptance. This clearly defines when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_asset_scheduleB
Delete an existing assessment schedule.
Args: - scheduleId (str): ID of the schedule to delete
Returns: - success (bool) - error (Optional[str])
| Name | Required | Description | Default |
|---|---|---|---|
| scheduleId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It discloses deletion and return values but omits important behavioral traits like irreversible effects, required permissions, or error handling for non-existent schedules.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded. However, the structured Args/Returns format adds redundancy given the schema and presumed output schema. Some fluff could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete tool with one parameter and an output schema, the description is adequate but lacks explanation of edge cases (e.g., idempotency, what happens if schedule doesn't exist).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'scheduleId' has 0% schema description coverage. The description adds 'ID of the schedule to delete,' which is redundant with the parameter name and adds no additional meaning (e.g., format, source, or validation).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete) and the resource (assessment schedule). It distinguishes from sibling tools like list_asset_schedules and schedule_asset_execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, nor prerequisites like schedule existence or permissions. The description provides no context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_actionA
Use this tool when the user asks about actions such as create, update or other action-related queries.
IMPORTANT: This tool MUST ONLY be executed after explicit user confirmation. Always prompt for REQUIRED-FROM-USER field from user and get inputs from user. Always confirm the inputs below execute action. Always describe the intended action and its effects to the user, then wait for their explicit approval before proceeding. Do not execute this tool without clear user consent, as it performs actual operations that modify system state.
Execute or trigger a specific action on an assessment run. use assessment id, assessment run id and action binding id. Execute or trigger a specific action on an control run. use assessment id, assessment run id, action binding id and assessment run control id . Execute or trigger a specific action on an evidence level. use assessment id, assessment run id, action binding id, assessment run control evidence id and evidence record ids. Use fetch assessment available actions to get action binding id. Only once action can be triggered at a time, assessment level or control level or evidence level based on user preference. Use this to trigger action for assessment level or control level or evidence level. Please also provide the intended effect when executing actions. For inputs use default value as sample, based on that generate the inputs for the action. Format key - inputName value - inputValue. If inputs are provided, Always ensure to show all inputs to the user before executing the action, and also user to make changes to the inputs and also confirm modified inputs before executing the action.
WORKFLOW:
First fetch the available actions based on user preference assessment level or control level or evidence level
Present the available actions to the user
Ask user to confirm which specific action they want to execute
Explain what the action will do and its expected effects
Wait for explicit user confirmation before calling this tool
Only then execute the action with this tool
Args: - assessmentId - assessmentRunId - actionBindingId - assessmentRunControlId - needed for control level action - assessmentRunControlEvidenceId - needed for evidence level action - evidenceRecordIds - needed for evidence level action - inputs (Optional[dict[str, Any]]): Additional inputs for the action, if required by the action's rules.
Returns: - id (str): id of triggered action.
| Name | Required | Description | Default |
|---|---|---|---|
| assessmentId | Yes | ||
| assessmentRunId | Yes | ||
| actionBindingId | Yes | ||
| assessmentRunControlId | No | ||
| assessmentRunControlEvidenceId | No | ||
| evidenceRecordIds | No | ||
| inputs | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| id | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses that this tool modifies system state, requires explicit user confirmation, and can only trigger one action at a time. It explains the return value (triggered action id) and references the need to fetch action binding IDs, providing clear behavioral expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose and contains repetition (e.g., user confirmation is mentioned multiple times). It includes a lengthy workflow and multiple warnings that could be condensed. The essential information is present but not optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, no schema descriptions, no annotations, output schema exists), the description covers the workflow, safety, level-specific parameters, and return value. It does not address error handling or non-standard scenarios, but it is largely sufficient for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains which parameters are needed for each level (control, evidence) and notes that inputs are optional and action-specific. It also describes how to obtain actionBindingId. However, it lacks detailed semantics for each parameter (e.g., how to derive assessmentId, assessmentRunId) beyond level differentiation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes actions on assessment runs at different levels (assessment, control, evidence). It specifies the resource ('action on assessment run') and verb ('execute or trigger'), and distinguishes itself from sibling tools like fetch_assessment_available_actions by referencing them in the workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit step-by-step workflow, including prerequisites (fetch available actions), user confirmation requirements, and parameter necessity by level. It includes strong warnings not to execute without user consent and instructs to prompt for required fields and input modifications.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_cypher_queryA
Given a question and query, execute a cypher query and transform result to human readable format.
This tool queries a Neo4j graph database containing compliance controls, frameworks, and evidence.
Key database structure: - Controls have hierarchical relationships via HAS_CHILD edges - Evidence nodes are attached to leaf controls (controls with no children) - Use recursive patterns [HAS_CHILD*] for traversing control hierarchies - Controls may have multiple levels of nesting - Evidence contains records - RiskItem nodes are attached to control-config via HAS_RISK & HAS_MAPPED_CONTROL edges - RiskItemAttribute nodes are attached to RiskItem via HAS_ATTRIBUTE edges - RiskItem contains RiskItemAttributes
Query guidelines: - For control hierarchies: Use MATCH (parent)-[HAS_CHILD*]->(child) patterns - For evidence: Evidence is only available on leaf controls (Always check last child of control for evidence) (no outgoing HAS_CHILD relationships) - For control depth: Calculate hierarchy depth when analyzing control structures - Use APOC procedures for complex graph operations when available - While list assessment run always include assessment name - For large datasets from query: Provide overview summary & suggest refinement suggestion
Args: query (str): The Cypher query to execute against the graph database.
Returns: - result (Any): The formatted, human-readable result of the Cypher query. - error (Optional[str]): An error message if the query execution fails or encounters issues.
Example queries: - Find all root controls: MATCH (c:Control) WHERE NOT ()-[:HAS_CHILD]->(c) RETURN c - Get control hierarchy: MATCH (root)-[:HAS_CHILD*]->(leaf) RETURN root, leaf - Find evidence for controls (leaf control): MATCH (c:Control)-[:HAS_EVIDENCE]->(e:Evidence) RETURN c, e - Find leaf control: MATCH (c:Control) WHERE NOT (c)-[:HAS_CHILD]->(:Control) RETURN c - Find records: MATCH (e:Evidence)-[:HAS_RECORD]-(:Record) RETURN e
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description lacks annotations, so it carries the full burden of behavioral disclosure. It explains the database structure and query patterns but does not warn that the tool can execute write queries (Cypher includes CREATE, DELETE, etc.), potentially leading to unintended data mutation. It also omits permission requirements or error handling details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose statement, nested details, and examples. It is somewhat lengthy but every section adds value. It could be slightly more concise by removing redundant phrases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the minimal input schema and no annotations, the description provides a comprehensive overview of the tool's behavior, database context, and return format. It is mostly complete but could benefit from mentioning write operation implications and more detailed error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage for the single parameter 'query', the description fully compensates by providing query guidelines, database schema details, and multiple example queries. This adds critical meaning beyond the bare schema definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a Cypher query and transforms the result to a human-readable format. It specifies the database type (Neo4j) and provides extensive context on database structure, making the purpose unambiguous and distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides query guidelines, example queries, and hints for traversing hierarchies. While it does not explicitly compare to alternative tools or state when not to use it, the context given is sufficient for an agent to understand appropriate usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_ruleA
RULE EXECUTION WORKFLOW:
PREREQUISITE STEPS: 0. MANDATORY: Check rule status to ensure rule is fully developed before execution
User chooses to execute rule after creation
Extract unique appTags from selected tasks (excluding 'nocredapp')
APPLICATION CONFIGURATION (OPTIONAL - only for tasks requiring credentials): For tasks that need application credentials:
Fetch available applications via get_applications_for_tag().
Present them to the user for manual selection.
User decides to: a. Use an existing application, or b. Run with new credentials (not persisted or saved as an application).
Proceed after user confirmation.
Note: Rules with only 'nocredapp' tasks can be executed without any application configuration.
APPLICATION-TASK MATCHING LOGIC (when applications are needed):
Applications are matched to tasks via 'appTags' labels
Tasks with 'nocredapp' appType do not require application configuration
SHARED APPLICATION SUPPORT: A single application CAN be used for multiple tasks if the user confirms they want to share the same credentials
When multiple tasks share the same appType AND require DIFFERENT applications, unique identifier key-value pairs MUST be added to distinguish them
MATCHING SCENARIOS:
One application per task: Each task has unique appType → straightforward matching
Shared application: Multiple tasks share same appType AND same application
User confirms: "Use same application for all [appType] tasks? (yes/no)"
If yes: Single application covers all matching tasks
Application appTags should match the common appType
Multiple applications for same appType: Different credentials needed for different tasks
Add unique identifier key (e.g., "purpose", "sourceSystem") to distinguish
Each application's appTags must include the unique identifier matching its target task
APPLICATION CONFIGURATION FORMAT (when needed):
For existing application (can be shared across multiple tasks):
json [ { "applicationType": "[application_class_name from fetch_applications(appType)]", "applicationId": "[Actual application ID chosen by user]", "appTags": "[Complete object from rule spec.tasks[].appTags]" } ]
For new credentials:
json [ { "applicationType": "[application_class_name from fetch_applications(appType)]", "appURL": "[Application URL from user (optional - can be empty string)]", "credentialType": "[User chosen credential type]", "credentialValues": { "[User provided credentials]" }, "appTags": "[Complete object from rule spec.tasks[].appTags]" } ]
WORKFLOW FOR MULTIPLE TASKS WITH SAME APPTYPE:
Detect tasks sharing same appType (excluding 'nocredapp')
Ask user: "Tasks [task1, task2] both require [appType]. Options: a) Use SAME application/credentials for all tasks b) Use DIFFERENT applications (requires unique identifiers)"
If SAME: User provides one application config with basic appTags
If DIFFERENT:
Prompt for unique identifier key (e.g., "purpose", "sourceSystem")
User provides separate application configs with unique identifier values
Update task appTags with matching unique identifiers
Build applications array (if needed) → get user confirmation
Additional Inputs (optional):
Ask user: "Do you want to specify a date range for this execution?"
From Date (format: YYYY-MM-DD) - optional
To Date (format: YYYY-MM-DD) - optional
Final confirmation → execute rule
If execution starts successfully → call fetch_execution_progress()
Rule Output File Display Process: a. Extract task outputs from execution results b. MANDATORY: Show output in this format: - TaskName: [task_name] - Files: [list of files] c. Ask: "View file contents? (yes/no)" d. If yes: Call fetch_output_file() for each requested file e. Display results with formatting
Rule Publication (optional):
Ask user: "Do you want to publish this rule to make it available in ComplianceCow system? (yes/no)"
If yes: Call publish_rule() to publish the rule
If no: End workflow
UI DISPLAY REQUIREMENT:
The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.
CRITICAL: rule_inputs MUST be the complete spec.inputsMeta__ objects with ALL original fields (name, description, dataType, repeated, allowedValues, required, defaultValue, format, showField, explanation) plus the 'value' field. DO NOT send trimmed objects with only name/dataType/value.
MANDATORY: The 'value' field content MUST also be copied to the 'defaultValue' field. Both fields must contain identical values. Example: if value="CSV", then defaultValue must also be "CSV".
Args: rule_name: The name of the rule to be executed. from_date: (Optional) Start date provided by the user in the format YYYY-MM-DD. to_date: (Optional) End date provided by the user in the format YYYY-MM-DD. rule_inputs: Complete spec.inputsMeta__ objects with ALL fields plus 'value' field, and 'defaultValue' set to same value as 'value'. applications: Application configuration details. For rules with only 'nocredapp' tasks, pass an empty list and the system will automatically use the hardcoded nocredapp application structure. is_application_data_provided_by_user (bool): Indicates whether application data was provided by the user. - Set to True if user provided or configured application details during execution. - Set to False if using nocredapp (empty applications list) or pre-existing applications.
Returns: Dict with execution results
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| from_date | Yes | ||
| to_date | Yes | ||
| rule_inputs | Yes | ||
| applications | Yes | ||
| is_application_data_provided_by_user | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It details the execution workflow, application matching logic, output display process, and optional publication. It also specifies critical data formatting rules for 'rule_inputs'. However, it does not explicitly mention authentication requirements or side effects like data mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively long, running multiple hundreds of words with a full workflow that includes UI display requirements and step-by-step instructions. While it is structured with sections and formatting, it could be significantly trimmed without losing essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (rule execution with application orchestration and output handling), the description covers all necessary aspects: prerequisites, configuration options, matching logic, parameter specifications, post-execution steps, and optional publication. The mention of a return value (Dict with execution results) complements the output schema richness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the 'Args' section in the description adds substantial meaning to each parameter. It explains the complex structure of 'rule_inputs' and 'applications' beyond the generic object type, including constraints like the 'defaultValue' requirement. The explanation is thorough but verbose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly indicates that the tool executes a rule, but the purpose is embedded in a lengthy workflow narrative rather than stated concisely upfront. The verb 'execute' and resource 'rule' are explicit, and it distinguishes from siblings like 'execute_task' by specifying the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides extensive usage guidance including mandatory prerequisite steps and post-execution actions. However, it does not explicitly contrast with sibling tools like 'execute_task' or 'publish_rule', and when-not-to-use scenarios are implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_taskA
Execute a specific task with real data after collecting all required inputs.
**This tool executes tasks with REAL data, not sample data.**
If any input depends on a previous task's output and that output is not available,
the dependent task(s) MUST be executed first to obtain the real output.
===============================================================================
EXECUTION CONTEXT
===============================================================================
- This tool MUST be called after collecting the inputs for a task.
- Execution is sequential: execute Task 1 → then Task 2 → etc.
- No task may proceed until its dependent tasks have been executed.
- On execution failure, provide detailed error feedback.
===============================================================================
DEPENDENCY & REAL DATA HANDLING
===============================================================================
If a task requires input from a previous task (dataset, file, or structured output):
1. **Use real task output when available**
- If the dependent task was already executed and produced outputs:
→ Use those outputs as the input.
→ Do NOT generate synthetic/sample data.
→ Do NOT re-run the previous task unnecessarily.
2. **If required previous task output does NOT exist**
- The assistant MUST:
- Explain *why* execution of the previous task is required.
- Automatically execute the previous task (and any required tasks in the chain).
- **After execution, display all execution results and outputs.**
- NO user confirmation should be requested—only explanation.
- Use the REAL output from the executed task as input.
3. **If executing a required previous task fails**
- The assistant MUST:
- Explain clearly why the task failed.
- Ask the user to provide the required input data manually.
- User-provided data becomes the fallback input.
4. **Only execute what is needed**
- Execute ONLY the minimal set of tasks whose outputs are required.
- **Every executed task must have its results shown to the user immediately.**
===============================================================================
APPLICATION CONFIGURATION
===============================================================================
Application credentials are REQUIRED if the task's appType is NOT 'nocredapp'.
If the task requires application credentials (appType != 'nocredapp'):
- Application config must be provided with:
- appName: Application class name
- appURL: Application URL (optional, can be empty string)
- credentialType: Type of credentials
- credentialValues: Actual credential key-value pairs
- OR applicationId if using existing saved application
If the task's appType is 'nocredapp':
- Application configuration can be omitted (pass None or empty)
- The system will automatically use the hardcoded nocredapp application structure:
{
"applicationType": "NoCredApp",
"appURL": "",
"credentialType": "NoCred",
"credentialValues": {"Dummy": ""},
"appTags": {"appType": ["nocredapp"], "environment": ["logical"], "execlevel": ["app"]}
}
===============================================================================
TASK EXECUTION FLOW
===============================================================================
1. Receive task name and collected inputs
2. Check if any input depends on previous task output
3. For dependency inputs:
a. Check if previous task output exists
b. If not, execute previous task first
c. Use real output as input value
4. Prepare execution payload with real data
5. Call task execution API
6. Parse and return execution results with output file URLs
===============================================================================
REQUEST BODY FORMAT
===============================================================================
{
"taskname": "TaskName",
"application": {
"appName": "ApplicationClassName",
"appURL": "https://app.url.com",
"credentialType": "CredentialTypeName",
"credentialValues": {
"key1": "value1",
"key2": "value2"
},
"appTags": [Complete object from of 'appTags' from the task in the rule]
},
"taskInputs": {
"inputs": {
"InputName1": "value_or_file_url",
"InputName2": "value_or_file_url"
}
}
}===============================================================================
Args:
task_name: Name of the task to execute
task_inputs: Dictionary containing key-value pairs of task inputs
Format: {"input_name": "value" or file_url}
application: Optional application configuration for tasks requiring credentials
Format: {
"appName": "ApplicationClassName",
"appURL": "https://...",
"credentialType": "...",
"credentialValues": {...},
"appTags": [Complete object from of 'appTags' from the task in the rule]
}
OR {"applicationId": "existing-app-id", "appTags": [Complete object from of 'appTags' from the task in the rule]}
Returns:
Dict containing:
{
"success": bool,
"execution_status": "COMPLETED" | "FAILED",
"task_name": str,
"task_inputs": dict,
"outputs": dict, # Output file URLs and values
"errors": list,
"message": str,
"next_action": str
}
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes | ||
| task_inputs | Yes | ||
| application | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Given no annotations, the description carries full behavioral burden. It clearly states the tool executes with real data, handles dependencies, and shows results. However, it could explicitly mention that execution may trigger real-world actions (e.g., data modification) beyond what the name implies, but the emphasis on 'real data' and the execution flow strongly implies mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured with clear sections (execution context, dependency handling, configuration, flow) and bullet points. It is front-loaded with the core purpose. While every sentence adds value, it could be slightly more concise, but the complexity warrants the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all aspects: input parameters, dependency logic, error handling, application configuration, execution flow, and return value format. Given the tool's complexity and the presence of an output schema, it is complete and leaves no significant gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by detailing parameter formats: task_name as a string, task_inputs as key-value pairs, and application with appName, credentialType, etc. It provides a complete request body example and explains optionality based on appType, adding critical meaning beyond the minimal schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: executing a specific task with real data after input collection. It emphasizes real data vs. sample, sequential execution, and dependency handling, distinguishing it from sibling tools like execute_rule or fetch_task_details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use the tool ('MUST be called after collecting inputs'), how to handle dependencies (execute previous tasks automatically, use real outputs), and when not to use it (do not generate synthetic data). It also explains fallback on failure and the minimal execution principle.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_applicationsB
Fetch all available applications from the system.
Returns: Dict containing list of applications with their details
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description does not reveal any behavioral traits beyond the basic operation. No details on performance, pagination, data size, or side effects. Since no annotations exist, the description carries the burden but only provides minimal information.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences: purpose and return type. It is front-loaded and avoids unnecessary detail, though a brief note on usage context would improve it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an existing output schema, the description is minimally adequate. However, it lacks context about when to use this tool vs siblings and does not hint at the output schema's richness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so schema coverage is 100% trivially. The description adds no parameter semantics, but none are needed. Baseline for 0 parameters is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch all available applications from the system,' specifying the verb (fetch), resource (applications), and scope (all). It effectively distinguishes itself from siblings like get_application_info (single app) and get_applications_for_tag (filtered).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as get_applications_for_tag. The description lacks context about use cases, performance implications, or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessment_available_actionsA
Get actions available on assessment for given assessment name. Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action. Args:
name (str): Assessment name
Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| totalRecords | No | |
| compliantRecords | No | |
| nonCompliantRecords | No | |
| notDeterminedRecords | No | |
| records | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It describes the return type (List of actions with fields and optional error) but does not mention any side effects, authorization requirements, or potential failures beyond an error message. The description is adequate but lacks depth, such as whether the fetch modifies state or requires specific permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured. It starts with the core purpose, then gives a usage guideline, and finally specifies parameters and return format using clear sections (Args, Returns). No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, well-defined return structure), the description covers all necessary information: what it does, how to use it, what output to expect, and the relationship with 'execute_action'. The output schema is present, so detailed return documentation is not required from description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds bare minimum parameter info: 'Args: - name (str): Assessment name'. This adds no additional meaning beyond the schema's type and default. Schema description coverage is 0%, so the description should compensate, but it only repeats the parameter name and type without format, source, or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get actions available on assessment for given assessment name.' It specifies the verb (fetch), resource (assessment actions), and scope (by name). This distinguishes it from sibling tools like 'fetch_evidence_available_actions' and 'fetch_available_control_actions' by explicitly targeting assessment-level actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear workflow steps: 'Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool...' This tells the agent when to use this tool (before executing) and how to proceed afterward. However, it does not explicitly state when not to use it or mention alternative tools for different action types.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessment_run_detailsB
Get assessment run details for given assessment run id. This api will return many contorls, use page to get details pagewise. If output is large store it in a file.
Args: - id (str): Assessment run id
Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description details return fields and warns about large output ('store it in a file'), but the pagination advice is inconsistent with the schema. With no annotations, it partially discloses behavior but lacks clarity on the missing page parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description front-loads the purpose but then provides an extensive list of return fields. While informative, it is verbose for a tool with an output schema. The structure with Args and Returns is clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers return fields and large output handling, but lacks context on how to obtain the assessment run ID, potential errors beyond the error field, and pagination details. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter (id) with 0% coverage. The description adds meaning by labeling it as 'Assessment run id', which clarifies its purpose. However, the reference to a non-existent 'page' parameter detracts from clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves assessment run details for a given ID, using a specific verb and resource. However, it mentions pagination ('use page to get details pagewise') but the input schema lacks a page parameter, causing slight ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool compared to siblings like fetch_assessment_runs or fetch_run_controls. The description does not specify prerequisites or alternative scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessment_run_leaf_control_evidenceB
Get leaf control evidence for given assessment run control id.
Args:
id (str): Assessment run control id
Returns: - evidences (List[ControlEvidenceVO]): List of control evidences - id (str): Evidence id. - name (str): Evidence name. - description (str): Evidence description. - fileName (str): File name. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| evidences | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description discloses return structure and possible error, implying a read operation. Lacks deeper behavioral context like permissions, side effects, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise with clear header and structured args/returns. Every sentence adds value, though the detailed return description could be slightly trimmed if output schema is sufficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, flat output), the description adequately covers purpose, input, and output. It does not mention empty list handling or prerequisites, but is sufficiently complete for a basic fetch tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description adds value by naming the parameter as 'Assessment run control id'. This adds meaning beyond the bare schema, but could be more specific about format or source.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get leaf control evidence for given assessment run control id', specifying verb, resource, and input. However, it does not distinguish from siblings like fetch_evidence_records or fetch_automated_controls_of_an_assessment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor any context about prerequisites or conditions. The description only provides input and output details.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessment_run_leaf_controlsA
Get leaf controls for given assessment run id. If output is large store it in a file.
Args: - id (str): Assessment run id
Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds limited behavioral context: it notes large output handling and returns an optional error field. However, it does not disclose permission requirements, side effects (likely read-only), or rate limits. The output schema partially compensates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clarity: it starts with the action, includes a note, then documents args and returns. The return section is detailed but appropriate given the output schema presence. It is not overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple fetch tool with one parameter, missing annotations, and an output schema, the description is complete. It covers the argument, return structure (matching output schema), and a caveat for large outputs. No significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'id' has 0% schema coverage, but the description explains it as 'Assessment run id,' which adds meaning beyond the bare type string. This is useful for an agent to understand the parameter's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get leaf controls for given assessment run id,' specifying the verb (Get) and resource (leaf controls) with the key parameter (assessment run id). It distinguishes from siblings like fetch_leaf_controls_of_an_assessment and fetch_run_controls by targeting a specific run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a usage hint about storing large output in a file, but lacks explicit guidance on when to use this tool versus alternatives like fetch_leaf_controls_of_an_assessment. No exclusions or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessment_runsA
Get all assessment run for given assessment id Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize, default page is 1 If the request times out retry with pagination, increasing pageSize from 5 to 10. use this tool when expected run is got in fetch recent assessment runs tool
Args: - id (str): Assessment id
Returns: - assessmentRuns (List[AssessmentRuns]): A list of assessment runs. - id (str): Assessement run id. - name (str): Name of the assessement run. - description (str): Description of the assessment run. - assessmentId (str): Assessement id. - applicationType (str): Application type. - configId (str): Configuration id. - fromDate (str): From date of the assessement run. - toDate (str): To date of the assessment run. - status (str): Status of the assessment run. - computedScore (str): Computed score. - computedWeight (str): Computed weight. - complianceStatus (str): Compliance status. - compliancePCT (str): Compliance percentage. - complianceWeight (str): Compliance weight. - createdAt (str): Time and date when the assessement run was created. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| page | No | ||
| pageSize | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| assessmentRuns | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description discloses pagination behavior, default page, retry on timeout, and covers possible errors. It also fully lists return fields. However, it does not explicitly state read-only nature or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description contains redundant formatting (extra bullet lists) and some repeated info (e.g., page/pageSize explained twice). Could be trimmed to fewer sentences while retaining clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With output schema present and all return fields listed, description covers parameters, errors, pagination, retry logic, and usage context. No critical information missing for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% description coverage, but description fully explains each parameter: id as assessment id, page and pageSize with defaults and usage. This compensates completely for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool fetches all assessment runs for a given assessment ID, and distinguishes itself from fetch_recent_assessment_runs by specifying when to use it. Verb 'Get' and resource 'assessment runs' are explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description provides clear when-to-use guidance: 'use this tool when expected run is got in fetch recent assessment runs tool'. It also gives retry strategy with pageSize. However, it lacks explicit when-not-to-use or alternative tools beyond the one sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assessmentsA
Fetch the list of available assessments in ComplianceCow.
TOOL PURPOSE:
Retrieves a list of available assessments if no specific match is provided.
Returns only basic assessment info (id, name, category) without the full control hierarchy.
Used to confirm the assessment name while attaching a rule to a specific control.
Args:
categoryId (Optional[str]): Assessment category ID.
categoryName (Optional[str]): Assessment category name.
assessmentName (Optional[str]): Assessment name.
Returns:
- assessments (List[Assessments]): A list of assessment objects, each containing:
- id (str): Unique identifier of the assessment.
- name (str): Name of the assessment.
- category_name (str): Name of the category.
- error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| categoryId | No | ||
| categoryName | No | ||
| assessmentName | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the burden. It explicitly states the tool returns only basic info and includes an error field. It does not mention authentication or rate limits, but for a fetch operation, the transparency is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a brief purpose, detailed tool purpose, Args section, and Returns section. It is front-loaded and efficient, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple fetch-list tool, the description fully covers behavior, parameters, and return structure. Even without an output schema, the described return fields (id, name, category_name, error) provide complete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description includes an Args section that explains each parameter (categoryId, categoryName, assessmentName) and their filtering purpose, fully compensating for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches a list of assessments, returning basic info (id, name, category) without full control hierarchy. It distinguishes from sibling tools like list_all_assessments by specifying the limited scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a specific use case: confirming assessment name while attaching a rule to a control. It implies usage for basic retrieval but does not explicitly mention when not to use or alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_assets_summaryC
Get assets summary for given assessment id
Args: - id (str): Assessment id
Returns: - integrationRunId (str): Asset id. - assessmentName (str): Name of the asset. - status (str): Name of the asset. - numberOfResources (str): Name of the asset. - numberOfChecks (str): Name of the asset. - dataStatus (str): Name of the asset. - createdAt (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| planRunID | No | |
| assessmentName | No | |
| status | No | |
| numberOfResources | No | |
| numberOfChecks | No | |
| dataStatus | No | |
| createdAt | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must convey behavioral traits. It implies a read-only operation but lacks details on authentication, rate limits, side effects, or data freshness. The return field descriptions are incorrect (e.g., 'status' described as 'Name of the asset'), which undermines transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a clear first line but becomes verbose with a repetitive and incorrect Returns section. The field descriptions are all the same placeholder text 'Name of the asset.', wasting space and potentially confusing the agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter and lack of structured output schema, the description attempts to document returns but does so with errors. It omits context like the nature of the summary, pagination, or filtering. The inaccuracies reduce completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description explains the sole parameter 'id' as 'Assessment id', adding minimal semantic value beyond the schema. This is adequate for a simple string parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get assets summary for given assessment id', specifying the verb and resource. It distinguishes from sibling tools like fetch_checks_summary or fetch_resources_summary by focusing on assets summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention preconditions, typical use cases, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_automated_controls_of_an_assessmentA
To fetch the only the automated controls for a given assessment. If assessment_id is not provided use other tools to get the assessment and its id.
Args: - assessment_id (str, required): Assessment id or plan id.
Returns: - controls (List[AutomatedControlVO]): List of controls - id (str): Control ID. - displayable (str): Displayable name or label. - alias (str): Alias of the control. - activationStatus (str): Activation status. - ruleName (str): Associated rule name. - assessmentId (str): Assessment identifier. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assessment_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden. It only lists return fields and an error message, but does not disclose side effects, read-only nature, or the inconsistency between the description (required) and schema (optional). This minimal disclosure is insufficient for full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively concise but includes the return structure, which is redundant given the output schema exists. It could be more streamlined without losing essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides basic context for parameter and usage, but does not differentiate from similar sibling tools like fetch_controls. The mismatch between required and optional undermines completeness. Given the output schema covers returns, the description is adequate but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds meaning by clarifying assessment_id as 'Assessment id or plan id' and noting its requirement. However, it contradicts the input schema which has a default and no required flag, reducing clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches 'only the automated controls' for a given assessment, using specific verb and resource. It distinguishes from sibling tools like fetch_controls and fetch_leaf_controls_of_an_assessment by emphasizing 'automated'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using other tools if assessment_id is not provided, providing clear context for when to use this tool. It implies the ID is necessary, but could more explicitly compare with sibling tools for fetching controls.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_available_control_actionsB
This tool should be used for handling control-related actions such as create, update, or to retrieve available actions for a given control.
If no control details are given use the tool "fetch_controls" to get the control details.
Fetch the available actions.
Prompt the user to confirm the intended action.
Once confirmed, use the
execute_actiontool with the appropriate parameters to carry out the operation.
Args:
assessmentName (str): Name of the assessment (required)
controlNumber (str): Identifier for the control (required)
controlAlias (str): Alias of the control (required)
If the above arguments are not available:
Use the
fetch_controlstool to retrieve control details.Then generate and execute a query to fetch the related assessment information before proceeding.
Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assessmentName | Yes | ||
| controlNumber | No | ||
| controlAlias | No | ||
| evidenceName | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| totalRecords | No | |
| compliantRecords | No | |
| nonCompliantRecords | No | |
| notDeterminedRecords | No | |
| records | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description mentions retrieval and lists output fields. Does not disclose side effects, permissions, or error conditions beyond the error field.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is somewhat lengthy with step-by-step instructions that could be separate. Front-loaded with purpose but includes redundant agent instructions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers return values and provides a workflow but lacks parameter descriptions and has inaccuracies. EvidenceName parameter not addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description lists three args as required (contradicting schema where only assessmentName is required) and omits evidenceName. No explanation of what each parameter does beyond its name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves available actions for a control, matching the tool name. It distinguishes from sibling tools like fetch_controls and execute_action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: use fetch_controls if control details missing, prompt user, then use execute_action. However, it does not explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_cc_rule_by_idA
Fetch rule details by rule id from the compliancecow.
Args: rule_id: Rule Id of the rule to retrieve
Returns: Dict containing complete rule structure and metadata
| Name | Required | Description | Default |
|---|---|---|---|
| rule_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description indicates a read-only operation ('Fetch ... details'), but lacks detail on side effects, authentication, or error cases. Adequate for a simple fetch, but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sections (Args, Returns) and uses bold for emphasis. It is well-structured and avoids redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool and presence of an output schema (not shown here), the description sufficiently covers the purpose and parameters. The Returns clause adds context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains the only parameter 'rule_id' as 'Rule Id of the rule to retrieve,' adding meaning beyond the schema (0% coverage). Clear and helpful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch rule details by rule id from the compliancecow,' specifying the verb+resource and distinguishing from siblings like 'fetch_cc_rule_by_name' and 'fetch_cc_rules_list'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have a rule ID but provides no explicit guidance on when not to use or alternatives. Basic clarity is present, but no comparative advice is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_cc_rule_by_nameA
Fetch rule details by rule name from the compliancecow.
Args: rule_name: Rule name of the rule to retrieve
Returns: Dict containing complete rule structure and metadata
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavioral traits. It only states it returns a dict, but does not mention it is a read-only operation, error behavior if rule not found, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with no wasted words: a single sentence for purpose plus clear Args/Returns sections. Front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple fetch tool with one parameter and an existing output schema, the description covers the essential purpose and return type. Minor gap: no mention of error scenarios, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must add meaning. It says 'rule_name: Rule name of the rule to retrieve' which merely repeats the parameter name without adding format, case sensitivity, or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Fetch rule details by rule name from the compliancecow' with a specific verb and resource, and clearly differentiates from sibling tools like 'fetch_cc_rule_by_id' (fetch by ID) and 'fetch_cc_rules_list' (list all rules).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives (e.g., by ID or list). The purpose implies usage when the rule name is known, but lacks exclusions or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_cc_rules_listA
Fetch list of CC rules with only name, description, and id. This tool should ONLY be used for attaching rules to control flows.
Args: params: Optional query parameters for filtering/pagination - name_contains: Filter rules by name containing this string - page_size: Number of items to be returned (default 100)
Returns: List of simplified rule objects containing only name, description, and id
| Name | Required | Description | Default |
|---|---|---|---|
| params | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return format and filtering/pagination parameters but does not mention side effects (likely a read operation), permissions, rate limits, or other behavioral traits. Basic transparency is present but lacks deeper context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two paragraphs covering purpose and usage first, then args and returns. Every sentence adds value, with no fluff. Minor improvement could be merging the first sentence with the guideline for tighter structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (list fetch with one param and known output schema), the description covers purpose, usage, parameters, and returns. Lacks explanation of the 'CC' acronym and the context of 'control flows', but overall is complete for the agent's needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% coverage (single 'params' object with additionalProperties). The description compensates by listing two specific sub-parameters (name_contains and page_size) with descriptions and defaults, adding significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Fetch' and the resource 'list of CC rules with only name, description, and id'. It distinguishes from sibling tools like fetch_cc_rule_by_id or fetch_cc_rule_by_name by indicating it returns a list. However, the acronym 'CC' is not explained, which may cause ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states 'This tool should ONLY be used for attaching rules to control flows,' providing a strong usage constraint. It does not explicitly list alternatives or when-not conditions, but the clear directive guides the agent appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_checksA
Get checks for given assets run id and resource type. Use this function to get all checks for given assets run id and resource type Use 'fetch_assets_summary' tool to get asset run id Use 'fetch_resource_types' tool to get all resource types Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 5 to 10.
If the check data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the checks.
Call fetch_checks with page=1, pageSize=10
Note the totalPages from the response
Continue calling each page until complete
Summarize all results together
Args: - id (str): Asset run id - resourceType (str): Resource type - complianceStatus (str): Compliance status
Returns: - checks (List[CheckVO]): A list of checks. - name (str): Name of the check. - description (str): Description of the check. - rule (RuleVO): Rule associated with the check. - type (str): Type of the rule. - name (str): Name of the rule. - activationStatus (str): Activation status of the check. - priority (str): Priority level of the check. - complianceStatus (str): Compliance status of the check. - compliancePCT (float): Compliance percentage. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| resourceType | Yes | ||
| page | No | ||
| pageSize | No | ||
| complianceStatus | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| checks | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. Discloses pagination, timeout handling, return structure (checks list with error), and large dataset alternatives. Lacks permissions info but acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-organized into sections (overview, args, returns) but verbose with repetitive first two sentences. Could trim redundancies for better conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers complexity: pagination, timeout, large dataset alternative, return schema. Includes step-by-step usage but omits error handling details beyond error field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, description explains all 5 parameters: id, resourceType, complianceStatus, page, pageSize. Adds practical guidance on pageSize defaults and usage, though complianceStatus values not specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Get checks for given assets run id and resource type', with explicit contrast to the summary tool for large datasets, differentiating from sibling fetch_checks_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance (use summary for large datasets), prerequisite tools (fetch_assets_summary, fetch_resource_types), and step-by-step pagination instructions with fallback for timeouts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_checks_summaryA
Use this to get the summary on checks Use this when total items in 'fetch_checks' is high Get checks summary for given asset run id and resource type. Get a summarized view of resources based on - Compliance breakdown for checks - Total Checks available - Total compliant checks - Total non-compliant checks
Args: - id (str): Asset run id - resourceType (str): Resource type
Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| resourceType | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| complianceSummary | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must cover behavioral traits. It does not disclose side effects, permissions, rate limits, or whether the operation is read-only. It only mentions return values and minimal error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description contains redundancy (e.g., 'Use this to get the summary on checks' followed by 'Get checks summary...'). It could be more concise, but the structure with Args/Returns is clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an implied output schema, and the description covers the return fields (complianceSummary, error). The input parameters are explained, and usage context is provided. It is sufficiently complete for a summary tool, though the structure of complianceSummary could be detailed more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description explains each parameter ('id' as asset run ID, 'resourceType' as resource type). This adds meaningful context beyond the schema structure, though it lacks details on possible value formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides a summary of checks for a given asset run ID and resource type, with a compliance breakdown. It distinguishes itself from sibling tools like fetch_checks by explicitly referencing when to use this summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a specific condition for use: when total items in fetch_checks is high. It implicitly suggests using fetch_checks for lower counts, and names the sibling tool fetch_checks, providing clear guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_controlsC
To fetch controls. Args: control_name (str): name of the control.
Returns: - prompt (str): The input prompt used to generate the Cypher query for fetching the control.
| Name | Required | Description | Default |
|---|---|---|---|
| control_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| prompt | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description discloses that the tool returns a 'prompt' rather than control data, which is critical behavior, but does not explain the rationale or what the prompt is used for. No mention of idempotency or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (two sentences), but it is more underspecified than concise. It does not waste words, but lacks necessary detail. An acceptable score for conciseness, but borderline.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fails to fully explain the tool's behavior. It does not mention that an output schema exists, nor does it describe the actual control data (if any) that the prompt relates to. Incomplete for a simple tool given the lack of annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage. The description adds only 'name of the control' for the parameter, but does not clarify its format, that it is optional (has default), or how it affects the prompt. Insufficient for an agent to use correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'To fetch controls' which is nearly tautological with the name. It then describes the return as a prompt, creating confusion between fetching controls and returning a query prompt. The purpose is unclear and potentially misleading.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus the many sibling fetch tools (e.g., fetch_run_controls, fetch_checks). No context about prerequisites or use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_dashboard_framework_controlsA
Function Overview: Retrieve Control Details for a Given CCF and Review Period
This function retrieves detailed control-level data for a specified Common Control Framework (CCF) during a specific review period.
Args:
review_period: The compliance period (typically a quarter) for which the control-level data is requested.
Format:"Q1 2024"framework_name:
The name of the Common Control Framework to fetch data for.
Purpose
This function is used to fetch a list of controls and their associated data for a specific CCF and review period.
It does not return an aggregated overview — instead, it retrieves detailed, item-level data for each control via an API call.
The results are displayed in the MCP host with client-side pagination, allowing users to navigate through the control list efficiently without making repeated API calls.
Returns: - controls (List[FramworkControlVO]): A list of framework controls. - name (str): Name of the control. - assignedTo (str): Email ID of the user the control is assigned to. - assignmentStatus (str): Status of the control assignment. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for completing the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - page (int): Current page number in the overall result set. - totalPage (int): Total number of pages. - totalItems (int): Total number of items. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| framework_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
As no annotations exist, the description bears full responsibility. It discloses the API call, returns pagination info, and mentions an optional error field, but lacks detail on rate limits or authentication.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is fairly long and contains some redundant phrasing (e.g., repeating the purpose). It is well-structured with sections, but could be more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, the description covers input parameters, return fields, and pagination details sufficiently. It is complete for a fetch tool, though lacks some behavioral nuance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds value by explaining the purpose and format of both parameters. However, there is a naming mismatch (review_period vs. period) that could confuse the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves detailed control-level data for a specific CCF and review period, distinguishing it from aggregated overview tools like fetch_dashboard_framework_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly tells when to use this tool (for detailed item-level data) vs. aggregated overview, but does not explicitly name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_dashboard_framework_summaryB
Function Overview: CCF Dashboard Summary Retrieval
This function returns a summary dashboard for a specified compliance period and Common Control Framework (CCF). It is designed to provide a high-level view of control statuses within a given framework and period, making it useful for compliance tracking, reporting, and audits.
Args:
period:
The compliance quarter for which the dashboard data is requested.
Format:"Q1 2024"framework_name:
The name of the Common Control Framework whose data is to be retrieved.
Dashboard Overview
The dashboard provides a consolidated view of all controls under the specified framework and period. It includes key information such as assignment status, compliance progress, due dates, and risk scoring to help stakeholders monitor and manage compliance posture.
Returns: - controls (List[FramworkControlVO]): A list of framework controls. - name (str): Name of the control. - assignedTo (str): Email ID of the user the control is assigned to. - assignmentStatus (str): Status of the control assignment. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for completing the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - page (int): Current page number in the overall result set. - totalPage (int): Total number of pages. - totalItems (int): Total number of items. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| framework_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It explains the read-only nature and return structure, but does not disclose side effects, authentication needs, or rate limits. A score of 3 reflects adequate but incomplete behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections for Args, Returns, and Overview, but is verbose and could be more concise. The first sentence front-loads the purpose, but some details are redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (2 string params) and the presence of an output schema in the description, the description is fairly complete. It explains purpose, parameters, and return values, though it lacks details on pagination behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds meaningful context: period format (e.g., 'Q1 2024') and framework_name explanation. This significantly aids the agent in providing correct values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns a summary dashboard for a compliance period and CCF, with a high-level view of control statuses. However, it does not differentiate from sibling tools like fetch_dashboard_framework_controls, which may have overlapping functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it is useful for compliance tracking, reporting, and audits, but provides no explicit guidance on when to use this tool versus alternatives. No when-not or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_evidence_available_actionsA
Get actions available on evidence for given evidence name.
If the required parameters are not provided, use the existing tools to retrieve them.
Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action.
Args:
- assessment_name (str): assessment name (required)
- control_number (str): control number (required)
- control_alias (str): control alias (required)
- evidence_name (str): evidence name (required)
Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assessment_name | No | ||
| control_number | No | ||
| control_alias | No | ||
| evidence_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| actions | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It details the return structure (actions list with fields and optional error) and implies read-only behavior by stating 'get actions available.' It does not contradict any annotations, as none are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an overview, workflow advice, and clearly separated Args/Returns sections. It is relatively concise given the detail provided, though the workflow advice could be slightly trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 4 parameters and the presence of an output schema, the description adequately covers the tool's inputs, outputs, and usage context. It also references sibling tools (like 'execute_action' and other retrieval tools) to complete the picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% coverage, but the description lists all four parameters (assessment_name, control_number, control_alias, evidence_name) with types and explicitly marks them as required, compensating for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get actions available on evidence for given evidence name.' It specifies the required parameters and distinguishes from similar fetch tools by focusing on evidence-level actions, though it does not explicitly contrast with siblings like fetch_available_control_actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit workflow guidance: if parameters are missing, use other tools to retrieve them; after fetching, ask user to confirm and then use 'execute_action'. This clearly indicates when to use this tool and the subsequent steps, though it lacks explicit 'when not to use' statements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_evidence_recordsA
Get evidence records for a given evidence ID with optional compliance status filtering. Returns max 50 records but counts all records for the summary.
Args: - id (str): Evidence ID - compliantStatus Optional[(str)]: Compliance status to filter "COMPLIANT", "NON_COMPLIANT", "NOT_DETERMINED" (optional).
Returns:
- totalRecords (int): Total records.
- compliantRecords (int): Number of complian records.
- nonCompliantRecords (int): Number of non compliant records.
- notDeterminedRecords (int): Number of not determined records.
- records (List[RecordListVO]): List of evidence records.
- id (str): Record id.
- name (str): System name.
- source (str): Record source.
- resourceId (str): Resource id.
- resourceName (str): Resource name.
- resourceType (str): Resource type.
- complianceStatus (str): Compliance status.
- complianceReason (str): Compliance reason.
- createdAt (str): The date and time the record was initially created.
- otherInfo (Any): Additional information.
- error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| compliantStatus | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| totalRecords | No | |
| compliantRecords | No | |
| nonCompliantRecords | No | |
| notDeterminedRecords | No | |
| records | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses important behavioral traits: returns max 50 records but counts all records for summary, includes an error field. Since no annotations are provided, the description adequately covers the tool's behavior beyond the input schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args/Returns sections, but includes a verbose return type specification that could be trimmed. However, the front-loaded summary sentence quickly conveys the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and a single output schema, the description covers all essential aspects: input filtering, max records, return fields (including summary counts and error messages). It is complete for a fetch tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully explains both parameters: 'id' (evidence ID) and 'compliantStatus' (optional, with enumerated values listed). This adds significant meaning beyond the schema's property types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it fetches evidence records for a given evidence ID with optional compliance status filtering. The verb 'fetch' is specific, and the resource 'evidence records' is well-defined, distinguishing it from sibling tools that fetch other entities (e.g., applications, controls).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Usage is implied through the description of inputs and outputs, but lacks direction on context or prerequisites (e.g., when to choose this over other fetch tools).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_evidence_record_schemaB
Get evidence record schema for a given evidence ID. Returns the schema of evidence record.
Args: - id (str): Evidence ID
Returns: - records (List[RecordListVO]): List of evidence record schema. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| schema | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It explains the return values (List of RecordListVO and optional error) but does not mention side effects, authentication needs, or rate limits. It is adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded, starting with the core purpose. The docstring-style formatting adds clarity, though it could be slightly more compact. Overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (though not shown), the description's mention of return types (records, error) is sufficient. However, it does not elaborate on the structure of 'RecordListVO' or edge cases, leaving some gaps for a tool with only one parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It lists the 'id' parameter with type 'str' and a brief description ('Evidence ID'), but adds no format, constraints, or examples beyond the schema. This is minimal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the schema of an evidence record for a given evidence ID, using a specific verb ('Get') and resource ('evidence record schema'). It is distinct from siblings like 'fetch_evidence_records', which likely returns the records themselves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., 'fetch_evidence_records') or any conditions for usage. It lacks explicit 'when to use' or 'when not to use' information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_execution_progressA
Fetch execution progress for a running rule.
IMPORTANT FOR CLAUDE/CLIENT:
This tool returns a snapshot of current progress. To see real-time updates:
Call this tool repeatedly every 1 seconds
Check the "continue_polling" flag in response
If continue_polling=true, call again after 1 seconds
If continue_polling=false, execution is complete
DISPLAY INSTRUCTIONS FOR CLAUDE:
When displaying progress, REPLACE the previous output (don't append):
🔄 Execution Progress (Live) ─────────────────────────────────
Show each task on ONE line that UPDATES in place: • task_name (type) [progress_bar] XX% STATUS
Use these Unicode blocks for progress bars:
COMPLETED: 🟦 (blue blocks)
INPROGRESS: 🟩 (green blocks)
ERROR: 🟥 (red blocks)
PENDING: ⬜ (white blocks)
After each poll, REPLACE the entire progress display with new data. DO NOT show multiple versions of the same task.
EXAMPLE DISPLAY SEQUENCE: Poll 1: • fetch_users (HTTP) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING • process_data (Script) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING
Poll 2 (REPLACES above): • fetch_users (HTTP) 🟩🟩🟩🟩⬜⬜⬜⬜⬜⬜ 40% INPROGRESS • process_data (Script) ⬜⬜⬜⬜⬜⬜⬜⬜⬜⬜ 0% PENDING
Poll 3 (REPLACES above): • fetch_users (HTTP) 🟦🟦🟦🟦🟦🟦🟦🟦🟦🟦 100% COMPLETED • process_data (Script) 🟩🟩🟩⬜⬜⬜⬜⬜⬜⬜ 30% INPROGRESS
RESPONSE FLAGS:
continue_polling: true = keep polling every 1 seconds
continue_polling: false = execution complete, show final summary
display_mode: "replace" = replace previous display
UI DISPLAY REQUIREMENT:
The file URL must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.
Args: rule_name: Rule being executed execution_id: ID from execute_rule()
Returns: Dict with progress data and polling instructions
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| execution_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description discloses that it returns a snapshot, polling behavior, and response flags. No annotations exist, so description carries full burden; it covers expected behavioral traits like real-time updates and completion detection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is bloated with extensive display instructions and examples that are not essential for tool selection/invocation. The core behavior is only a small part; the rest could be separate guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers polling and response but lacks error handling, idempotency, or restrictions. Output schema exists, so return description is sufficient, but behavioral context is incomplete without annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds minimal semantics via 'Args:' line explaining rule_name and execution_id. This is helpful but basic, lacking details like formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch execution progress for a running rule' with a specific verb and resource. While it lacks explicit differentiation from sibling tools like 'check_rule_status', the name itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit polling instructions: 'call this tool repeatedly every 1 seconds', check 'continue_polling' flag, and criteria for stopping. Clear when to use and how to interpret response.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_general_available_actionsA
Get general actions available on assessment, control & evidence. Once fetched, ask user to confirm to execute the action, then use 'execute_action' tool with appropriate parameters to execute the action. For inputs use default value as sample, based on that generate the inputs for the action. Args: - type (str): Type of the action, can be "assessment", "control" or "evidence".
Returns: - actions (List[ActionsVO]): List of actions - actionName (str): Action name. - actionDescription (str): Action description. - actionSpecID (str): Action specific id. - actionBindingID (str): Action binding id. - target (str): Target. - ruleInputs: Optional[dict[str, Any]]: Rule inputs for the action, if applicable. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| actions | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It indicates a read operation and lists return structure and error. Could add more about auth or idempotency but adequate for a fetch tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with purpose, then workflow instructions, then parameter details. Every sentence adds value, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter tool with output schema, the description covers purpose, parameter, return structure, and usage workflow, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 0% coverage, but description explicitly explains parameter 'type' with valid values ('assessment', 'control', 'evidence'), adding meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets 'general actions available on assessment, control & evidence', using a specific verb ('get') and resource. It distinguishes from siblings like 'fetch_assessment_available_actions' by being 'general'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear workflow: fetch, ask user to confirm, then use 'execute_action' tool. Implicitly guides when to use (for general actions) but does not explicitly exclude alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_leaf_controls_of_an_assessmentA
To fetch the only the leaf controls for a given assessment. If assessment_id is not provided use other tools to get the assessment and its id.
Args: - assessment_id (str, required): Assessment id or plan id.
Returns: - controls (List[AutomatedControlVO]): List of controls - id (str): Control ID. - displayable (str): Displayable name or label. - alias (str): Alias of the control. - activationStatus (str): Activation status. - ruleName (str): Associated rule name. - assessmentId (str): Assessment identifier. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assessment_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but the description discloses the return structure and error field. It implies a read-only operation ('fetch') and adds behavioral context beyond the schema, though it could mention if there are any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with a clear one-line purpose followed by structured Args and Returns. No unnecessary information, and key points are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description adequately covers purpose, parameter, and return structure. It could be improved by noting any limitations or differences from sibling tools, but is still complete for typical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema: it states the parameter is required (despite schema default) and explains it's 'assessment id or plan id.' This compensates for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches 'leaf controls' for a given assessment. It distinguishes from siblings like 'fetch_automated_controls_of_an_assessment' by specifying 'leaf', but lacks explicit differentiation from other similar tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: 'If assessment_id is not provided use other tools to get the assessment and its id.' This helps the agent know when to use this tool vs alternatives, though it doesn't mention specific sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_output_fileA
Fetch and display content of an output file from rule execution.
FILE OUTPUT HANDLING:
WHEN TO USE:
Rule execution output contains file URLs
User requests to view specific file content
Files contain reports, logs, compliance data, or analysis results
CONTENT DISPLAY LOGIC:
If file size < 10KB: Show entire file content
If file size >= 10KB: Show only first 3 records/lines with user-friendly message
Supported formats: JSON, CSV, Parquet, and other text files
Always return file format extracted from filename
Provide clear user messaging about content truncation
CRITICAL: If content is truncated or full content, include truncation message with the display_content
The file URL (file_url) must ALWAYS be displayed to the user in the UI, allowing the user to view or download the file directly.
MANDATORY CONTENT DISPLAY FORMAT:
FileName: [extracted from file_url]
Format: [file format from file_format]
Message: [truncation status or completion message if applicable user_message]
Content: [display_content based on file format show the entire display_content]
File URL: [always show the file_url in the UI so the user can view or download the file] Args: file_url: URL of the file to fetch and display
Returns: Dict containing file content, metadata, and display information
| Name | Required | Description | Default |
|---|---|---|---|
| file_url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully compensates by detailing content display logic (truncation at 10KB, first 3 lines, format support), mandatory URL display, and user messaging. This provides comprehensive behavioral transparency beyond what annotations would typically cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose, containing multiple sections (overview, WHEN TO USE, CONTENT DISPLAY LOGIC, MANDATORY FORMAT) with some redundancy (e.g., truncation mentioned twice). It could be more streamlined while retaining key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple schema (one parameter) and presence of an output schema, the description thoroughly covers purpose, usage, behavior, parameter, and return format (via MANDATORY CONTENT DISPLAY FORMAT). No gaps remain for the user to guess about.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description adds a brief 'Args: file_url: URL of the file to fetch and display' that provides essential meaning. While not extensive, it clarifies the parameter's role beyond the schema's bare type definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch and display content of an output file from rule execution' with specific verb and resource. The WHEN TO USE section further clarifies scope, differentiating it from other fetch tools by focusing on rule execution output files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a WHEN TO USE section that lists specific scenarios (rule execution output contains file URLs, user requests to view file content, files contain reports/logs). However, it does not explicitly state when not to use the tool or suggest alternative tools, which would improve differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_recent_assessment_runsC
Get recent assessment run for given assessment id
Args: - id (str): assessment id
Returns: - assessmentRuns (List[AssessmentRuns]): A list of assessment runs. - id (str): Assessement run id. - name (str): Name of the assessement run. - description (str): Description of the assessment run. - assessmentId (str): Assessement id. - applicationType (str): Application type. - configId (str): Configuration id. - fromDate (str): From date of the assessement run. - toDate (str): To date of the assessment run. - status (str): Status of the assessment run. - computedScore (str): Computed score. - computedWeight (str): Computed weight. - complianceStatus (str): Compliance status. - compliancePCT (str): Compliance percentage. - complianceWeight (str): Compliance weight. - createdAt (str): Time and date when the assessement run was created. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| assessmentRuns | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states the function returns a list of runs. It does not disclose whether the call is read-only, destructive, or has authentication or rate limit implications. The return type is mentioned but behavioral traits are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with clear Args/Returns sections and front-loaded with the primary purpose. However, the extensive return field list could be shortened if an output schema is available.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input and provided output details, the description is mostly complete. However, it lacks usage guidance and behavioral context, which are important for an agent to correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description restates the sole parameter 'id' as 'assessment id', adding no semantic value beyond the schema. With 0% schema description coverage, the description should elaborate on expected format or examples, which it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches recent assessment runs for a given assessment ID. However, it does not define what 'recent' means or differentiate from sibling tools like fetch_assessment_runs, which may return all runs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., fetch_assessment_run_details for a specific run, fetch_assessment_runs for all runs). The description lacks context for appropriate selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_resourcesA
Get resources for given asset run id and resource type Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize, default page is 1 If the request times out retry with pagination, increasing pageSize from 5 to 10.
If the resource data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the resource.
Call fetch_resources with page=1, pageSize=10
Note the totalPages from the response
Continue calling each page until complete
Summarize all results together
Args: - id (str): Asset run id - resourceType (str): Resource type - complianceStatus (str): Compliance status
Returns: - resources (List[ResourceVO]): A list of resources. - name (str): Name of the resource. - resourceType (str): Type of the resource. - complianceStatus (str): Compliance status of the resource. - checks (List[ResourceCheckVO]): List of checks associated with the resource. - name (str): Name of the check. - description (str): Description of the check. - rule (RuleVO): Rule applied in the check. - type (str): Type of the rule. - name (str): Name of the rule. - activationStatus (str): Activation status of the check. - priority (str): Priority level of the check. - controlName (str): Name of the control. - complianceStatus (str): Compliance status specific to the resource. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| resourceType | Yes | ||
| page | No | ||
| pageSize | No | ||
| complianceStatus | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| resources | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully covers pagination behavior, timeout handling, and response structure. It discloses the step-by-step process for paginating through results. Missing details on required permissions or rate limits, but otherwise transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is verbose, including a lengthy nested return structure and step-by-step pagination list. While structured, it could be more concise. The first sentence is clear, but later sections add redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description includes an output schema, which reduces the need for return value explanation, but it still duplicates some information. It covers pagination and timeouts but lacks details on valid values for resourceType and complianceStatus, and error scenarios beyond the error field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains page and pageSize semantics through pagination instructions but only provides minimal label-like descriptions for id and resourceType ('Asset run id', 'Resource type'). complianceStatus is not explained at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get resources for given asset run id and resource type', specifying the verb 'get' and the resource. It distinguishes from sibling tools like fetch_resources_by_check_name by emphasizing asset run id and resource type parameters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit pagination instructions and recommends using the 'summary tool' for large datasets, offering clear guidance on when to use pagination and an alternative. However, it does not directly contrast with all sibling tools like fetch_resources_summary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_resources_by_check_nameA
Get resources for given asset run id, and check name. Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 10 to 50.
If the resource data set is large to fetch efficiently or results in timeouts, it is recommended to use the 'summary tool' instead to get a summarized view of the resource.
Call fetch_resources_for_check with page=1, pageSize=10
Note the totalPages from the response
Continue calling each page until complete
Summarize all results together
Args: - id: Asset run id. - checkName: Check name.
Returns: - resources (List[ResourceVO]): A list of resources. - name (str): Name of the resource. - resourceType (str): Type of the resource. - complianceStatus (str): Compliance status of the resource. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| checkName | Yes | ||
| page | No | ||
| pageSize | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| resources | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses pagination requirements, timeout behavior, error handling, and return structure (list of resources with fields). However, it doesn't explicitly state read-only nature but implies it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with purpose first, then details, but contains some redundancy (e.g., pagination details repeated). Could be slightly more concise without losing value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given complexity (paginated fetch, potential timeouts) and no annotations, description covers key aspects: pagination, alternatives, return structure, and error handling. Output schema supplements completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description adds meaning by explaining id and checkName in Args and describing page/pageSize usage in text. Missing page/pageSize in formal Args section slightly reduces clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets resources for a given asset run id and check name, distinguishing from summary variant by recommending the summary tool for large datasets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides when to use pagination, retry with increasing pageSize, and suggests using the summary tool when data is large, including step-by-step pagination instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_resources_by_check_name_summaryA
Use this to get the summary on check resources Use this when total items in 'fetch_resources_for_check' is high Get check resources summary for given asset run id, resource type and check Paginated data is enough for summary Get a summarized view of check resources based on - Compliance breakdown for resources - Total Resources available - Total compliant resources - Total non-compliant resources
Args: - id (str): Asset run id - resourceType (str): Resource type
Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| resourceType | Yes | ||
| check | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| complianceSummary | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses the return format (compliance summary with breakdown) and that it's a summary, implying no side effects. However, it does not mention pagination behavior or rate limits, which would be helpful but not critical for a fetch operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat verbose with repeated phrases like 'Use this to get the summary on check resources'. It has bullet points and sections, but could be more concise. The structure is clear but not tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (indicated), the description doesn't need to fully detail returns, but it does include a returns section. However, it fails to document the 'check' parameter and does not clarify pagination details. For a tool with 3 required parameters, the description is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description only explains two of three required parameters (id and resourceType) in the Args section, omitting 'check'. This is a significant gap. No format, enums, or constraints are mentioned, leaving the agent uncertain about the 'check' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: fetching a summary of check resources. It uses specific verbs ('get summary') and resources ('check resources') and distinguishes from the sibling tool 'fetch_resources_by_check_name' by mentioning it's a summary when items are many.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this when total items in fetch_resources_for_check is high', providing clear context for when to use this tool versus alternatives. Also notes that paginated data is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_resources_summaryA
Use this to get the summary on resource
Use this when total items in 'fetch_resources' is high
Fetch a summary of resources for a given asset run id and resource type.
Get a summarized view of resources include
- Compliance breakdown for resource
- Total Resources available
- Total compliant resources
- Total non-compliant resourcesArgs: - id (str): asset run ID - resourceType (str): Resource type
Returns: - complianceSummary (dict): Summary of compliance status across checks. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| resourceType | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| complianceSummary | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. It describes return structure and error field but lacks details on side effects, permissions, or rate limits. Adequate for a read operation but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description has some redundancy ('Use this to get the summary on resource' then 'Fetch a summary...') and informal phrasing. Structured with bullet points and Args/Returns, but could be more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema provided but Has output schema true, the description partially describes output but not fully (complianceSummary dict lacks key structure). Adequate for simple tool but missing details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description adds meaning by labeling id as 'asset run ID' and resourceType as 'Resource type', which compensates well. Also lists Returns section, adding value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches a summary of resources for a given asset run ID and resource type, listing compliance breakdown. It distinguishes from sibling fetch_resources by suggesting use when total items is high.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use when total items in fetch_resources is high, providing clear context for when to choose this tool. Does not mention other alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_resource_typesA
Get resource types for given asset run id. Use 'fetch_assets_summary' tool to get assets run id Function accepts page number (page) and page size (pageSize) for pagination. If MCP client host unable to handle large response use page and pageSize. If the request times out retry with pagination, increasing pageSize from 50 to 100.
Call fetch_resource_types with page=1, pageSize=50
Note the totalPages from the response
Continue calling each page until complete
Summarize all results together
Args: - id(str): Asset run id
Returns:
- resourceTypes (List[AssetsVo]): A list of resource types.
- resourceType (str): Resource type.
- totalResources (int): Total number of resources.
- error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| page | No | ||
| pageSize | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses pagination behavior, retry strategy on timeout, and return of totalPages. Without annotations, it covers key behavioral aspects but omits details like idempotency or caching.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear steps and bullet points. It is somewhat verbose but each part adds value, especially the numbered pagination process.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers prerequisites, input, output, and pagination workflow. Given the presence of sibling tools and no output schema in structured form, the description compensates well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Explains each parameter's purpose and pagination usage. However, there is a contradiction: schema default for pageSize is 0, but description suggests starting at 50, which could confuse agents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets resource types for a given asset run ID. The verb 'Get' and resource 'resource types' are specific, and it distinguishes from siblings like fetch_resources and fetch_resources_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on using fetch_assets_summary to obtain the ID, and detailed pagination steps. However, it lacks explicit mention of when not to use this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_ruleA
Fetch rule details by rule name.
Args: rule_name: Name of the rule to retrieve
Returns: Dict containing complete rule structure and metadata
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It states the return type (Dict with rule structure and metadata) but does not disclose potential side effects, permissions, error conditions, or rate limits. The description is minimal but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using a clear and standard format (description, Args, Returns). Every sentence serves a purpose with no redundancy. It is well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description does not need to detail return values extensively. It correctly mentions the return type. However, it lacks information on error handling or usage constraints. For a simple fetch tool, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to the sole parameter by specifying 'Name of the rule to retrieve' in the Args section. Since schema coverage is 0%, this explanation is valuable and clarifies the parameter's purpose beyond the schema's type-only definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches rule details by rule name. It identifies the specific resource (rule) and the unique identifier (name), distinguishing it from sibling tools that fetch by ID or list rules. However, it does not explicitly differentiate from fetch_cc_rule_by_name, which may be similar.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like fetch_cc_rule_by_id, fetch_cc_rules_list, or fetch_rule_design_notes. There is no mention of prerequisites, exclusions, or context for optimal use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_rule_design_notesC
Fetch and manage design notes for a rule.
WORKFLOW:
CHECK EXISTING NOTES:
Always check if design notes exist for the rule first (whether user wants to create or view)
If found: Present complete notebook to user in readable format
If not found: Offer to create new ones
IF NOTES EXIST:
Show complete notebook with all sections (this serves as the VIEW)
Ask: "Here are your design notes. Modify or regenerate?"
USER OPTIONS:
MODIFY:
Ask "Do you need any changes to the design notes?"
If no changes needed: Get user confirmation, then call create_design_notes() to update
If changes needed: Collect modifications, show preview, get confirmation, then call create_design_notes() to update
REGENERATE:
Generate the design notes using generate_design_notes_preview()
Show preview to user
Get user confirmation
If confirmed: Call create_design_notes() to save the regenerated design notes
CANCEL: End workflow
IF NO NOTES EXIST:
Inform user no design notes found
Ask: "Create comprehensive design notes for this rule?"
If yes: Generate the design notes using generate_design_notes_preview()
Show preview to user
Get user confirmation
If confirmed: Call create_design_notes() to generate
KEY RULES:
MUST follow this workflow explicitly step by step
Always check for existing notes first whenever user asks about design notes (create or view)
ALWAYS get user confirmation before calling create_design_notes()
If any updates needed, explicitly call create_design_notes() tool to save changes
Present notes in Python notebook format
Use create_design_notes() for creation and updates
Args: rule_name: Name of the rule
Returns: Dict with success status, rule name, design notes content, and error details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It describes a multi-step workflow that involves calling other tools, but doesn't clearly state that this tool itself only fetches data and relies on others for mutations. The side effects and dependencies are not transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly long (over 30 lines) with a detailed workflow that belongs in a separate guide rather than a tool description. It lacks conciseness and front-loading; the core purpose is buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the return dict format and workflow steps, but it mixes orchestration instructions with the tool's function. It is complete in the sense of detailing a process, but that process blurs the line between this tool and others, potentially leading to misuse.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (rule_name) with 0% schema description coverage. The description merely restates 'Name of the rule' without adding meaningful context (e.g., format, case sensitivity, required source).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Fetch and manage design notes', which broadens the purpose beyond 'fetch'. It includes creation and update workflows, but the tool name suggests only fetching. This ambiguity makes it unclear whether this tool is a simple fetcher or a workflow orchestrator.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like create_design_notes or generate_design_notes_preview. The workflow implies usage but doesn't state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_rule_readme_documentaionA
Retrieve README documentation for a specific rule by name.
Fetches the complete README documentation for a rule, providing detailed information about the rule's purpose, usage instructions, prerequisites, and implementation steps. This is useful for understanding how to properly use a rule in workflows.
Args: name (str): The exact name of the rule to retrieve README for
Returns: - readmeText (str): Complete README documentation as readable text - ruleName (str): Name of the rule for reference - error (str): Error message if retrieval fails or README not available
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| readmeText | No | |
| ruleName | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only operation by saying 'Retrieve' and detailing the return fields, but it does not disclose potential errors, permissions required, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections, but could be slightly more concise. The opening sentence is clear, and the details are appropriately placed without extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity (1 parameter) and presence of an output schema, the description adequately covers purpose, parameter semantics, and return fields. It does not need to explain return values in depth since the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema: it explains the 'name' parameter as 'The exact name of the rule to retrieve README for'. Given 0% schema coverage, this fully compensates for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve' and resource 'README documentation for a specific rule by name'. It distinguishes from sibling tools like create_rule_readme, update_rule_readme, and fetch_rule_design_notes by specifying this is for documentation reading only.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes this is useful 'for understanding how to properly use a rule in workflows', providing a clear use case. However, it does not explicitly mention when not to use it or contrast with alternatives like create_rule_readme.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_rules_suggestionsA
Tool-based version of fetch_rules_and_tasks_suggestions for improved compatibility and prevention of duplicate rule creation.
This tool serves as the initial step in the rule creation process. It helps determine whether the user's proposed use case matches any existing rule in the catalog.
PURPOSE:
To analyze the user's use case and avoid duplicate rule creation by identifying the most suitable existing rule based on its name, description, and purpose.
NEW: Check for partially developed rules in local system before allowing new rule creation
NEW: Present resumption options if incomplete rules are found to prevent duplicate work
WHEN TO USE:
As the first step before initiating a new rule creation process.
When the user wants to check if similar rules already exist by leveraging the Rules Suggestions API, instead of browsing the entire catalog manually.
When verifying if a suggested rule can be reused or adapted rather than creating one from scratch.
When checking for incomplete local rules that should be resumed instead of creating new ones.
🚫 DO NOT USE THIS TOOL FOR:
Checking what rules are available in the ComplianceCow system.
This tool only works with the rule catalog (not the entire ComplianceCow system).
The catalog contains only rules that are published and available for reuse in the catalog.
For direct ComplianceCow system lookups, use dedicated system tools instead:
fetch_cc_rule_by_namefetch_cc_rule_by_id
MANDATORY STEP: CONTEXT SUMMARY
Before calling the rule catalog API, always rewrite the user’s raw requirement into a single-paragraph descriptive summary string (not bullet points, not verbatim input).
The summary must capture the essence of the requirement in clear, natural language.
This summary string is what will be passed to
fetch_rules_and_tasks_suggestions.Example: User input: "Use GitHub GraphQL API to fetch merged PRs and check if approvals >= 2" Summary: "The proposed rule validates compliance for GitHub Pull Requests by retrieving all merged PRs through the GitHub GraphQL API, checking whether the number of approvers meets a required threshold, and marking them as compliant or non-compliant."
WHAT IT DOES:
Generates a concise summary string from the user's intent or requirements.
Calls the Rules Suggestions API with this summary string to retrieve a narrowed list of relevant rules.
Performs intelligent matching using metadata (name, description, purpose) from the suggested rules against the user-provided use case details.
Uses semantic pattern recognition to identify similar or related rules, even across different systems (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions).
Analyzes the
readmeDatafield from thefetch_rule()response to validate the rule's suitability for the user's use case.
IF A MATCHING RULE IS FOUND:
Retrieves complete details via
fetch_rule().If the readmeData field is available in the fetch_rule() response, Performs README-based validation using the
readmeDatafield from thefetch_rule()response to assess its suitability for the user’s use case.If suitable:
Returns the rule with full metadata, explanation, and the analysis report.
If not suitable:
Informs the user that the rule's README content does not align with the intended use case.
Prompts the user with clear next-step options:
"The rule's README content does not align with your use case. Please choose one of the following options:"
Customize the existing rule
Evaluate alternative matching rules
Proceed with new rule creation
Waits for the user's choice before proceeding.
IF A SIMILAR RULE EXISTS FOR AN ALTERNATE TECHNOLOGY STACK:
Detects rules with the same logic but built for a different platform or system (e.g., AzureUserUnusedPermission for SalesforceUserUnusedPermissions)
If the readmeData field is available in the fetch_rule() response, Retrieves and analyzes the
readmeDatafrom thefetch_rule()response to compare the implementation details against the user's proposed use caseBased on the comparison:
If the README content matches or is mostly reusable, suggest using the existing rule structure and logic as a foundation to create a new rule tailored to the user's target system
If the README content does not match or is not suitable, clearly inform the user and recommend either modifying the logic significantly or proceeding with a completely new rule from scratch
IF NO SUITABLE RULE IS FOUND:
Clearly informs the user that no relevant rule matches the proposed use case
Suggests continuing with new rule creation
Optionally highlights similar rules that can be used as a reference
MANDATORY STEPS: README VALIDATION:
Always retrieve and analyze
readmeDatafromfetch_rule().Ensure the rule's logic, behavior, and intended use align with the user's proposed use case.
README ANALYSIS REPORT:
Generate a clear and concise report for each
readmeDataanalysis that classifies the result as a full match, partially reusable, or not aligned.Present this report to the user for review.
USER CONFIRMATION BEFORE PROCEEDING: When analyzing a README file:
If no relevant rule matches the proposed use case, or if the README is deemed unsuitable, the tool must pause and request explicit user confirmation before proceeding further.
The tool should:
Clearly inform the user that no matching rule was found or the README is not appropriate.
Suggest creating a new rule as the next step.
Optionally recommend similar existing rules that can serve as references to help the user craft the new rule.
ITERATE UNTIL MATCH:
Repeat the above steps until a suitable rule is found or all options are exhausted.
CROSS-PLATFORM RULE HANDLING:
For rules from a different stack:
If reusable: suggest customization
If not reusable: recommend new rule creation
Returns:
A single rule object with full metadata and verified README match — if an exact match is found
A similar rule suggestion with customization options — if a cross-system match is found (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)
A message indicating no suitable rule found — with next steps and guidance to create a new rule
| Name | Required | Description | Default |
|---|---|---|---|
| user_requirement | Yes | ||
| summary_string | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description exhaustively discloses the tool's behavior: generating summary, calling API, matching, README validation, cross-platform handling, and user confirmation steps. It covers all scenarios and mandatory steps, leaving no ambiguity about the tool's actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long and contains redundant points (e.g., README validation appears in multiple sections). However, it is well-structured with clear headings and bullet points, making it navigable. It could be tightened but is not overly verbose given the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all major workflows (match found, cross-platform, no match) and mandatory steps like README validation and user confirmation. The presence of an output schema (not shown) is implied but the description includes return types. Slight gaps remain in parameter handling details, but it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains the role of summary_string by describing a 'CONTEXT SUMMARY' step where the agent must generate it from user_requirement. It adds meaning beyond the schema, though it could clarify whether the tool generates the summary internally or expects both parameters. Overall, it compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is the 'initial step in the rule creation process' to 'prevent duplicate rule creation.' It explicitly distinguishes from siblings like fetch_cc_rule_by_name and fetch_cc_rule_by_id by noting it works with the rule catalog, not the entire system.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides both a 'WHEN TO USE' section with specific scenarios and a 'DO NOT USE THIS TOOL FOR' section that lists alternatives. This explicitly guides when to invoke the tool versus using other sibling tools, meeting the highest standards of usage clarity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_run_control_meta_dataB
Use this tool to retrieve control metadata for a given control_id, including:
Control details: control name
Assessment details: assessment name and ID
Assessment run details: assessment run name and ID
Args: - id (str): Control id
Returns: - assessmentId (str): Assessment id. - assessmentName (str): Assessment name. - assessmentRunId (str): Assessment run id. - assessmentRunName (str): Assessment run name. - controlId (str): Control id. - controlName (str): Control name. - controlNumber (str): Control number. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| planId | No | |
| planName | No | |
| planInstanceId | No | |
| planInstanceName | No | |
| planInstanceControlId | No | |
| planInstanceControlName | No | |
| planInstanceControlDisplayable | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states retrieval and lists return fields. No details on side effects, auth needs, or behavior on invalid input. Minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Structured with bullet points and clear sections for Args and Returns. Concise but includes necessary detail. Front-loaded purpose sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one parameter and an explicit output schema in the description, it covers the return fields. However, lacks usage context like permissions or error handling beyond the error field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description adds 'Control id' for the single parameter, providing context. But the explanation is brief and does not elaborate beyond the schema type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves control metadata for a given control_id, specifying included details. It is specific but does not explicitly differentiate from sibling fetch_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (to retrieve metadata) but lacks guidance on when not to use it or alternatives. Context is clear but no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_run_controlsA
use this tool when you there is no result from the tool "execute_cypher_query". use this tool to get all controls that matches the given name. Next use fetch control meta data tool if need assessment name, assessment Id, assessment run name, assessment run Id
Args: - name (str): Control name
Returns: - controls (List[Control]): A list of controls. - id (str): Control run id. - name (str): Control name. - controlNumber (str): Control number. - alias (str): Control alias. - priority (str): Priority. - stage (str): Control stage. - status (str): Control status. - type (str): Control type. - executionStatus (str): Rule execution status. - dueDate (str): Due date. - assignedTo (List[str]): Assigned user ids - assignedBy (str): Assigner's user id. - assignedDate (str): Assigned date. - checkedOut (bool): Control checked-out status. - compliancePCT__ (str): Compliance percentage. - complianceWeight__ (str): Compliance weight. - complianceStatus (str): Compliance status. - createdAt (str): Time and date when the control run was created. - updatedAt (str): Time and date when the control run was updated. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It describes the return type (list of controls with fields) and an error field, but does not disclose any side effects, permissions, or rate limits. The description is adequate for a simple fetch operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is multi-sentence with a conditional usage note, a follow-up suggestion, and a detailed return field list. While structured, the first sentence has grammatical issues and the list is lengthy. It could be more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (fetch by name), and the description lists all return fields, which compensates for the lack of schema descriptions. It does not explain error handling beyond the error field, but overall it provides sufficient context for the agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage for its single parameter 'name'. The description adds 'Control name', which provides semantic context beyond the schema's type-only definition. This compensates for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches controls matching a given name, as a fallback when execute_cypher_query returns no result. It specifies the verb (get) and resource (controls), and distinguishes its usage from a sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when to use ('when there is no result from execute_cypher_query') and suggests a follow-up tool (fetch control meta data). However, it does not state when not to use it or name alternatives beyond the one condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_task_readmeA
Retrieve README documentation for a specific task by name.
Fetches the complete README documentation for a task, providing detailed information about the task's purpose, usage instructions, prerequisites, and implementation steps. This is useful for understanding how to properly use a task in workflows.
Args: name (str): The exact name of the task to retrieve README for
Returns: - readmeText (str): Complete README documentation as readable text - taskName (str): Name of the task for reference - error (str): Error message if retrieval fails or README not available
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| readmeText | No | |
| taskName | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It explains that the tool fetches complete README documentation, returns readmeText and taskName, and includes an error field for failures. This adequately discloses the read-only nature and error handling, though it could mention side effects (none) explicitly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the primary purpose in the first sentence, followed by a brief elaboration and structured Args/Returns. Every sentence provides value without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description adequately explains the return fields (readmeText, taskName, error) and the purpose. It could mention potential length or format of the readme, but overall it is sufficient for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description adds 'name (str): The exact name of the task to retrieve README for', specifying that the name must be exact and is associated with a task. This compensates fully for the schema's lack of detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves README documentation for a specific task by name, distinguishing it from siblings like fetch_rule_readme_documentaion and get_template_guidance. The verb 'fetch' and resource 'task readme' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates this is useful for understanding how to properly use a task in workflows, implying the context. However, it does not explicitly state when not to use it or mention alternative tools for rules or templates, which given many siblings would improve clarity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_unique_node_data_and_schemaC
Fetch unique node data and schema
| Name | Required | Description | Default |
|---|---|---|---|
| question | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| node_names | No | |
| unique_property_values | No | |
| neo4j_schema | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only says 'Fetch,' implying a read-only operation but offering no details about side effects, auth needs, or return behavior beyond what might be in the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief (one sentence), which is concise, but it sacrifices informativeness. It is not sufficiently developed for its purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a required 'question' parameter and no annotations, the description should provide more detail about usage and expected input. An output schema exists but does not compensate for the lack of parameter context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter 'question' has no description in the schema (0% coverage) and no explanation in the description. The phrase 'unique node data and schema' does not clarify what the question parameter does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Fetch unique node data and schema,' which indicates a fetch operation but does not clarify what 'unique node' refers to in this context or distinguish it from numerous sibling fetch tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool compared to alternatives like fetch_checks or fetch_assets_summary. The description lacks explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_workflow_detailsC
Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description carries full burden but only explains parameter sourcing. It fails to disclose whether the operation is read-only, idempotent, or what happens with invalid IDs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief but uses a technical 'Args:' format. While concise, it could be more readable and front-loaded with a purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, return values need not be explained. However, the description omits a clear overall purpose and any behavioral context, leaving the agent under-informed for a fetch/details operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must compensate. It adds value by specifying how to obtain the ID from 'get_workflows' output, which aids correct invocation beyond the schema's type-only definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clarifies the parameter and its source, but the tool's purpose is implied rather than explicitly stated. The name and parameter hint at fetching workflow details by ID, but a clear verb+resource statement like 'Fetch workflow details by ID' is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'get_workflow_by_name' or 'list_workflows'. The description provides no context for selection or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_workflow_resource_dataB
Fetch workflow resource data for a given resource type.
Resources provide dynamic data that can be used as inputs in workflow nodes. This function retrieves available data for a specific resource type.
Args: resource: The resource type to fetch data for. Resource options: USER_BLOCK
Returns: List of resource data items or error message
| Name | Required | Description | Default |
|---|---|---|---|
| resource | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions returns 'list or error message' but does not state whether the operation is read-only, if it has side effects, or any authentication or rate limit requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections (summary, context, args, returns) and concise, though slightly verbose in the 'Resources provide...' sentence. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema, the description provides sufficient context about the resource's purpose and return type. It is complete enough for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description fully explains the 'resource' parameter, including its meaning and an explicit option (USER_BLOCK). This adds significant value over the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches workflow resource data for a specific resource type, with a clear verb and resource. However, it does not explicitly differentiate from sibling tools like fetch_resources or fetch_resource_types, though the context implies a distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that resources provide dynamic data for workflow node inputs, which implies when to use. However, it lacks explicit guidance on when not to use or alternatives, and no exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_workflow_ruleA
Retrieve a specific workflow rule by name.
Finds and returns the single workflow rule that matches the provided name. This rule contains the input/output specifications needed for workflow operations.
Args: name (str): The name of the workflow rule to retrieve
Returns: - rules (List[WorkflowRuleVO]): List containing the single matched workflow rule with input/output specifications - id: (str) - name: (str) - description: (str) - ruleInputs: [List[WorkflowRuleInputsVO]] - ruleOutputs: [List[WorkflowRuleOutputsVO]]
- error (Optional[str]): An error message if any issues occurred during retrieval.| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| rules | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool returns a list with a single matched rule and an optional error, which is adequate for a read-only fetch. No contradictions with annotations since none exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with Args/Returns sections and front-loads the main purpose. It is slightly verbose but not excessively so, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple parameter, existing output schema (described in description), and no nested objects, the description covers the essential parts: purpose, parameter, and return values. It could mention edge cases or error handling more explicitly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully compensates by explaining the 'name' parameter: 'The name of the workflow rule to retrieve'. This is clear and sufficient for the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves a specific workflow rule by name, using specific verbs and resource. It distinguishes from siblings like fetch_cc_rule_by_name and fetch_workflow_details, but does not explicitly differentiate from all other fetch tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (to retrieve a specific workflow rule by name) but does not provide guidance on when not to use it or mention alternatives such as list_workflow_rules or fetch_workflow_details.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_design_notes_previewA
Generate design notes preview for user confirmation before actual creation.
DESIGN NOTES PREVIEW GENERATION
This tool generates a complete Jupyter notebook structure as a dictionary for user review. The MCP will create the full notebook content with 7 standardized sections based on rule context and metadata, then return it for user confirmation.
DESIGN NOTES TEMPLATE STRUCTURE REQUIREMENTS
The MCP should generate a Jupyter notebook (.ipynb format) with exactly 7 sections:
SECTION 1: Evidence Details
DESCRIPTION: System identification and rule purpose documentation
CONTENT REQUIREMENTS:
Table with columns: System | Source of data | Frameworks | Purpose
System: {TARGET_SYSTEM_NAME} (all lowercase")
Source: Always 'compliancecow'
Frameworks: Always '-'
Purpose: Use rule's purpose from metadata
RecommendedEvidenceName: {RULE_OUTPUT_NAME} (use rule's primary compliance output, exclude LogFile)
Description: Use rule description from metadata
Reference: Include actual API documentation links that the rule uses (extract from task specifications, no placeholder values)
FORMAT: Markdown cell with table and code blocks only
SECTION 2: Define the System Specific Data (Extended Data Schema)
DESCRIPTION: System-specific raw data structure definition with detailed breakdown
CONTENT REQUIREMENTS:
Step 2a: Inputs
Generate numbered list from rule's spec.inputs
Format: "{NUMBER}. {INPUT_NAME}({INPUT_DATA_TYPE}) - {INPUT_DESCRIPTION}"
Include all inputs with their types and purposes
Step 2b: API & Flow
Generate numbered list of API endpoints based on target system
Format: "{NUMBER}. {HTTP_METHOD} {URL} - {BRIEF_DESCRIPTION}"
Include only actual API endpoints that this specific rule uses for data collection
Extract from task specifications, not generic templates
Step 2c: Define the Extended Schema
Generate large JSON code block with actual API response structure
Use system-specific field names and realistic data values
Include all fields that will be processed by the rule
FORMAT: Markdown headers with detailed lists + large JSON code block
SECTION 3: Define the Standard Schema
DESCRIPTION: Standardized compliance data format documentation
CONTENT REQUIREMENTS:
Header explaining standard schema purpose
JSON code block with complete standardized structure containing:
System: based on target system (lowercase)
Source: Always 'compliancecow'
Resource info: ResourceID, ResourceName, ResourceType, ResourceLocation, ResourceTags, ResourceURL
System-specific data fields based on actual rule output columns, if unavailable then generate based on rule details
Compliance fields: ValidationStatusCode, ValidationStatusNotes, ComplianceStatus, ComplianceStatusReason
Evaluation and action fields: EvaluatedTime, UserAction, ActionStatus, ActionResponseURL (UserAction, ActionStatus, ActionResponseURL are empty by default)
Step 3a: Sample Data
Generate markdown table with ALL standard schema columns in same order - include all columns even if empty
Include three complete example rows with realistic, system-specific data
Use proper data formatting and realistic identifiers
FORMAT: JSON code block + comprehensive markdown table
SECTION 4: Describe the Compliance Taxonomy
DESCRIPTION: Status codes and compliance definitions
CONTENT REQUIREMENTS:
Table with columns: ValidationStatusCode | ValidationStatusNotes | ComplianceStatus | ComplianceStatusReason
ValidationStatusCode: CRITICAL FORMAT REQUIREMENT - Rule-specific codes must strictly follow this exact format:
Each word must be exactly 3-4 characters long
Words must be separated by underscores (_)
Use ALL UPPERCASE letters
Create codes that directly relate to the rule's compliance purpose
Examples: CODE_OWN_HAS_PR_REV (code ownership has pull request review), REPO_SEC_SCAN_PASS (repository security scan passed), AUTH_MFA_ENBL (authentication multi-factor enabled)
DO NOT use generic codes like "PASS" or "FAIL"
DO NOT exceed 4 characters per word
DO NOT use special characters other than underscores
Generate 4-6 different status codes covering various compliance scenarios
Detailed compliance reasons specific to the rule's purpose
Both COMPLIANT and NON_COMPLIANT scenarios
FORMAT: Markdown cell with table
SECTION 5: Calculation for Compliance Percentage and Status
DESCRIPTION: Percentage calculations and status logic
CONTENT REQUIREMENTS:
Header explaining compliance calculation methodology
Code cell with calculation logic:
TotalCount = Count of 'COMPLIANT' and 'NON_COMPLIANT' records
CompliantCount = Count of 'COMPLIANT' records
CompliancePCT = (CompliantCount / TotalCount) * 100
Status determination rules:
COMPLIANT: 100%
NON_COMPLIANT: 0% to less than 100%
NOT_DETERMINED: If no records are found
FORMAT: Markdown header cell + Code cell with calculation logic
SECTION 6: Describe (in words) the Remediation Steps for Non-Compliance
DESCRIPTION: Non-compliance remediation procedures
CONTENT REQUIREMENTS:
Can be "N/A" if no specific remediation steps apply
When applicable, provide:
Immediate Actions required
Short-term remediation steps
Long-term monitoring approaches
Responsible parties and timeframes
System-agnostic guidance that can be customized
FORMAT: Markdown cell with detailed remediation procedures
SECTION 7: Control Setup Details
DESCRIPTION: Rule configuration and implementation details
CONTENT REQUIREMENTS:
Table with two columns: Control Details | (Values)
Required fields (only these):
RuleName: Use actual rule name
PreRequisiteRuleNames: Default to 'N/A' or list dependencies
ExtendedSchemaRuleNames: Default to 'N/A' or list related rules
ApplicationClassName: Fetch all appType values from spec.tasks array, combine them, remove duplicates, and format as comma-separated values
PostSynthesizerName: Default to 'N/A' or specify if used
FORMAT: Markdown table with control configuration details
JUPYTER NOTEBOOK METADATA REQUIREMENTS
Include proper notebook metadata (colab, kernelspec, language_info)
Set nbformat: 4, nbformat_minor: 0
Use appropriate cell metadata with unique IDs for each section
Ensure proper markdown and code cell formatting
MCP CONTENT POPULATION INSTRUCTIONS
The MCP should extract the following information from the rule context:
Rule name, purpose, description from rule metadata
System name from appType (clean by removing connector suffixes like "-connector")
Task details from spec.tasks array
Input specifications from spec.inputs and spec.inputsMeta__
Output specifications from spec.outputsMeta__
Application connector information for control setup
API endpoints from task specifications (not generic placeholders)
CONTENT GENERATION GUIDELINES
Use realistic, system-specific examples that can be customized later
Include comments in code sections indicating customization points
Provide system-agnostic content that applies broadly
Use consistent naming conventions throughout all sections
Extract actual API documentation links from task specifications
Generate ValidationStatusCodes that are specific to the rule's compliance purpose
Ensure all sample data reflects the actual system being monitored
WORKFLOW
MCP retrieves rule context from stored rule information
MCP generates complete Jupyter notebook using template structure above
MCP populates template with extracted rule metadata and calculated values
MCP returns complete notebook structure as dictionary for user review
User reviews and confirms the structure
If approved, call create_design_notes() to actually save the notebook
ARGS
rule_name: Name of the rule for which to generate design notes preview
RETURNS
Dict containing complete notebook structure for user review and confirmation
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description extensively details the tool's behavior, including the exact template structure, content requirements for each section, metadata, and population instructions. It falls short of mentioning permissions or rate limits, but the depth of behavioral disclosure is very high.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely verbose (over 2000 words) and includes detailed template instructions that are more suited for internal documentation than a tool description. While well-structured with sections and headers, it is not concise and could be significantly shortened for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of generating a full notebook with 7 sections, the description is highly complete, covering all content requirements, metadata, and workflow. The output schema exists (though not shown) and the description states it returns a dict, which is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one parameter, 'rule_name', with no schema description (0% coverage). The description adds meaning by stating it is the name of the rule for which to generate the preview, which is sufficient for a single simple parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it generates a design notes preview for user confirmation before actual creation, distinguishing it from the sibling tool 'create_design_notes' which saves the notebook. It specifies the exact output (Jupyter notebook dictionary) and the workflow step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly outlines when to use the tool: for preview before creation, and then directing to call 'create_design_notes' after user approval. It also provides a numbered workflow explaining the sequence, giving clear context and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_rule_readme_previewA
Generate README.md preview for rule documentation before actual creation.
RULE README GENERATION:
This tool generates a complete README.md structure as a string for user review. The MCP will create comprehensive rule documentation with detailed sections based on rule context and metadata, then return it for user confirmation.
README TEMPLATE STRUCTURE REQUIREMENTS:
The MCP should generate a README.md with exactly these sections:
SECTION 1: Rule Header
DESCRIPTION: Rule identification and overview CONTENT REQUIREMENTS:
Rule name as main title (# {RULE_NAME})
Brief description from rule metadata
Status badges (Version, Application Type, Environment)
Purpose statement
Last updated timestamp FORMAT: Markdown header with badges and overview
SECTION 2: Overview
DESCRIPTION: High-level rule explanation CONTENT REQUIREMENTS:
What this rule does (purpose and description)
Target system/application
Compliance framework alignment
Key benefits and use cases
When to use this rule FORMAT: Markdown sections with bullet points
SECTION 3: Rule Architecture
DESCRIPTION: Technical architecture and flow CONTENT REQUIREMENTS:
Rule flow diagram (text-based)
Task sequence and dependencies
Data flow: Input → Processing → Output
Integration points
Architecture decisions FORMAT: Markdown with code blocks for diagrams
SECTION 4: Inputs
DESCRIPTION: Detailed input specifications CONTENT REQUIREMENTS:
Table of all rule inputs with:
Input Name
Data Type
Required/Optional
Description
Default Value
Example Value
Input validation rules
File format specifications (for FILE inputs) FORMAT: Markdown table with detailed explanations
SECTION 5: Tasks
DESCRIPTION: Individual task breakdown CONTENT REQUIREMENTS:
For each task in the rule:
Task name and alias
Purpose and functionality
Input requirements
Output specifications
Processing logic overview
Error handling
Task execution order
Dependencies between tasks FORMAT: Markdown subsections for each task
SECTION 6: Outputs
DESCRIPTION: Rule output specifications CONTENT REQUIREMENTS:
Table of all rule outputs with:
Output Name
Data Type
Description
Format/Structure
Example Value
Output file formats and schemas
Success/failure indicators FORMAT: Markdown table with examples
SECTION 7: Configuration
DESCRIPTION: Rule configuration and setup CONTENT REQUIREMENTS:
Application type and environment settings
Execution level and mode
Required permissions and access
System prerequisites
Configuration examples
Environment-specific settings FORMAT: Markdown with code blocks
SECTION 8: Usage Examples
DESCRIPTION: Practical usage scenarios CONTENT REQUIREMENTS:
Basic usage example
Advanced configuration example
Common use cases
Best practices
Troubleshooting tips FORMAT: Markdown with code examples
SECTION 9: I/O Mapping
DESCRIPTION: Data flow mapping details CONTENT REQUIREMENTS:
Complete I/O mapping visualization
Rule input to task input mappings
Task output to task input mappings
Task output to rule output mappings
Data transformation explanations FORMAT: Markdown with formatted mapping table
SECTION 10: Troubleshooting
DESCRIPTION: Common issues and solutions CONTENT REQUIREMENTS:
Common error scenarios
Input validation failures
Task execution errors
Output generation issues
Performance considerations
Support and contact information FORMAT: Markdown FAQ-style sections
SECTION 11: Version History
DESCRIPTION: Change log and versioning CONTENT REQUIREMENTS:
Current version information
Version history table
Change descriptions
Migration notes
Deprecation warnings FORMAT: Markdown table with version details
SECTION 12: References
DESCRIPTION: Additional resources and links CONTENT REQUIREMENTS:
Related documentation links
Compliance framework references
API documentation
Support resources
Contributing guidelines FORMAT: Markdown bullet list with links
MARKDOWN FORMATTING REQUIREMENTS:
Use proper Markdown syntax
Include table of contents with links
Use code blocks for examples
Include badges and shields
Proper heading hierarchy (H1, H2, H3)
Use tables for structured data
Include horizontal rules for section separation
MCP CONTENT POPULATION INSTRUCTIONS: The MCP should extract the following information from the rule context:
Rule name, purpose, description from rule metadata
System name from appType (clean by removing connector suffixes)
Task details from spec.tasks array (name, alias, purpose, appTags)
Input specifications from spec.inputs object
Output specifications from spec.outputsMeta__
I/O mappings from spec.ioMap array
Environment and execution settings from labels
Application type and integration details
PLACEHOLDER REPLACEMENT RULES:
{RULE_NAME} = meta.name
{RULE_PURPOSE} = meta.purpose
{RULE_DESCRIPTION} = meta.description
{SYSTEM_NAME} = extracted from appType
{VERSION} = meta.version or "1.0.0"
{ENVIRONMENT} = meta.labels.environment[0]
{APP_TYPE} = meta.labels.appType[0]
{EXEC_LEVEL} = meta.labels.execlevel[0]
{TASK_COUNT} = len(spec.tasks)
{INPUT_COUNT} = len(spec.inputs)
{OUTPUT_COUNT} = len(spec.outputsMeta__)
{TIMESTAMP} = current ISO timestamp
CONTENT GUIDELINES:
Use clear, technical language
Include practical examples
Provide comprehensive coverage
Make it developer-friendly
Include troubleshooting help
Keep sections well-organized
Use consistent formatting
WORKFLOW:
MCP retrieves rule context using fetch_rule() (ensure only the fetch_rule tool is called, not fetch_cc_rule)
MCP extracts metadata and technical details
MCP generates complete README.md content using template above
MCP populates all placeholders with actual rule data
MCP returns complete README content as string for user review
User reviews and confirms the content
If approved, call create_rule_readme() to actually save the README
Args: rule_name: Name of the rule for which to generate README preview
Returns: Dict containing complete README.md content as string for user review
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It exhaustively discloses the tool's behavior: it generates a complete README.md structure as a string for user review, does NOT save anything (deferred to create_rule_readme), retrieves rule context using fetch_rule(), and follows a specific template with placeholders. It also specifies the return format as 'Dict containing complete README.md content as string.' There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long and includes the full 12-section README template, which is more appropriate for external documentation than a tool description. While it is well-structured with headings, lists, and a front-loaded purpose statement, much of the content is redundant for an AI agent's selection and invocation. The description could be significantly more concise by referencing the template rather than reproducing it entirely.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's single parameter and the presence of an output schema (described as returning a dict with README content), the description is very complete. It covers the full workflow, dependencies (fetch_rule), and exact output format. However, the inclusion of extensive MCP instructions (e.g., 'The MCP should generate a README.md with exactly these sections:') blurs the line between tool description and usage guide, slightly reducing completeness for the tool's own definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The only parameter is 'rule_name'. The description includes a minimal 'Args: rule_name: Name of the rule for which to generate README preview' at the end, which adds basic context but no additional semantics like format or validation. Given that it is a single string parameter, this is adequate but not exceptional; the description does not significantly enhance understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Generate README.md preview for rule documentation before actual creation.' It specifies the verb 'generate' and the resource 'README preview for rule documentation.' It distinguishes itself from sibling tools like 'create_rule_readme' (which actually saves) and 'fetch_rule_readme_documentaion' (which fetches existing) by noting the workflow step 'If approved, call create_rule_readme() to actually save the README.' Thus, the purpose is highly specific and distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides extensive usage guidelines, including a detailed workflow: use fetch_rule() first, generate preview, then if approved call create_rule_readme. It explicitly mentions 'ensure only the fetch_rule tool is called, not fetch_cc_rule' and outlines the steps. However, it does not explicitly state scenarios when not to use this tool, such as when the rule already has a README. Yet the workflow and sibling differentiation are clear enough to guide appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_application_infoA
Get detailed information about an application, including supported credential types.
APPLICATION CREDENTIAL CONFIGURATION WORKFLOW:
User selects "Configure new application credentials".
Call this tool to retrieve application details and supported credential types.
Present credential options to the user with:
Required attributes
Data type
If type is bytes → must be Base64-encoded
Collect credential values for the selected type.
Validate that all required attributes are provided.
Verify that each credential value matches its expected data type.
Build the credential configuration and append it to the
apps_configarray.
DATA VALIDATION REQUIREMENTS:
All required attributes must be present.
Data type must match specification.
Bytes values must be Base64-encoded before saving.
Args: tag_name: The app tag name for retrieving application information
Returns: Dict containing application details and supported credential types
| Name | Required | Description | Default |
|---|---|---|---|
| tag_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It does not disclose behavioral traits such as side effects, required permissions, rate limits, or error responses. It only vaguely mentions the return type and includes a long workflow irrelevant to the tool's own behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is overly long, including an entire credential configuration workflow and data validation requirements that are not directly about the tool itself. The first sentence is concise, but the rest is wasteful and should be in separate documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While an output schema exists, the description adds a workflow and validation notes, but it still lacks details about the return structure beyond 'Dict containing application details and supported credential types.' It is adequate for a simple get tool but not fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter (tag_name) is described as 'The app tag name for retrieving application information,' adding meaning beyond the schema which only specifies type string. This is sufficient given the low schema coverage (0%).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Get detailed information about an application, including supported credential types.' It uses a specific verb (get) and resource (application information), and is distinct from sibling tools like fetch_applications or get_applications_for_tag.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a detailed step-by-step workflow for configuring application credentials, explicitly stating when to call this tool (step 2). However, it does not mention when not to use it or suggest alternative tools for similar tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_applications_for_tagA
Get available applications for a specific app tag.
APPLICATION RETRIEVAL:
Fetches all existing applications configured for the specified app tag.
Returns a list of applications with ID, name, and app type.
Used during rule execution to present application choices to the user.
Optionally filters by additional tags (e.g., purpose, sourceSystem) for precise matching.
Args: tag_name (str): The app tag name to get applications for. This parameter is mandatory and must not be empty. additional_tags (Dict[str, List[str]]): Optional additional tags to filter applications. Example: {"purpose": ["source-repo"]} to find apps with specific purpose.
Returns: dict: A dictionary containing available applications for the specified tag.
Raises: ValueError: If tag_name is not provided or is empty.
| Name | Required | Description | Default |
|---|---|---|---|
| tag_name | Yes | ||
| additional_tags | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It describes a read operation that fetches applications and raises ValueError for empty tag_name. However, it does not mention whether results are paginated, what happens if no applications exist for the tag, or any authorization requirements. The description is adequate but lacks some behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections ('APPLICATION RETRIEVAL:', 'Args:', 'Returns:', 'Raises:') and uses bullet points for clarity. It is concise—no redundant sentences—and front-loads the main purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists (not shown but known), the description appropriately focuses on input behavior. It covers parameters, return type (dictionary), and an error case. Missing details like behavior on empty results or tag not found are minor; overall complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds essential meaning: tag_name is mandatory and must not be empty; additional_tags is optional with an example format. This compensates for the schema's lack of descriptions, though it does not detail all possible tag keys or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get available applications for a specific app tag.' It specifies what is returned (ID, name, app type) and optionally allows filtering by additional tags. This distinguishes it from sibling tools like 'fetch_applications' or 'get_application_info'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes the tool is 'used during rule execution to present application choices to the user,' providing clear context. However, it does not explicitly state when not to use this tool or suggest alternatives among siblings, which would improve guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_asset_control_hierarchyB
Retrieve the complete control hierarchy for an asset with nested plan controls. Returns only id and name for each control while preserving the full hierarchical structure.
Args: - assetId (str): Asset id.
Returns: - success (bool): Indicates if the operation completed successfully. - planControls (List[dict]): Nested hierarchy of controls with only id and name. Each control contains: - id (str): Control id. - name (str): Name of the control. - planControls (List[dict]): Nested child controls ( - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that only id and name are returned while preserving hierarchy, and includes a structured Args/Returns section. However, it lacks information on authentication requirements, error handling, or whether the operation is read-only (no annotations provided).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose and uses a structured Args/Returns format for clarity. While it is moderately sized, some minor redundancy in the Returns section could be trimmed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, the description covers the return structure well, especially with the nested planControls format. However, it omits usage context, error behavior, and any prerequisites, leaving gaps for an agent to select the tool appropriately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The parameter 'assetId' is described only as 'Asset id,' which is essentially a restatement of the schema field name. With 0% schema description coverage, the description offers minimal added meaning and does not clarify the expected format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve the complete control hierarchy for an asset with nested plan controls,' specifying the verb and resource. It distinguishes from sibling tools by emphasizing the hierarchical structure and limited return fields (id and name only).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as other fetch tools that return control details or different hierarchical views. There is no mention of preconditions or context for appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_common_controls_detailsA
Function accepts compliance period as 'period'. Period donates for which quarter of year dashboard data is needed. Format: Q1 2024. Use this tool to get Common Control Framework (CCF) dashboard data for a specific compliance period with filters. This function provides detailed information about common controls, including their compliance status, control status, and priority. Use pagination if controls count is more than 50 then use page and pageSize to get control data pagewise, Once 1st page is fetched,then more pages available suggest to get next page data then increase page number. Args: - period (str): Compliance period for which dashboard data is needed. Format: 'Q1 2024'. (Required) - complianceStatus (str): Compliance status filter (Optional, possible values: 'COMPLIANT', 'NON_COMPLIANT', 'NOT_DETERMINED"). Default is empty string (fetch all Compliance statuses). - controlStatus (str): Control status filter (Optional, possible values: 'Pending', 'InProgress', 'Completed', 'Unassigned', 'Overdue'). Default is empty string (fetch all statuses). - priority (str): Priority of the controls. (Optional, possible values: 'High', 'Medium', 'Low'). Default is empty string (fetch all priorities). - controlCategoryName (str): Control category name filter (Optional). Default is empty string (fetch all categories). - page (int): Page number for pagination (Optional). Default is 1 (fetch first page). - pageSize (int): Number of items per page (Optional). Default is 50.
Returns: - controls (List[CommonControlVO]): A list of common controls. - id (str): Unique identifier of the control. - planInstanceID (str): ID of the associated plan instance. - alias (str): Alias or alternate name for the control. - displayable (str): Flag or content that indicates display eligibility. - controlName (str): Name of the control. - dueDate (str): Due date assigned to the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - status (str): Current status of the control. - complianceStatus (str): Compliance status of the control. - updatedAt (str): Timestamp when the control was last updated. - page (int): Current page number in the paginated result. - totalPage (int): Total number of pages available. - totalItems (int): Total number of control items. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| complianceStatus | No | ||
| controlStatus | No | ||
| priority | No | ||
| controlCategoryName | No | ||
| page | No | ||
| pageSize | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| page | No | |
| totalPage | No | |
| totalItems | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden. It is a read-only operation (implied by 'get' and 'dashboard data'), but it does not explicitly state the absence of side effects, authorization needs, or rate limits. It does disclose pagination behavior and return structure, which adds some transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args and Returns sections, but it contains some redundancy (e.g., multiple mentions of 'dashboard data') and could be shortened. The pagination instruction is clearly placed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters and an output schema, the description fully covers purpose, parameter semantics, pagination, and return fields. An agent can correctly invoke this tool with no additional context needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add all parameter meaning. It does so comprehensively: explains period format, provides possible values for complianceStatus, controlStatus, and priority, describes controlCategoryName as optional, and explains page/pageSize defaults and pagination usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves Common Control Framework (CCF) dashboard data with filters. It specifies the resource (common controls) and the action (get dashboard data), making it distinct from sibling tools like get_dashboard_data and get_top_non_compliant_controls_detail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool (for CCF dashboard data) and includes pagination instructions (use page and pageSize for more than 50 controls). However, it does not mention when not to use it or compare with alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_dataA
Function accepts compliance period as 'period'. Period denotes for which quarter of year dashboard data is needed. Format: Q1 2024.
Dashboard contains summary data of Common Control Framework (CCF). For any related to contorl category, framework, assignment status use this function. This contains details of control status such as 'Completed', 'In Progress', 'Overdue', 'Pending'. The summarization levels are 'overall control status', 'control category wise', 'control framework wise', 'overall control status' can be fetched from 'controlStatus' 'control category wise' can be fetched from 'controlSummary' 'control framework wise' can be fetched from 'frameworks'
Args: - period (str) - Period denotes for which quarter of year dashboard data is needed. Format: Q1 2024.
Returns: - totalControls (int): Total number of controls in the dashboard. - controlStatus (List[ComplianceStatusSummaryVO]): Summary of control statuses. - status (str): Compliance status of the control. - count (int): Number of controls with the given status. - controlAssignmentStatus (List[ControlAssignmentStatusVO]): Assignment status categorized by control. - categoryName (str): Name of the control category. - controlStatus (List[ComplianceStatusSummaryVO]): Status summary within the category. - status (str): Compliance status. - count (int): Number of controls with this status. - compliancePCT (float): Overall compliance percentage across all controls. - controlSummary (List[ControlSummaryVO]): Detailed summary of each control. - category (str): Category name of the control. - status (str): Compliance status of the control. - dueDate (str): Due date for the control, if applicable. - compliancePCT (float): Compliance percentage for the control. - leafControls (int): Number of leaf-level controls in the category. - complianceStatusSummary (List[ComplianceStatusSummaryVO]): Summary of control statuses. - status (str): Compliance status. - count (int): Number of controls with the given status. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | Q1 2024 |
Output Schema
| Name | Required | Description |
|---|---|---|
| totalControls | No | |
| controlStatus | No | |
| controlAssignmentStatus | No | |
| compliancePCT | No | |
| controlSummary | No | |
| complianceStatusSummary | No | |
| frameworks | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden. It clearly documents the return structure and the input parameter. However, it does not explicitly confirm read-only behavior or mention any side effects, but the tool name and context imply non-destructive data retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is fairly detailed and structured, with the period parameter explained first, followed by a description of the dashboard content, and then the full output schema. It could be slightly more concise, but the length is justified by the complexity of the return data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and a complex return structure, the description covers all aspects: input format, purpose, and full output fields with types and explanations. With no annotations or output schema provided, the description is complete enough for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'period' is explained in detail: the description specifies the format 'Q1 2024' and its purpose (quarter of year for dashboard data). This adds significant meaning beyond the schema's type definition, especially given 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves dashboard summary data for the Common Control Framework based on a compliance period. It mentions specific return fields and distinguishes from sibling tools by stating 'For any related to control category, framework, assignment status use this function.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides some guidance on when to use the tool ('For any related to control category, framework, assignment status use this function'), but does not explicitly mention alternatives or situations to avoid. It lacks a clear when-to-use/when-not-to-use structure.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_review_periodsB
Fetch list of review periods Returns: - items (List[str]): list of review periods - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| items | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description indicates a read operation ('fetch') but lacks disclosure of behavioral traits such as side effects, permissions, or rate limits. Without annotations, more transparency is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (two sentences) and front-loaded. However, it repeats return structure that might be in output schema, slightly reducing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list-fetching tool with no parameters, the description is adequate but lacks usage guidance and behavioral details, making it complete only to a minimum degree.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so schema coverage is 100%. The description does not need to add parameter details, thus baseline 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch list of review periods', specifying the verb (fetch) and resource (review periods). It is distinct from sibling tools due to the specific resource name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. With many sibling fetch tools, explicit usage context is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_rules_summaryA
Tool-based version of get_rules_summary for improved compatibility and prevention of duplicate rule creation.
This tool serves as the initial step in the rule creation process. It helps determine whether the user's proposed use case matches any existing rule in the catalog.
PURPOSE:
To analyze the user's use case and avoid duplicate rule creation by identifying the most suitable existing rule based on its name, description, and purpose.
NEW: Check for partially developed rules in local system before allowing new rule creation
NEW: Present resumption options if incomplete rules are found to prevent duplicate work
WHEN TO USE:
As the first step before initiating a new rule creation process
When the user wants to retrieve and review all available rules in the catalog
When verifying if a similar rule already exists that can be reused or customized
NEW: When checking for incomplete local rules that should be resumed instead of creating new ones
🚫 DO NOT USE THIS TOOL FOR:
Checking what rules are available in the ComplianceCow system.
This tool only works with the rule catalog (not the entire ComplianceCow system).
The catalog contains only rules that are published and available for reuse in the catalog.
For direct ComplianceCow system lookups, use dedicated system tools instead:
fetch_cc_rule_by_namefetch_cc_rule_by_id
WHAT IT DOES:
Retrieves the full list of rules from the catalog with simplified metadata (name, purpose, description)
Performs intelligent matching using metadata (name, description, purpose) with user-provided use case details
Uses semantic pattern recognition to find similar rules, even across different systems (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)
IF A MATCHING RULE IS FOUND:
Retrieves complete details via
fetch_rule().If the readmeData field is available in the fetch_rule() response, Performs README-based validation using the
readmeDatafield from thefetch_rule()response to assess its suitability for the user’s use case.If suitable:
Returns the rule with full metadata, explanation, and the analysis report.
If not suitable:
Informs the user that the rule's README content does not align with the intended use case.
Prompts the user with clear next-step options:
"The rule's README content does not align with your use case. Please choose one of the following options:"
Customize the existing rule
Evaluate alternative matching rules
Proceed with new rule creation
Waits for the user's choice before proceeding.
IF A SIMILAR RULE EXISTS FOR AN ALTERNATE TECHNOLOGY STACK:
Detects rules with the same logic but built for a different platform or system (e.g., AzureUserUnusedPermission for SalesforceUserUnusedPermissions)
If the readmeData field is available in the fetch_rule() response, Retrieves and analyzes the
readmeDatafrom thefetch_rule()response to compare the implementation details against the user's proposed use caseBased on the comparison:
If the README content matches or is mostly reusable, suggest using the existing rule structure and logic as a foundation to create a new rule tailored to the user's target system
If the README content does not match or is not suitable, clearly inform the user and recommend either modifying the logic significantly or proceeding with a completely new rule from scratch
IF NO SUITABLE RULE IS FOUND:
Clearly informs the user that no relevant rule matches the proposed use case
Suggests continuing with new rule creation
Optionally highlights similar rules that can be used as a reference
MANDATORY STEPS: README VALIDATION:
Always retrieve and analyze
readmeDatafromfetch_rule().Ensure the rule's logic, behavior, and intended use align with the user's proposed use case.
README ANALYSIS REPORT:
Generate a clear and concise report for each
readmeDataanalysis that classifies the result as a full match, partially reusable, or not aligned.Present this report to the user for review.
USER CONFIRMATION BEFORE PROCEEDING: When analyzing a README file:
If no relevant rule matches the proposed use case, or if the README is deemed unsuitable, the tool must pause and request explicit user confirmation before proceeding further.
The tool should:
Clearly inform the user that no matching rule was found or the README is not appropriate.
Suggest creating a new rule as the next step.
Optionally recommend similar existing rules that can serve as references to help the user craft the new rule.
ITERATE UNTIL MATCH:
Repeat the above steps until a suitable rule is found or all options are exhausted.
CROSS-PLATFORM RULE HANDLING:
For rules from a different stack:
If reusable: suggest customization
If not reusable: recommend new rule creation
Returns:
A single rule object with full metadata and verified README match — if an exact match is found
A similar rule suggestion with customization options — if a cross-system match is found (e.g., AzureUserUnusedPermission vs SalesforceUserUnusedPermissions)
A message indicating no suitable rule found — with next steps and guidance to create a new rule
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses the workflow: retrieval, matching, calling fetch_rule(), README validation, analysis report, user confirmation, iteration, and cross-platform handling. No contradictions and thorough coverage of behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively long, with repetitive explanations (e.g., README validation described multiple times). It includes verbose sections like 'IF A MATCHING RULE IS FOUND' and 'ITERATE UNTIL MATCH' that could be condensed. This hinders quick scanning by the agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite length, the description covers all necessary facets: matching logic, cross-platform handling, user confirmation, iteration, and edge cases. Since an output schema exists, return values need no extra detail. The tool's complexity is fully addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so baseline is 4. The description does not need to explain parameters, and it doesn't add any, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's role as an initial step in rule creation to prevent duplicates by analyzing use cases against catalog rules. However, the name 'get_rules_summary' understates the extensive analysis and decision-making behavior, which could mislead about core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit 'WHEN TO USE' and 'DO NOT USE THIS TOOL FOR' sections provide clear context. It specifies using this tool as the first step before new rule creation and for catalog retrieval, and directs to alternative tools like 'fetch_cc_rule_by_name' for system lookups.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_task_detailsB
Tool-based version of get_task_details for improved compatibility.
DETAILED TASK ANALYSIS REQUIREMENTS:
Use this tool if the tasks://details/{task_name} resource is not accessible
Extract complete input/output specifications with template information
Review detailed capabilities and requirements from the full README
Identify template-based inputs (those with the templateFile property)
Analyze appTags to determine the application type
Review all metadata and configuration options
Use this information for accurate task matching and rule structure creation
INTENTION-BASED OUTPUT CHAINING:
ANALYZE output purpose: Is this meant for direct user consumption or further processing?
ASSESS completion level: Does this output fulfill the user's end goal or serve as a stepping stone?
EVALUATE consolidation needs: Are multiple outputs meant to be combined for complete picture?
DETERMINE transformation requirements: Does raw output need formatting for usability?
WORKFLOW GAP DETECTION:
IDENTIFY outputs that represent partial solutions to user problems
DETECT outputs that split information requiring reunification
RECOGNIZE outputs that extract data without presenting insights
FLAG outputs that validate without providing actionable summaries
COMPLETION INTENTION MATCHING:
SUGGEST tasks that transform intermediate outputs into final deliverables
RECOMMEND tasks that consolidate split information into unified reports
PROPOSE tasks that add analysis layer to raw validation results
ENSURE suggested tasks align with user's stated end goals
IMPORTANT (MANDATORY BEHAVIOR): If the requested task is not found with the user's specification, the system MUST:
Prompt the user to choose how to proceed including the below option.
Option: Create task development Ticket.
Wait for the user's response before taking any further action.
If the user chooses to create a task development ticket, call
create_support_ticket()via the MCP tool, collecting the required input details from the user before submitting.
Args: task_name: The name of the task for which to retrieve details
Returns: A dictionary containing the complete task information if found, OR executes the user-selected alternative approach, OR creates a support ticket (with collected details) if chosen
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It describes the return behavior (dictionary with task info or alternative actions) and the mandatory not-found process. However, much of the description comprises abstract workflow instructions (e.g., 'INTENTION-BASED OUTPUT CHAINING') that are not specific to the tool's behavior, reducing clarity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively long (over 300 words) and contains multiple verbose sections (e.g., 'DETAILED TASK ANALYSIS REQUIREMENTS', 'INTENTION-BASED OUTPUT CHAINING') that are not directly about the tool's operation. Much of this content seems like generic agent workflow guidance rather than tool-specific documentation. This lack of conciseness harms usability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema (not shown), the description covers basic usage and the important not-found case. It mentions aspects like template information and appTags in the analysis section, but the structure is cluttered. Overall, it provides sufficient context for an AI to use the tool, though not ideally.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage for the single parameter 'task_name'. The description adds a one-line explanation: 'The name of the task for which to retrieve details', which provides basic meaning. This is adequate but minimal, especially given the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool retrieves task details for a given task name, with the opening line establishing it as a tool-based version for improved compatibility. However, the main purpose is somewhat diluted by extensive workflow instructions that obscure the core functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a dedicated 'IMPORTANT (MANDATORY BEHAVIOR)' section that explains how to handle cases where the task is not found, including prompting the user and optionally creating a support ticket. It also mentions using this tool if the tasks://details resource is inaccessible. However, it lacks explicit guidance on when to use this tool over its many sibling tools and does not specify when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_tasks_summaryA
Resource containing minimal task information for initial selection.
This tool is also used as a fallback resource when fetch_tasks_suggestions is disabled or does not return suitable matches, ensuring the user always has access to a broader list of available tasks for manual selection.
This resource provides only the essential information needed for task selection:
Task name and display name
Brief description
Purpose and capabilities
Tags for categorization
Inputs/Outputs params with minimal details
Basic README summary
Use this for initial task discovery and selection. Detailed information can be
retrieved later using tasks://details/{task_name} for selected tasks only.
AUTOMATIC OUTPUT ANALYSIS BY INTENTION:
MANDATORY: Analyze each task's output purpose and completion level during selection
IDENTIFY output intentions that require follow-up processing:
SPLITTING INTENTION: Outputs that divide data into separate categories → REQUIRE consolidation
EXTRACTION INTENTION: Outputs that pull raw data without formatting → REQUIRE transformation
VALIDATION INTENTION: Outputs that check compliance without final reporting → REQUIRE analysis/reporting
PROCESSING INTENTION: Outputs that transform data but don't create final deliverables → REQUIRE finalization
OUTPUT COMPLETION ASSESSMENT:
EVALUATE: Does this output serve as a final deliverable for end users?
ASSESS: Is this output consumable without additional processing?
DETERMINE: Does this output require combination with other outputs to be meaningful?
IDENTIFY: Is this output an intermediate step in a larger workflow?
WORKFLOW COMPLETION ENFORCEMENT:
NEVER present task selections that end with intermediate processing outputs
AUTOMATICALLY suggest tasks that fulfill incomplete intentions
ENSURE every workflow produces actionable final deliverables
RECOMMEND tasks that bridge gaps between current outputs and user goals
Mandatory functionality:
Retrieve a list of task summaries based on the user's request
Analyze task outputs and suggest additional tasks for workflow completion
If no matching task is found for the requested functionality, prompt user for confirmation
Based on user response, either proceed accordingly or create support ticket using create_support_ticket()
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the burden. It covers basic return content but omits details like pagination or idempotency. The heavy mix of agent instructions confuses the tool's own behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long and includes entire sections of agent instructions (analysis, enforcement, etc.) that are not about the tool. It lacks conciseness and mixes concerns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and an output schema, the description covers the basic context (what it returns and when to use). However, the extraneous instructions detract from completeness and clarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero parameters and 100% coverage. The description adds nothing extra about parameters, but none are needed. Baseline 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it provides minimal task information for initial selection and is a fallback when fetch_tasks_suggestions fails. The core purpose is clear, but it also includes extensive instructions that go beyond the tool's role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it (initial discovery, fallback) and mentions an alternative (tasks://details/ for details). Good guidance on context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_template_guidanceA
Get detailed guidance for filling out a template-based input.
COMPLETE TEMPLATE HANDLING PROCESS:
STEP 1 - TEMPLATE IDENTIFICATION:
Called for inputs that have a templateFile property
Provides decoded template content and structure explanation
Returns required fields, format-specific tips, and validation rules
PREFILLING PROCESS:
Analyze template structure for external dependencies
Prefill template with realistic values based on the instructions
RELEVANCE FILTERING:
ANALYZE task description and user use case to create targeted search queries
EXTRACT key terms from rule purpose and task capabilities
COMBINE system name with specific functionality being configured
PRIORITIZE documentation that matches the exact use case scenario
STEP 3 - ENHANCED TEMPLATE PRESENTATION TO USER: Show the template with this EXACT format: "Now configuring: [X of Y inputs]
Task: {task_name} Input: {input_name} - {description}
You can:
Accept these prefilled values (type 'accept')
Modify specific sections (provide your modifications)
Replace entirely (provide your complete configuration)
Please review and confirm or modify the prefilled configuration:"
STEP 4 - FALLBACK TO ORIGINAL TEMPLATE: If no documentation found or prefilling fails:
Show original empty template with standard format
Include note: "No documentation found for prefilling. Please provide your configuration."
Continue with existing workflow
STEP 5 - COLLECT USER CONTENT:
Wait for the user to provide their response (accept/modify/replace)
Handle "accept" by using prefilled content
Handle modifications by merging with prefilled baseline
Handle complete replacement with user content
Do NOT proceed until the user provides content
NEVER use template content as default values without documentation analysis
STEP 6 - PROCESS TEMPLATE INPUT:
Call collect_template_input(task_name, input_name, user_content)
Include documentation source metadata
Validates content format, checks required fields, uploads file
Returns file URL for use in rule structure
TEMPLATE FORMAT HANDLING:
JSON: Must be valid JSON with proper brackets and quotes
TOML: Must follow TOML syntax with proper sections [section_name]
YAML: Must have correct indentation and structure
XML: Must be well-formed XML with proper tags
VALIDATION RULES:
Format-specific syntax validation
Required field presence checking
Data type validation where applicable
Template structure compliance
Documentation standard compliance (when applicable)
CRITICAL TEMPLATE RULES:
ALWAYS call get_template_guidance() for inputs with templates
ALWAYS analyze documentation before showing template to user
ALWAYS show the prefilled template (or original if no docs found) with exact presentation format
ALWAYS wait for the user to provide response (accept/modify/replace)
ALWAYS call collect_template_input() to process user content
NEVER use template content directly - always use documentation-enhanced or user-provided content
ALWAYS use returned file URLs in rule structure
PROGRESS TRACKING:
Show "Now configuring: [X of Y inputs]" for user progress
Include clear task and input identification
Provide format-specific guidance and tips
Include documentation analysis results and source citations
Args: task_name: Name of the task input_name: Name of the input that has a template
Returns: Dict containing template content, documentation analysis, prefilled values, and guidance
| Name | Required | Description | Default |
|---|---|---|---|
| task_name | Yes | ||
| input_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It thoroughly discloses behavior: returns decoded content, prefills, handles user responses, and chains to collect_template_input. No contradictions or hidden side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very detailed with steps and repeated 'ALWAYS' constraints. While structured, it is verbose and could be shortened. Some redundancy reduces conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and simple schema, description fully covers the tool's purpose, process, and output. Output schema is mentioned, so return details are handled. Complete for agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 0%, but description explicitly documents parameters in Args section, adding context (task_name as task name, input_name as template input name). Provides enough meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides detailed guidance for filling template-based inputs, with a specific verb ('get') and resource ('guidance'). It distinguishes from siblings like collect_template_input by focusing on analysis and prefilling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit CRITICAL TEMPLATE RULES stating to always call this tool for templates, and details when to use vs. when to fallback. It provides step-by-step process and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_top_non_compliant_controls_detailC
Function overview: Fetch control with low compliant score or non compliant controls. Arguments:
period: Compliance period which denotes quarter of the year whose dashboard data is needed. By default: Q1 2024.
count:
page: If the user asks of next page use smartly decide the page.
Returns:
controls (List[NonCompliantControlVO]): A list of non-compliant controls.
name (str): Name of the control.
lastAssignedTo (List[UserVO]): List of users to whom the control was last assigned.
emailid (str): Email ID of the assigned user.
score (float): Score assigned to the control.
priority (str): Priority level of the control.
error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| count | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It mentions the function overview and return structure but lacks details on side effects, authentication, rate limits, or what happens with pagination beyond a vague note about 'smartly decide the page.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with sections but is somewhat verbose and includes unclear phrasing like 'If the user asks of next page use smartly decide the page.' It could be more concise and directly informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description includes a detailed return structure, complementing the output schema. However, it lacks information on error handling, prerequisites, or typical usage scenarios, making it moderately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning for 'period' (compliance quarter) but for 'count' only provides the field name, and for 'page' gives a vague instruction. Overall, it provides some but insufficient detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool fetches controls with low compliant scores or non-compliant controls, which is specific. However, it does not differentiate from similar sibling tools like 'fetch_controls' or 'get_top_over_due_controls_detail', so clarity is slightly reduced.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description does not mention prerequisites or when not to use, which is a significant gap given the many sibling tools for fetching controls.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_top_over_due_controls_detailB
Fetch controls with top over due (over-due) Function accepts count as 'count' Function accepts compliance period as 'period'. Period donates for which quarter of year dashboard data is needed. Format: Q1 2024.
Args: - period (str, required) - Compliance period - count (int, required) - page content size, defaults to 10
Returns: - controls (List[OverdueControlVO]): A list of overdue controls. - name (str): Name of the control. - assignedTo (List[UserVO]): List of users assigned to the control. - emailid (str): Email ID of the assigned user. - assignmentStatus (str): Assignment status of the control. - complianceStatus (str): Compliance status of the control. - dueDate (str): Due date for the control. - score (float): Score assigned to the control. - priority (str): Priority level of the control. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | Q1 2024 | |
| count | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| controls | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. The description indicates a read-only fetch operation and details the return structure, but does not disclose potential side effects, authentication needs, or limitations. Adequate for a simple fetch.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately concise but uses a mixture of prose and docstring format (Args/Returns). The opening line is duplicated. Could be streamlined while retaining key info.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema is provided, the description covers purpose, parameters, and return values. It explains the period format and count default. However, it does not explain how 'top' is determined or any ordering, which might be needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds meaning beyond schema: explains period format ('Q1 2024') and count as page size with default. Schema has 0% description coverage, so this compensation is valuable. However, the description mixes parameter details with return format, causing slight confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches controls with top overdue, distinguishing it from siblings like 'get_top_non_compliant_controls_detail' and 'fetch_controls'. However, the term 'top' is not explicitly defined (e.g., sorted by score or duedate).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., fetch_controls, get_dashboard_common_controls_details). It only describes parameters and return values without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_workflow_by_nameA
Get a workflow configuration by its name (exact, case-sensitive match).
Args: - name (str): workflow name to search
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral burden. It indicates a read operation but does not explicitly declare it as read-only or safe. No disclosure of side effects or error behaviors is given.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences: a clear main action followed by a minimal parameter list. No extraneous words, and the primary purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with an output schema, the description covers the essential purpose and parameter. However, it could mention the uniqueness of the name and suggest alternative tools for different scenarios. Overall, it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must add meaning. The 'Args' section restates the parameter name and type, adding 'workflow name to search' which provides basic context but lacks depth, examples, or format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'workflow configuration', and the method 'by its name (exact, case-sensitive match)'. It distinguishes this tool from siblings like 'fetch_workflow_details' (likely by ID) and 'list_workflows' (list all).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have the exact name, but it does not explicitly state when to use this versus alternatives like 'fetch_workflow_details' or 'list_workflows'. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
helpA
Important: This tool should execute when user asks for help or guidance on using ComplianceCow functions. ComplianceCow Help Tool - Provides guidance on how to use ComplianceCow functions.
Args: category: Help category to display. Options: - "all": Show all available help - "assessments": Assessment-related functions - "controls": Control-related functions - "evidence": Evidence-related functions - "dashboard": Dashboard and reporting functions - "assets": Asset management functions - "actions": Action execution functions - "queries": Database query functions
Returns: Formatted help text for the specified category
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | all |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool returns formatted help text for a category and has no side effects. While it doesn't explicitly state safety or idempotency, the nature of a help tool implies read-only behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is fairly concise for a help tool, with clear bullet points for categories. It could be slightly more terse but is well-structured and not overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema needed beyond mentioned return), the description covers all needed context: trigger condition, parameter options, and return type. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only defines a string type with a default, but the description significantly adds meaning by listing all valid category options with descriptions, practically serving as an enum. This goes well beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides guidance on using ComplianceCow functions and lists specific categories. It distinguishes itself from all other tools as the dedicated help function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states 'This tool should execute when user asks for help or guidance on using ComplianceCow functions', clearly defining when to use it. However, it does not include when not to use it or mention alternatives, but since there are no sibling help tools, this is less critical.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_all_assessment_categoriesA
Get all assessment categories
Returns: - categories (List[Category]): A list of category objects, where each category includes: - id (str): Unique identifier of the assessment category. - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| categories | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description must convey behavioral traits. It mentions the return structure and potential error, but does not disclose side effects, authentication requirements, rate limits, or whether the list is static or dynamic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the primary action. The bulleted return details are well-structured and concise, with no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and a detailed output description, the tool is adequately documented for a simple retrieval. However, it lacks context on potential limitations or prerequisites, which would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters and 100% coverage. With zero parameters, baseline is 4. The description adds no parameter info, which is acceptable since none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get all assessment categories', specifying the verb and resource. It distinguishes from sibling tools like list_all_assessments and list_all_assets by focusing on categories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Usage is implied by the tool's simplicity and uniqueness among siblings, but the lack of exclusions or context for alternatives reduces clarity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_all_assessmentsC
Get all assessments Args: categoryId: assessment category id (Optional) categoryName: assessment category name (Optional) assessmentName: assessment name (Optional) Returns: - assessments (List[Assessments]): A list of assessments objects, where each assessment includes: - id (str): Unique identifier of the assessment. - name (str): Name of the assessment. - categoryName (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| categoryId | No | ||
| categoryName | No | ||
| assessmentName | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| assessments | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must disclose behavior. It mentions return values but does not state if the tool is read-only, any side effects, rate limits, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description uses a structured Args/Returns format but includes redundancy (e.g., 'Get all assessments' followed by return description). It is reasonably concise but not maximally efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple operation and presence of output schema (return structure described), the description covers the key aspects: purpose, parameters, and return format. Lacks examples or edge cases but is sufficient for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and description merely lists parameter names (categoryId, categoryName, assessmentName) without explaining their purpose, format, or how they filter results. For example, it does not clarify if parameters are mutually exclusive or combined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Get all assessments', which clearly indicates the action and resource. However, it does not distinguish itself from the sibling tool 'fetch_assessments'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'fetch_assessments'. No exclusions or context about filtering or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_all_assetsB
Get all assets
Returns: - assets (List[AssetsVo]): A list of assets. - id (str): Asset id. - name (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| assets | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description only specifies return format, missing behavioral traits such as authentication needs, rate limits, or side effects. For a tool without annotations, more transparency is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise and front-loaded. The description is a single line plus return fields, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and presence of an output schema, the description covers the basics. However, it could specify the scope of 'all assets' (e.g., tenant-wide) and any limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (0 params), so the description cannot provide parameter-level meaning. Baseline of 4 is appropriate since no additional info is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get all assets' and lists return fields, but does not differentiate from sibling tools like list_assets_cc or fetch_assets_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool over alternatives. The description provides no context for selection among the many list-related siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_assets_ccA
Retrieve all available assets (integration plans).
Returns: - success (bool): Indicates if the operation completed successfully. - assets (List[dict]): A list of assets. - id (str): Asset id. - name (str): Name of the asset. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes return fields (success, assets list, error) clearly. No annotations provided, but the description carries the burden well, indicating a read-only retrieval without side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, with clear structure using dashes for return fields. Could be slightly more organized (e.g., separate lines), but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Sufficient for a parameterless list tool: explains what it returns and error handling. Lacks differentiation from sibling 'list_all_assets', but otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has no parameters, so description adds value by explaining the output schema in detail. Schema coverage is 100%, but the description compensates with return field documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it retrieves all available assets, specifying they are 'integration plans'. Provides return structure. However, it does not explicitly differentiate from sibling 'list_all_assets', which may cause confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage when needing all integration plan assets, but no explicit when-to-use or comparison with alternatives like 'list_all_assets'. No usage exclusions provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_asset_schedulesA
List schedules for a given asset.
Args: - assetId (str): Asset ID whose schedules need to be listed
Returns: - success (bool) - items (list): List of schedules - error (Optional[str])
| Name | Required | Description | Default |
|---|---|---|---|
| assetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It only mentions return fields but does not reveal side effects, authentication needs, rate limits, or any constraints beyond listing. This is minimal for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: one line for purpose, then a clear list of arguments and returns. No extraneous words, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with an output schema (implicit), the description covers the return structure (success, items, error). It lacks details like whether pagination is supported or what a schedule object contains, but these are reasonable omissions given the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to the sole parameter 'assetId' by explaining it as 'Asset ID whose schedules need to be listed'. Since schema description coverage is 0%, this clarification is valuable and fills the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description directly states 'List schedules for a given asset' with a clear verb+resource structure. It distinguishes from sibling tools like delete_asset_schedule and schedule_asset_execution by focusing only on listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., list_checks, list_workflows, or other listing tools). The description only lists parameters and returns without context on prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_checksB
Retrieve all checks associated with an asset.
Args: - assetId (str): Asset id (plan id).
Returns: - success (bool): Indicates if the operation completed successfully. - checks (List[dict]): A list of checks. - id (str): Check id. - name (str): Name of the check. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
| assetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only operation ('Retrieve') but does not explicitly state safety, permissions, or side effects. The return structure is documented, but behavioral traits like rate limits or prerequisites are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured using Args/Returns format, which is clear but slightly verbose. It is not overly long, but could be more concise for a simple single-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and an output schema (implied by the Returns section), the description covers the essential inputs and outputs. It could mention prerequisites like the asset existing, but overall it is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds critical meaning: 'assetId (str): Asset id (plan id).' This clarifies the parameter's purpose beyond the bare schema type, compensating well for the lack of annotation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve all checks associated with an asset' with a specific verb and resource. It explicitly mentions the sole required parameter 'assetId' and distinguishes itself from sibling tools like 'fetch_checks' by focusing on checks for a single asset.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It lacks explicit when-to-use, when-not-to-use, or mentions of sibling tools, leaving the agent to infer usage context without support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_control_notesC
List all notes for a given control.
This tool retrieves all notes associated with a control.
Args: controlId (str): The control ID to list notes for (required).
Returns: Dict with success status and notes: - success (bool): Whether the request was successful - notes (List[dict]): List of note objects, each containing: - id (str): Note ID - topic (str): Note topic - notes (str): Note content - totalCount (int): Total number of notes found - error (str, optional): Error message if request failed
| Name | Required | Description | Default |
|---|---|---|---|
| controlId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses the return format but does not explicitly state that the operation is read-only, does not describe authorization needs, rate limits, or side effects. The description implies a safe read but lacks explicit behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with Args and Returns sections, but it is verbose for a simple one-parameter tool. The detailed return structure is informative, though some redundancy exists with the available output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one parameter and a documented return structure, the description covers the purpose, input, and output sufficiently. However, it lacks edge case handling (e.g., empty results) and usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description simply restates the parameter name and that it is required, adding no extra meaning beyond the input schema. It does not clarify format, constraints, or example values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all notes for a given control' with a specific verb (list), resource (notes), and scope (control). It distinguishes from sibling tools like create_control_note and update_control_note, but does not explicitly contrast with other list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides basic usage instructions (required controlId) but no guidance on when to use this tool versus alternatives, no when-not-to-use, and no prerequisites or context for choosing this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_activity_typesA
Get available workflow activity types.
Activity types define what kind of actions can be performed in workflow nodes:
Pre-build Function: Execute predefined logic
Pre-build Rule: Execute a rule
Pre-build Task: Trigger a predefined task
Returns: List of available activity types
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose key behaviors. It indicates a read-only retrieval but does not explicitly mention that no changes are made, nor does it discuss permissions or limitations. The simple nature of the tool mitigates the lack of detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably short but includes bullet points that could be integrated into a single line. It is front-loaded with the primary action but has some redundancy (e.g., 'Returns:' line).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and an output schema, the description covers the purpose and the contents of the returned list adequately. No additional information is necessary for proper invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, and schema coverage is 100% (trivially). The description adds no parameter information because none exist. Baseline score of 4 is appropriate for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves available workflow activity types and distinguishes itself from sibling list tools by specifying that these are for actions in workflow nodes. It uses specific verbs and context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for getting activity types but does not explicitly state when to use this tool versus sibling tools like list_workflow_functions or list_workflow_conditions. No exclusion criteria or alternatives are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_condition_categoriesA
Retrieve available workflow condition categories.
Condition categories help organize workflow decision points by type. This is useful for filtering and selecting appropriate conditions when building workflows.
Returns: - Condition categories (List[WorkflowConditionCategoryItemVO]): List of condition categories - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| conditionCategories | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It describes the return value (list of categories with name) and potential error, but does not disclose any behavioral traits such as read-only nature, rate limits, or side effects. This is adequate for a simple list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loading the verb and resource, and includes a clear returns section. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and a provided output schema, the description sufficiently explains the purpose, use case, and return format. It is complete for a simple retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema coverage is 100% (empty schema). The description adds value by explaining the return structure (name and error), which is not present in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves available workflow condition categories and explains their purpose in organizing decision points. The name and description distinguish it from sibling list tools (e.g., list_workflow_conditions, list_workflow_event_categories).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes this is useful for filtering and selecting conditions when building workflows, providing context. However, it does not explicitly state when to use this tool versus alternatives, nor does it exclude any scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_conditionsA
Retrieve available workflow conditions.
Conditions are decision points in workflows that evaluate expressions or functions to determine the flow path. They can use CEL expressions or predefined functions to make branching decisions. Only active conditions are returned.
Returns: - conditions (List[WorkflowConditionVO]): List of active workflow conditions with input/output specifications - categoryId (str) - desc (str) - displayable: (str) - inputs: [List[WorkflowInputsVO]] - outputs: [List[WorkflowOutputsVO]] - status: (str)
- error (Optional[str]): An error message if any issues occurred during retrieval.| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| conditions | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Describes that only active conditions are returned and includes output structure. However, does not explicitly declare read-only nature or mention any side effects, authorization needs, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured, front-loaded with action verb, concise explanation of conditions, and clear return specification. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequately describes the return data including error field. Could mention pagination or result limits, but for a simple list tool without parameters, it is mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, baseline is 4. Description adds meaning by explaining the purpose and what is returned, which compensates for the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Retrieve available workflow conditions' and explains what conditions are. While it doesn't explicitly differentiate from siblings like 'list_workflow_condition_categories', the name and description make the purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, filters, or contextual cues for selection among similar list operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_event_categoriesA
Retrieve available workflow event categories.
Event categories help organize workflow triggers by type (e.g., assessment events, time-based events, user actions). This is useful for filtering and selecting appropriate events when building workflows.
Returns: - eventCategories: List of event categories with type and displayable name - error: Error message if retrieval fails
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| eventCategories | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the return structure (eventCategories and error) and implies a safe read operation. It is transparent about expected behavior, though it omits potential edge cases like auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with three short sentences, front-loading the purpose. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless retrieval tool with an output schema, the description is fully complete: it states the action, purpose, and return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the baseline is 4. The description adds value by explaining the output structure, which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource: 'Retrieve available workflow event categories.' It explains the purpose and gives examples, clearly distinguishing from sibling tools like list_workflow_activity_types by focusing on event categories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states it is 'useful for filtering and selecting appropriate events when building workflows,' which provides context but does not explicitly compare to alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_eventsB
Retrieve available workflow events that can trigger workflows.
Events are the starting points of workflows. Each event has a payload that provides data to subsequent workflow nodes. Events are categorized into two types:
System Events: Automatically triggered by the system when specific actions occur. Examples include:
Assessment run completed
Form submitted
Scheduled time-based triggers
Custom Events: Manually triggered events that can be used to:
Trigger workflows from within other workflows
Integrate with external systems
Enable manual workflow execution
Returns: - systemEvents (List[WorkflowEventVO]): A list of system events that are automatically triggered. - id (str) - categoryId (str) - desc (str) - displayable (str) - payload [List[WorkflowPayloadVO]] - status (str) - type (str) - customEvents (List[WorkflowEventVO]): A list of custom events that can be manually triggered. - id (str) - categoryId (str) - desc (str) - displayable (str) - payload [List[WorkflowPayloadVO]] - status (str) - type (str) - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| systemEvents | No | |
| customEvents | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, but the description details the output structure including systemEvents, customEvents, and an error field. It implies a read-only operation but does not explicitly state safety or authorization requirements. The description adds moderate value over annotations (none).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately detailed with a bulleted list of return fields. It is not overly verbose but could be more concise by shortening the examples and field definitions, which are already partially captured in the output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and the output schema exists, the description provides sufficient context about what the tool does and what it returns. It covers both system and custom events and includes error handling, making it complete for a retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the input schema. Since schema_description_coverage is 100% and the tool has zero parameters, the description adds no param info, but baseline for 0 params is 4. The description does not need to add parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves available workflow events, specifying two types (system and custom). It uses a specific verb 'Retrieve' and resource 'workflow events', but does not explicitly differentiate from sibling list tools like 'list_workflow_activity_types'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool over other list tools or context for usage. The description only explains what it returns, not when it is appropriate to invoke.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_function_categoriesA
Retrieve available workflow function categories.
Function categories help organize workflow activities by type. This is useful for filtering and selecting appropriate functions when building workflows.
Returns: - activity categories (List[WorkflowActivityCategoryItemVO]): List of activity categories. - name (str): Name of the category. - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| activityCategories | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It indicates a read operation via 'Retrieve' and mentions return types and error handling, but lacks explicit statements about safety, authentication, or side effects. For a simple list tool, this is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of three short sentences. The bullet list for returns is clear and efficient. Every sentence adds value without unnecessary repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no annotations, output schema exists), the description covers purpose, usage, and return structure. It includes an error field mention. It is mostly complete, though might benefit from noting that it returns all categories without filtering.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so schema description coverage is 100% trivially. According to the rubric, 0 parameters yields a baseline of 4. The description does not need to add parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Retrieve available workflow function categories', using specific verb and resource. It explains function categories organize workflow activities by type, distinguishing it from sibling tools like list_workflow_activity_types and list_workflow_conditions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says this tool is useful for filtering and selecting functions when building workflows, providing clear context. However, it does not explicitly mention when not to use it or list alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_functionsA
Retrieve available workflow functions (activities).
Functions are the core actions that can be performed in workflow nodes. They take inputs and produce outputs that can be used by subsequent nodes. Only active functions are returned.
Returns: - activities (List[WorkflowActivityVO]): List of active workflow functions with input/output specifications - id: Optional[str] = "" - categoryId (str) - desc (str) - displayable Optional[str] = "" - name (str) - inputs [List[WorkflowInputsVO]] - outputs [List[WorkflowOutputsVO]] - status (str)
- error (Optional[str]): An error message if any issues occurred during retrieval. | Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| activities | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the burden. It states only active functions are returned and provides return structure, but does not disclose potential side effects, permissions, or rate limits. It is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with purpose, and includes necessary return field details without redundancy. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and a complex output, the description provides return structure and explains function behavior (active only, inputs/outputs). It is mostly complete but could mention error handling or permissions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero parameters, so baseline is 4. The description adds no parameter info, but none is needed. Schema coverage is trivially 100%.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves available workflow functions (activities) and explains they are core actions taking inputs and producing outputs. It distinguishes from siblings like 'list_workflow_activity_types' by specifying it returns functions with input/output specifications.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving functions for workflow nodes but lacks explicit guidance on when to use versus alternatives or when not to use. No exclusion or preference is stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_predefined_variablesA
Retrieve available predefined variables for workflow configuration.
Predefined variables are system-level variables that can be used in workflow configurations. These system-level variables are mapped to specific operations. When you set a value for a predefined variable, it automatically triggers the associated system operation (like sending workflow failure notifications). Example: - Sending workflow failure notifications to specific users - Sending workflow failure notifications to admin Returns: - items (List[WorkflowPredefinedVariableVO]): A list of predefined variables. - id (str): Unique identifier of the predefined variable - type (str): Data type of the variable (e.g., Text, Boolean) - name (str): Name of the predefined variable - error (Optional[str]): An error message if any issues occurred during retrieval.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| items | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states the tool retrieves data and returns items/error, but lacks details on rate limits, authentication needs, or any side effects. It is adequately transparent for a read-only operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with clear structure: purpose statement, explanation, example, and return schema. Every sentence adds value and is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and an output schema described, the description provides sufficient context: it explains what predefined variables are, gives examples, and lists return fields. It is complete for a simple retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so parameter semantics are not applicable. The description adds value by explaining the return structure and providing examples, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves available predefined variables for workflow configuration. The verb 'retrieve' and resource 'predefined variables' are specific, and the purpose distinguishes it from sibling list_workflow_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides examples of use cases (e.g., sending notifications) but does not explicitly state when to use this tool vs alternatives or exclude other tools. Usage is implied by context and examples.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_rulesA
Retrieve available workflow rules.
Rules are predefined logic that can be executed in workflow nodes. They typically handle data processing, validation, or business logic. Rules have inputs and outputs that can be mapped to other workflow components.
Returns: - rules (List[WorkflowRuleVO]): List of available workflow rules with input/output specifications - id (str) - name: (str) - description (str) - ruleInputs: [List[WorkflowRuleInputsVO]] - ruleOutputs: [List[WorkflowRuleOutputsVO]]
- error (Optional[str]): An error message if any issues occurred during retrieval. | Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| rules | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return format and error field, confirming it's a read operation. However, it lacks details on authentication, rate limits, or side effects, which is acceptable for a simple list tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description includes a definition of workflow rules that might be redundant for an AI agent familiar with the domain. The return spec is formatted as a list, which is clear but somewhat verbose. Could be more concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of parameters and annotations, the description is fairly complete. It explains the tool's purpose and return structure. However, it doesn't mention pagination or filtering possibilities, which are not needed here. Minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The schema coverage is 100% (empty schema), and the description adds no parameter details because none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Retrieve available workflow rules,' clearly stating the verb and resource. It distinguishes from sibling tools like fetch_workflow_rule by being a list operation, and provides context on what workflow rules are.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not specify when to use this tool versus alternatives like fetch_workflow_rule or fetch_rule. No guidance on when not to use it or prerequisites, leaving the agent to infer usage from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflowsA
Retrieve a list of all available workflow configurations.
Returns: - List of workflow configuration items : Each item contains workflow metadata - Error message (str): If retrieval fails or an error occurs
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It only mentions return types and error cases but does not disclose behavioral traits like read-only nature, rate limits, or behavior when no workflows exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences covering purpose and returns. No wasted words, and key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and presence of an output schema, the description adequately covers purpose and return format. Minor missing details (e.g., sorting order) but sufficient for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so schema coverage is trivially 100%. The description adds no parameter info (none needed), meeting baseline for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Retrieve' and the resource 'all available workflow configurations.' It distinguishes itself from sibling tools like fetch_workflow_details and list_workflow_rules by focusing on listing all configurations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., fetch_workflow_details) or when not to use it. No explicit context or exclusions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflow_tasksA
Retrieve available workflow tasks.
Tasks are predefined operations that can be executed in workflow nodes. They typically handle external integrations, notifications, or complex operations. Tasks have inputs and outputs that can be mapped to other workflow components.
Returns: - tasks (List[WorkflowTaskVO]): List of available workflow tasks with input/output specifications - id (str) - name (str) - displayable (str) - description (str) - inputs: [List[WorkflowTaskInputsVO]] - outputs: [List[WorkflowTaskOutputsVO]]
- error (Optional[str]): An error message if any issues occurred during retrieval. | Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| tasks | No | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must cover behavioral aspects. It describes the return structure but lacks details on safety (e.g., read-only), authentication, or side effects. For a simple retrieval tool, this is adequate but not thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description includes a lengthy returns section that largely duplicates the output schema. Could be more concise by omitting redundant field listings.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description explains the purpose and high-level content. It provides enough context for a simple list tool, though usage guidelines are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. Description adds no parameter info, but the baseline for zero-param tools is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Retrieve available workflow tasks' and explains what tasks are, distinguishing from sibling tools like list_workflow_conditions or list_workflow_events by focusing on 'tasks' as predefined operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. Does not mention exclusions or prerequisites. Given many sibling list tools, explicit usage context is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
modify_workflowA
Modify an existing workflow using YAML definition.
The workflow ID (UUID) is required to identify which workflow to modify. This function updates an existing workflow with a new YAML specification. The YAML should define the workflow structure including states, activities, conditions, and transitions. Always display the workflow diagram and confirm with the user before executing this tool.
BEFORE using 'modify_workflow' tool, you MUST check:
Do I have the complete CCow workflow YAML schema?
Do I know the exact state configuration requirements?
Do I understand the data flow and variable reference patterns? If the answer to ANY of these is "no", respond with: "I need CCow workflow schema knowledge to properly implement this workflow. Please provide the workflow YAML specification, state definitions, and integration patterns before I proceed with modify_workflow."
Args: workflow_yaml: YAML string defining the updated workflow structure workflow_id: ID of the workflow to modify
Returns: Success message or error message
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_yaml | Yes | ||
| workflow_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden. It discloses the requirement to confirm with user and display diagram, but does not cover side effects, permissions, or locking. The behavioral detail is minimal but present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose, but then includes a lengthy checklist and fallback response script which could be more concise. It sacrifices brevity for guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 0% schema coverage and no output schema in description, it only vaguely mentions return values. It does not address error handling or prerequisites beyond the checklist. With many sibling workflow tools, more detail on when to use this versus others would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It lists both parameters with explanations: workflow_id as identifier and workflow_yaml as YAML definition. This adds meaning beyond the raw schema, though format constraints are not detailed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Modify an existing workflow using YAML definition', specifying the action and resource. It distinguishes from sibling tools like create_workflow and trigger_workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a checklist for prerequisites and instructs to display diagram and confirm with user before execution, guiding when and how to use the tool. It does not explicitly mention alternatives but the context implies distinct tools for creation and triggering.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
prepare_applications_for_executionA
Analyze rule tasks and prepare application configuration requirements for execution.
This tool helps users understand what applications are needed and whether they can share applications across multiple tasks.
WHEN TO USE:
Before calling execute_rule() to understand application requirements
To identify if multiple tasks can share the same application
To determine if unique identifiers are needed when using different applications for same appType
NOTE: This tool is optional. Rules with only 'nocredapp' tasks can be executed directly without any application configuration. Use this tool only when tasks require credentials.
APPLICATION SHARING SCENARIOS (when applications are needed):
Shared Application: User wants same credentials for all tasks of an appType
Single application config with basic appTags (just appType)
One application covers multiple tasks
Separate Applications: User needs different credentials per task
Must add unique identifier key (e.g., "purpose") to task appTags
Each application config must include matching unique identifier
No Application Needed: All tasks have 'nocredapp' appType
Skip application configuration entirely
Call execute_rule() with an empty applications list
WORKFLOW:
Call this tool with rule_name
Review which tasks need applications (if any)
If no tasks need applications (all nocredapp): Skip to step 6
For tasks with same appType, decide: share or separate?
If sharing: Provide one application config per appType If separate: Add unique identifiers and provide separate configs
Call execute_rule() with configured applications (or empty list for nocredapp rules)
Args: rule_name: Name of the rule to analyze
Returns: Dict with analysis results and configuration guidance
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It transparently describes the tool's behavior: analyzing tasks, identifying sharing possibilities, and guiding configuration. It also clarifies the optional nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with headings, bullets, and scenarios, but somewhat lengthy. Front-loaded with purpose and clear organization.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input and output schema, the description covers all necessary context: when to use, scenarios, workflow, and return type. Adequately completes the picture for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter 'rule_name' with 0% schema coverage. The description adds 'Name of the rule to analyze', which is minimal but adequate for a single string parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool analyzes rule tasks and prepares application configuration requirements for execution. It specifies the verb 'analyze' and 'prepare' and distinguishes from sibling tools like execute_rule.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides WHEN TO USE sections, including when not to use (optional for nocredapp tasks), and a detailed WORKFLOW with decision points.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
prepare_input_collection_overviewA
INPUT COLLECTION OVERVIEW & RULE CREATION
Prepare and present input collection overview before starting any input collection.
MANDATORY FIRST STEP - INPUT OVERVIEW PROCESS (Enhanced): This tool MUST be called before collecting any inputs. It analyzes all selected tasks and presents a complete overview of what inputs will be needed.
ENHANCED WITH AUTOMATIC RULE CREATION: After user confirms the input overview, this tool automatically creates the initial rule structure with selected tasks. The rule will be saved with DRAFT status and can be progressively updated as inputs are collected.
MANDATORY WORKFLOW ENFORCEMENT - CRITICAL INSTRUCTION:
AFTER user confirms the input overview, IMMEDIATELY call create_rule() with initial structure.
This call is MANDATORY and CANNOT be skipped or deferred.
The initial rule structure MUST be created before any input collection begins.
BLOCK all subsequent input collection if initial rule creation fails.
NEVER proceed to input collection without successful initial rule creation.
If create_rule() fails, STOP workflow and resolve the issue before continuing.
The rule creation establishes the foundation for progressive updates during input collection.
ENFORCEMENT STEPS:
Present overview to user
Get user confirmation
IMMEDIATELY call create_rule() with initial structure that MUST INCLUDE inputs and inputsMeta__ sections WITH ACTUAL INPUT DATA - DO NOT LEAVE inputs and inputsMeta__ SECTION EMPTY - INPUTS AND INPUTSMETA__ ARE MANDATORY CORE COMPONENTS THAT MUST CONTAIN THE REQUIRED INPUT MAPPINGS - THIS IS NON-NEGOTIABLE - NO EXCEPTIONS
Verify rule creation success before proceeding
Only then allow input collection to begin
TASK-BY-TASK INPUT COLLECTION & VALIDATION (CRITICAL ENFORCEMENT): ═══════════════════════════════════════════════════════════════════ MANDATORY WORKFLOW FOR EACH TASK:
FOR EACH TASK in selected_tasks: STEP 1: Collect ALL inputs for current task - Use collect_template_input() for file/template inputs - Use collect_parameter_input() for parameter inputs - Wait for the current task inputs to be collected
STEP 2: **MANDATORY EXECUTION** (CANNOT BE SKIPPED)
⛔ THIS STEP CANNOT BE SKIPPED ⛔
- Call execute_task(task_name, collected_inputs_for_this_task, application_config)
- This MUST happen IMMEDIATELY after all task inputs are collected
- BLOCK progression if execution fails
- If execution fails:
* Show execution errors to user
* Allow input correction
* Re-execute with corrected inputs
* Only proceed when execution succeeds
- On success:
* Store the REAL outputs from this task
* Use these outputs as inputs for dependent tasks
* Display output files to user
STEP 3: Move to next task ONLY after the task execution succeeds
- Task Execution success = prerequisite for next task
- No task can start input collection without previous task execution completing successfully
- Use the REAL outputs from the executed task as inputs for dependent tasks❌ PROHIBITED ACTIONS:
Collecting inputs for Task N+1 without executing Task N
Skipping execution "to save time"
Assuming execution will happen "later"
Moving to final rule creation without executing all tasks
✅ CORRECT WORKFLOW: Task1 Inputs → Execute Task1 → Show Results → Task2 Inputs → Execute Task2 → Show Results → Task3 Inputs → Execute Task3 → Show Results → Complete Rule
❌ WRONG WORKFLOW: Task1 Inputs → Task2 Inputs → Task3 Inputs → [Try to execute later]
SELECTIVE INPUT INCLUSION:
DO NOT automatically include ALL task inputs in initial rule creation.
Only include inputs that are REQUIRED or explicitly needed for the user's use case.
Skip optional inputs unless user specifically requests them.
Additional inputs can be added later if needed during execution or refinement.
FAILURE HANDLING:
If user confirms but create_rule() fails → STOP and fix issue.
If user declines → End workflow, no rule creation needed.
If create_rule() succeeds → Proceed to task-wise input collection and execution.
NEVER skip the create_rule() call after user confirmation.
HANDLES DUPLICATE INPUT NAMES WITH TASK ALIASES (Preserved):
Creates unique identifiers for each task-alias-input combination.
Format: "{task_alias}.{input_name}" for uniqueness.
Prevents conflicts when multiple tasks have same input names or same task used multiple times.
Maintains clear mapping between task aliases and their specific inputs.
Task aliases should be simple, meaningful step indicators (e.g., "step1", "validation", "processing").
OVERVIEW REQUIREMENTS (Preserved):
Analyze ALL selected tasks with their aliases for input requirements.
Categorize inputs: templates vs parameters.
Create unique identifiers for each task-alias-input combination.
Count total inputs needed.
Present clear overview to user.
Get user confirmation before proceeding.
Return structured overview for systematic collection.
NEW: Automatically create initial rule after user confirmation.
OVERVIEW PRESENTATION FORMAT (Enhanced with Validation):
INPUT COLLECTION OVERVIEW:
I've analyzed your selected tasks. Here's what we need to configure:
TASK 1: [TaskAlias] ([TaskName]) ─────────────────────────────────── Template Inputs: • [InputName] ([Format] file) - [Description] Unique ID: [TaskAlias.InputName]
Parameter Inputs: • [InputName] ([DataType]) - [Description] Unique ID: [TaskAlias.InputName] Required: [Yes/No]
⚠️ EXECUTION CHECKPOINT: After collecting all Task 1 inputs, execute_task() will be called to execute the task with real data before proceeding to Task 2.
TASK 2: [TaskAlias] ([TaskName]) ─────────────────────────────────── [... similar structure ...]
⚠️ EXECUTION CHECKPOINT: After collecting all Task 2 inputs, execute_task() will be called to execute the task with real data before proceeding to Task 3.
SUMMARY:
Total inputs needed: X
Template files: Y ([formats])
Parameter values: Z
Estimated time: ~[X] minutes
Execution checkpoints: [number of tasks]
WORKFLOW:
For each task in the rule:
Collect all required inputs for the task
Execute the task with real data using execute_task()
Mark the task as executed (✓)
Store REAL outputs for use by dependent tasks
After all tasks are executed → proceed to final rule completion
Ready to start task-by-task input collection with execution checkpoints?
CRITICAL WORKFLOW RULES:
ALWAYS call this tool first before any input collection.
NEVER start collecting inputs without user seeing overview.
NEVER proceed without user confirmation.
Create unique task_alias.input identifiers to avoid conflicts.
Show clear task-alias-input relationships to user.
NEW: Collect inputs task-by-task and execute each task immediately after collection.
NEW: Use REAL outputs from executed tasks as inputs for dependent tasks.
NEW: Create initial rule structure after user confirmation.
CRITICAL REQUIREMENTS:
Input names: alphanumeric + underscore only (auto-sanitize with re.sub(r'[^a-zA-Z0-9_]', '_', name))
Collection order: Complete ALL inputs for each task one by one (Task 1 → execute Task 1 → Task 2 → execute Task 2 → Task 3 → execute Task 3)
Within each task: collect all inputs, then execute using 'execute_task()' to get real outputs before proceeding
If a task (e.g., Task 2) has input files or other inputs that depend on a previous task, use the REAL output from the executed previous task as the input. Do NOT generate sample data.
If the previous task has not been executed yet, execute it first to obtain real outputs.
ARGS:
selected_tasks: List of dicts with 'task_name' and 'task_alias' Example: [ {"task_name": "data_validation", "task_alias": "step1"}, {"task_name": "data_processing", "task_alias": "step2"}, {"task_name": "data_validation", "task_alias": "final_check"} ]
Returns: Dict containing structured input overview and collection plan with unique identifiers, plus automatic rule creation capability after user confirmation, with explicit execution checkpoints for each task
| Name | Required | Description | Default |
|---|---|---|---|
| selected_tasks | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: it creates rules automatically after confirmation, handles duplicate names, enforces task-by-task execution ordering, and includes state changes. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively verbose, repeating workflow instructions multiple times with heavy formatting. While well-structured, it could be significantly shortened without losing meaning, and many sentences are redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the availability of an output schema, the description fully covers return value structure, side effects (rule creation), and workflow integration. It addresses all scenarios including failure handling and dependent task execution.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates fully by detailing the parameter structure (list of dicts with task_name and task_alias), providing examples, explaining naming conventions, and specifying auto-sanitization rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool prepares and presents an input collection overview as a mandatory first step. It distinguishes itself from sibling tools by being the overview and rule creation step, with no other tool providing this functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance (mandatory first step before any input collection) and detailed workflow steps, including enforcement, prohibitions, and failure handling. It clearly states when not to proceed and what actions to take alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_applicationB
Publish applications to make them available for rule execution.
Args: rule_name: Name of the rule these applications belong to app_info: List of application objects to publish
Returns: Dict with publication results for each application
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| app_info | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states the action without explaining side effects, required permissions, error conditions, or whether the operation is reversible. This is insufficient for an AI agent to understand the impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the purpose. It uses a structured docstring format with clear sections for args and returns, making it easy to parse. Every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has moderate complexity (2 params, array of objects) and an output schema. The description covers the basic purpose and parameters but omits details on error handling, idempotency, or constraints. It is adequate but feels incomplete for production use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It briefly explains both parameters ('Name of the rule these applications belong to', 'List of application objects to publish'), adding meaning beyond the schema. However, it does not specify the structure of the application objects, limiting helpfulness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Publish applications') and the goal ('make them available for rule execution'). It is specific and distinguishes from siblings that publish rules or check status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context (for a specific rule) but offers no guidance on when to use this tool versus alternatives like publish_rule or check_applications_publish_status. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_ruleA
Publish a rule to make it available for ComplianceCow system.
CRITICAL WORKFLOW RULES:
MANDATORY: Check rule status to ensure rule is fully developed before publishing
MUST FOLLOW THESE STEPS EXACTLY
DO NOT ASSUME OR SKIP ANY STEPS
APPLICATIONS FIRST, THEN RULE
WAIT FOR USER AT EACH STEP
NO SHORTCUTS OR BYPASSING ALLOWED
RULE PUBLISHING HANDLING:
WHEN TO USE:
After successful rule creation
User wants to make rule available for others
Rule has been tested and validated
WORKFLOW (step-by-step with user confirmation):
Fetch applications and check status
Call fetch_applications() to get available applications
Extract appTypes from ALL tasks in rule spec.tasks[].appTags.appType - MUST TAKE ALL THE TASKS APPTYPE AND REMOVE DUPLICATES - CRITICAL: DO NOT SKIP ANY TASK APPTYPES
Match ALL task appTypes with applications app_type to get application_class_name
Call check_applications_publish_status() for ALL matched applications
Present consolidated applications with meaningful format Applications for your rule: [1] App Name | Type: xyz | Status: Published | Action: Republish [2] App Name | Type: abc | Status: Not Published | Action: Publish
Select applications to publish: ___
MANDATORY: WAIT for user selection before proceeding to next step
DO NOT CONTINUE without explicit user input
BLOCK execution until user provides selection
STOP HERE: Cannot proceed to step 3 without user response
HALT WORKFLOW: Wait for user to select application numbers
NEVER SKIP THIS STEP: User must select applications first
ALWAYS ASK FOR SELECTION EVEN IF ALL APPLICATIONS ARE PUBLISHED
Publish selected applications (BLOCKED until step 2 complete)
ENTRY REQUIREMENT: User selection from step 2 must be provided
PREREQUISITE CHECK: Verify user provided application numbers
CANNOT EXECUTE: Without completing step 2 user selection
Get user selection numbers
Call publish_application() for selected applications only
Inform user whether successfully published or not
CHECKPOINT: All applications must be published before rule steps
Check rule publication status (APPLICATIONS MUST BE COMPLETE FIRST)
GATE KEEPER: Cannot proceed without application publishing completion
MANDATORY PREREQUISITE: All application steps finished
BLOCKED ACCESS: No rule operations until applications handled
Call check_rule_publish_status()
Check response valid field:
True = Already published
False = Not published
Handle rule publishing based on status If valid=False (not published):
Show: "Rule is not published. Do you want to publish it? (yes/no)"
If yes: Proceed with publishing using current name
If valid=True (already published):
Show: "Rule is already published. Choose option:"
[1] Republish with same name
[2] Publish with another name
Get user choice
Handle alternative name logic If "another name" chosen:
Ask: "Enter new rule name: ___"
Call check_rule_publish_status(new_name)
If name exists: "Name already exists. Choose option:"
[1] Use same name (republish)
[2] Enter another name
If name available: Proceed with new name
Keep checking until user chooses available name or decides to republish existing
Final publication
Call publish_rule() with confirmed name
Inform user: "Published successfully" or "Publication failed"
Rule Association:
Publishes the rule to make it available for control attachment
Ask user: "Do you want to attach this rule to a ComplianceCow control? (yes/no)"
If yes: Proceed to associate the rule with control and request assessment name and control alias from the user
If no: End workflow
EXECUTION CONTROL MECHANISMS:
STEP GATE: Each step requires completion before next
USER GATE: Each step requires user input/confirmation
EXECUTION BLOCKER: No tool calls without user response
WORKFLOW ENFORCER: Steps cannot be skipped or assumed
SEQUENTIAL LOCK: Must complete in exact order
Args: rule_name: Name of the rule to publish cc_rule_name: Optional alternative name for publishing
Returns: Dict with publication status and details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| cc_rule_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It transparently discloses the multi-step orchestration, user gating, and execution blockers. However, it does not explicitly warn about destructive side-effects of publishing, only implies caution via status checks.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is excessively long and repetitive, with multiple identical cautions and blockages. While structured, it could be condensed significantly without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is very thorough about the procedural workflow, but it lacks a precise output schema (just 'Dict with publication status and details') and does not cover error handling scenarios. Given the complexity, this is a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It explains rule_name as the primary name and cc_rule_name as an optional alternative, with detailed logic for alternative name handling in step 6. Adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it publishes a rule to make it available for ComplianceCow, which is clear. It distinguishes from siblings by including a multi-step workflow that calls other tools, but the composite nature blurs the tool's specific action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (after successful rule creation, rule tested) and mandates checking rule status first. Provides step-by-step workflow with alternatives (e.g., handle existing name) and enforces user interaction, making usage guidance very strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
schedule_asset_executionA
Schedule automated execution for a asset.
IMPORTANT WORKFLOW & SAFETY RULES:
User inputs (runPrefixName, cronTab) are mandatory and cannot be bypassed or assumed.
The
cronTabstring MUST be constructed explicitly from the user's schedule instructions (e.g., frequency, time-of-day, timezone). Never auto-generate it without user confirmation.controlPeriodMUST be one of the supported values.controlDurationMUST be a positive integer provided by the user. Args:assetId (str): Id of the asset to be scheduled.
runPrefixName (str): Human-readable name/prefix for this scheduled run.
description (str): Description for the scheduled run.
cronTab (str): Full cron expression including timezone (e.g.
TZ=Asia/Calcutta 0 0 * * *), explicitly provided/confirmed by the user. Must not be assumed or defaulted.controlPeriod (str): Control period for the assessment run, type selected by the user. Allowed values: - DAY → Last few days - WEEK → Last few weeks - MONTH → Last few months - CAL_WEEK → Last few calendar weeks - CAL_MONTH → Last few calendar months
controlDuration (int): Duration count for the selected control period Returns:
success (bool): Indicates if the schedule was created successfully.
scheduleId (str): ID of the created schedule (only present if successful).
error (Optional[str]): An error message if any issues occurred during creation.
| Name | Required | Description | Default |
|---|---|---|---|
| assetId | Yes | ||
| runPrefixName | Yes | ||
| description | Yes | ||
| cronTab | Yes | ||
| controlPeriod | Yes | ||
| controlDuration | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It covers the return values (success, scheduleId, error) but does not explain side effects (e.g., whether the schedule starts immediately, if it can overwrite existing schedules, or if validation occurs). The input constraints are detailed, but behavioral aspects are lacking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a header, bullet points, and a clear args list. It is somewhat repetitive (cronTab requirements appear twice) and could be more concise, but the organization aids readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 required params, no annotations, output schema referenced), the description covers inputs and outputs well. It lacks edge-case behavior (e.g., duplicate schedules) and could elaborate on error scenarios, but overall provides sufficient context for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides detailed semantics for all 6 parameters, including examples (e.g., cronTab format with timezone), allowed values for controlPeriod, and type requirements. This fully clarifies the parameters beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Schedule automated execution for a asset'. It distinguishes itself from siblings like delete_asset_schedule and list_asset_schedules by focusing on creation. The purpose is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a dedicated 'IMPORTANT WORKFLOW & SAFETY RULES' section that mandates user input and provides explicit instructions for constructing cronTab and selecting controlPeriod/controlDuration. However, it does not explicitly state when not to use this tool or mention alternatives like delete_asset_schedule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
suggest_control_citationsA
Suggest control citations for a given control name or description.
WORKFLOW: When user provides a requirement, ask which assessment they want to use. Get assessment name from user, then resolve to assessmentId (mandatory). For control: offer two options - select from existing control on selected assessment OR create new control. If selecting existing control, get control name from user and resolve to controlId. If creating new control, controlId will be empty.
This function provides suggestions for control citations based on control names or descriptions. The user can select from the suggested controls to attach citations to their assessment controls.
Args: controlName (str): Name of control to get suggestions for (required). assessmentId (str): Assessment ID - resolved from assessment name (required). description (str, optional): Description of the control to get suggestions for. controlId (str, optional): Control ID - resolved from control name if selecting existing control, empty if creating new control.
Returns: Dict with success status and suggestions: - success (bool): Whether the request was successful - items (List[dict]): List of suggestion items, each containing: - inputControlName (str): The input control name - controlId (str): The control ID (empty if control doesn't exist yet) - suggestions (List[dict]): List of suggested controls, each containing: - Name (str): Control name - Control ID (int): Control ID number - Control Classification (str): Classification type - Impact Zone (str): Impact zone category - Control Requirement (str): Requirement level - Sort ID (str): Sort identifier - Control Type (str): Type of control - Score (float): Similarity score - authorityDocument (str): Name of the authorityDocument - error (str, optional): Error message if request failed
| Name | Required | Description | Default |
|---|---|---|---|
| controlName | Yes | ||
| description | Yes | ||
| controlId | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It explains the suggestion generation process and return structure, but could explicitly state that it is a read-only operation with no side effects. The mention of 'suggestions' implies non-mutating behavior, but direct declaration would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (WORKFLOW, Args, Returns). It is detailed but not excessively verbose. Minor redundancy exists (e.g., repeating the suggestion context), but overall it efficiently conveys the necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the description covers workflow, parameters, and return schema adequately. However, the omission of assessmentId from the input schema is a significant gap that undermines completeness. Error handling and permissions are not mentioned, but with output schema present, return values are sufficiently documented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains controlName and controlId well, but mentions assessmentId as mandatory despite it not being in the input schema. This inconsistency reduces clarity. The description adds value by describing the optional description parameter and the workflow, but the gap regarding assessmentId is notable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Suggest control citations for a given control name or description.' It also explains the workflow, differentiating it from sibling tools like fetch_controls by focusing on suggestions based on input. The verb 'suggest' and resource 'control citations' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit workflow guidance: 'When user provides a requirement, ask which assessment they want to use...' It details prerequisites (assessmentId resolution), two options (select existing or create new), and the role of each parameter. This fully informs when and how to use the tool vs alternatives like fetch_controls.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trigger_workflowA
Trigger a workflow by the given workflow config id.
Args: - workflowConfigId: The workflow config id - event: Start event name. - inputs: Additional input payload for the event. IMPORTANT: Input values must be obtained from the user only - do not pass random/placeholder values. Each field requires meaningful user-provided values. - confirm: If False, shows a preview of required inputs and does not execute. If True, executes.
Returns: - JSON string containing execution acknowledgement or error message
| Name | Required | Description | Default |
|---|---|---|---|
| workflowConfigId | Yes | ||
| event | Yes | ||
| inputs | No | ||
| confirm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses the execution behavior (confirm flag controls preview vs actual execution), return type (JSON string with acknowledge/error), and that inputs should come from the user. Does not cover potential side effects or permissions, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with 'Args' and 'Returns' sections, front-loads the main purpose, and every sentence adds value. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a trigger tool with no annotations and no output schema, the description covers parameters, behavior of confirm, and return value. Could mention prerequisites (e.g., valid workflow config id) or error conditions, but the main functionality is sufficiently documented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, yet description provides meaningful semantics for all 4 parameters: workflowConfigId (the id), event (start event name), inputs (additional payload with user-only constraint), confirm (preview vs execute). Adds critical usage instructions beyond schema structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('trigger'), the resource ('workflow by the given workflow config id'), and directly supports the tool's name. It distinguishes itself from sibling tools like list_workflows or create_workflow by specifying the exact trigger action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: 'Input values must be obtained from the user only - do not pass random/placeholder values.' Also explains the confirm parameter's behavior (preview vs execute). Does not explicitly contrast with alternatives like execute_rule, but the trigger context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_control_noteA
Update an existing documentation note on a control.
✅ PURPOSE This tool updates an existing note that was previously created on a control. It allows modification of the note content, topic, or both.
✅ CONFIRMATION-BASED SAFETY FLOW
When confirm=False: → The tool returns a PREVIEW of the updated markdown note. → The user may edit the note before confirming.
When confirm=True: → The note is permanently updated and saved.
Args:
controlId (str): The control ID where the note exists (required).
noteId (str): The note ID to update (required).
assessmentId (str): The assessment ID or asset ID that contains the control (required).
notes (str): The updated documentation content in MARKDOWN format (required).
topic (str, optional): Updated topic or subject of the note.
confirm (bool, optional):
- False → Preview only (default, no persistence)
- True → Update and permanently save the note
Returns: Dict with success status and note data: - success (bool): Whether the request was successful - message (str, optional): Success or error message - noteId (str, optional): Updated note ID - error (str, optional): Error message if request failed
| Name | Required | Description | Default |
|---|---|---|---|
| controlId | Yes | ||
| noteId | Yes | ||
| assessmentId | Yes | ||
| notes | Yes | ||
| topic | Yes | ||
| confirm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover all behavioral traits. It discloses the preview vs. save behavior, the markdown format requirement, and the return structure. It is transparent but could mention potential error conditions (e.g., invalid IDs).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections, bullet points, and emoji highlights. It is slightly lengthy but every sentence adds value. The most critical information (purpose and safety flow) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, no annotations, and an output schema, the description covers the safety flow, parameter meanings, and return format. It is fairly comprehensive but could clarify error handling or preconditions (e.g., note existence). Still, it provides sufficient context for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description fully compensates by explaining each parameter in the Args section, including purpose, required status, and optional details (e.g., topic, confirm defaults). This adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Update an existing documentation note on a control.' It uses a specific verb ('update'), identifies the resource ('documentation note on a control'), and clearly distinguishes from sibling tools like 'create_control_note' and 'list_control_notes.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on the confirm parameter, explaining when to use preview vs. permanent save. It also describes a 'confirmation-based safety flow.' However, it does not explicitly mention when not to use this tool or suggest alternative tools for related tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_rule_readmeA
Update existing README.md file with new content.
README UPDATE:
This tool updates an existing README.md file with new content. Useful for making changes after initial creation or updating documentation as rules evolve.
Args: rule_name: Name of the rule for which to update README updated_readme_content: Updated README.md content as string
Returns: Dict containing README update status and details
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| updated_readme_content | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It notes the tool updates a file and returns a dict with status, but does not disclose whether it overwrites entirely, appends, or what happens if the README does not exist (it says 'update existing', implying failure if missing).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise but includes a redundant header 'README UPDATE:' and repeats itself somewhat. It has a clear structure with an Args section, but could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, no nesting), the description covers purpose, parameters, and return, and references an output schema. It misses error scenarios and prerequisites, but is largely complete for typical usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description is the sole source for parameter meaning. It provides clear names and types for both parameters: 'rule_name: Name of the rule...' and 'updated_readme_content: Updated README.md content as string', adding value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('update') and resource ('existing README.md file'), and distinguishes from the sibling tool 'create_rule_readme' by specifying 'update existing' and mentioning it is for making changes after initial creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for updating an existing README (as opposed to creating), which is reinforced by the sibling tool 'create_rule_readme'. However, it does not explicitly state when not to use it or list prerequisites like the README must already exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_workflow_mermaid_diagramC
Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output - mermaidDiagram (str): workflow mermaid diagram
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| mermaidDiagram | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full responsibility for behavioral disclosure. It only lists arguments and hints at id source, but fails to mention if the update is destructive, whether it overwrites the entire diagram, any side effects on related data, or the return value. The presence of an output schema is not referenced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short, using a compact 'Args:' format. It efficiently conveys the parameter explanations in two lines. However, it lacks a proper sentence or introductory phrase that states what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 required parameters and no annotations, the description is inadequate. It does not state the tool's purpose explicitly, describe return values, or indicate any behavioral constraints. The output schema exists but is unmentioned, leaving the agent without complete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning: id is 'workflow id' and can be fetched from get_workflows output; mermaidDiagram is 'workflow mermaid diagram'. This goes beyond the property names but lacks constraints like format, allowed values, or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool name 'update_workflow_mermaid_diagram' clearly indicates the action, and the description lists the parameters with explanations (id is workflow id, mermaidDiagram is the diagram). However, it does not explicitly state 'Updates the mermaid diagram of a workflow' or differentiate from sibling tools like modify_workflow, so clarity is good but not perfect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a specific usage hint: the id can be fetched from the output of get_workflows. This guides the agent on how to obtain the required id. However, it does not mention when to use this tool over alternatives (e.g., modify_workflow) or any prerequisites or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_workflow_summaryC
Args: - id (str): workflow id. This can be fetched from path /status/id of 'get_workflows' output - summary (str): workflow summary, preferably ReadMe.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| summary | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states it 'updates' the summary but does not mention side effects, overwrite behavior, required permissions, error handling, or what happens if the id is invalid. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief, listing the two parameters with a short explanation each. It is front-loaded and wastes no words. However, the structure reads like a code comment rather than natural language, which could be improved.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the large number of sibling tools, the description does not provide sufficient context for an agent to choose this tool over similar ones like 'modify_workflow'. It also fails to mention the output schema or describe the update behavior, leaving the tool's effect underdefined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must add meaning. It explains that 'id' can be fetched from a specific path, and 'summary' is 'preferably ReadMe'. This adds value beyond the bare schema but lacks detail on format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description indicates that the tool updates a workflow summary by specifying the id and summary parameters. It is clear that it targets a specific field, differentiating it from sibling tools like 'modify_workflow' which likely updates the entire workflow. However, it could be more explicit about the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as 'modify_workflow'. It does not specify context, prerequisites, or when not to use it, leaving the agent without selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_evidenceA
Upload evidence file to ComplianceCow assessment run control
Purpose: Create evidence in an executed assessment run by attaching a file
Args:
runId (str): Assessment run(aka Plan instance) ID from the executed assessment run
runControlId (str): Leaf control ID in the Assessment run where evidence will be attached
filePath (str, optional): Full file system path to the evidence file to upload
fileBytes (str, optional): Base64 encoded file content
fileName (str, optional): Name of the file when using fileBytes
Returns:
str: Success message with evidence ID, or error message
Note: Either provide filePath OR both fileBytes and fileName must be provided.
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | ||
| runControlId | Yes | ||
| filePath | No | ||
| fileBytes | No | ||
| fileName | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description discloses the return (success message with evidence ID or error) and the file provision options. However, it fails to specify side effects (e.g., overwrite behavior), permissions needed, file constraints (size, format), or behavior when both filePath and fileBytes are provided. This is adequate but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a title, Purpose, Args, Returns, and Note sections. Each sentence is relevant and concise, with no redundancy or fluff. It is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, file upload) and the presence of sibling upload_file, the description provides enough context for correct invocation, including parameter alternatives and return format. It lacks details like size limits or duplicate handling, but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds meaning by explaining each parameter's role and the logical grouping of filePath vs fileBytes+fileName. It does not specify formats for runId/runControlId, but the mutual exclusivity note adds significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Upload evidence file to ComplianceCow assessment run control' and 'Create evidence in an executed assessment run by attaching a file', specifying the verb (upload/create), resource (evidence on assessment run control), and context. It distinguishes from sibling 'upload_file' by its specific purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on required parameters (runId, runControlId) and the mutual exclusivity of filePath vs fileBytes+fileName via the note. However, it does not explicitly state when to use this tool over the sibling 'upload_file', which could be clarified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_fileA
Upload file content and return file URL for use in rules.
ENHANCED FILE UPLOAD PROCESS:
Automatically detects file format from filename and content
Validates and fixes common formatting issues for JSON, YAML, TOML, CSV, XML
Accepts JSON arrays in various formats: raw, single-line, multi-line, or escaped (auto-formatted).
Normalizes CSV delimiters and whitespace
Reformats content with proper indentation/structure
No user preview required - validation happens automatically
Returns detailed validation results and file URL
SUPPORTED INPUT FORMATS:
Raw JSON: {"key": "value"} or [{"key": "value"}]
Escaped JSON: "{"key": "value"}"
Complex escaped: "[{"repository":"name","owner":"org"}]"
Standard strings for other formats (YAML, TOML, CSV, XML)
AUTOMATIC FORMAT PROCESSING:
JSON: Detects escaped strings, unescapes, validates syntax, reformats with indentation
Raw JSON objects/arrays: Automatically converts to proper JSON string format
YAML: Validates structure, reformats with proper indentation
TOML: Validates sections and key-value pairs, reformats
CSV: Detects delimiter, strips cell whitespace, normalizes format
XML: Validates well-formed structure
Other formats: Pass through as-is
VALIDATION RESULTS:
Returns success/failure status with detailed error messages
Provides format-specific validation feedback
Indicates if content was automatically reformatted
Includes file metadata (size, format, etc.)
Args:
rule_name: Descriptive name for the rule (same across all rule inputs)
file_name: Name of the file to upload
content: File content (text or base64 encoded)
CRITICAL: Must be stringified if JSON content
content_encoding: Encoding of the content (utf-8, base64)
Returns: Dict containing upload results: { success: bool, file_url: str, filename: str, unique_filename: str, file_id: str, file_format: str, content_size: int, validation_status: str, was_formatted: bool, message: str, error: Optional[str] }
| Name | Required | Description | Default |
|---|---|---|---|
| rule_name | Yes | ||
| file_name | Yes | ||
| content | Yes | ||
| content_encoding | No | utf-8 |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries full burden. It details automatic format detection, validation, reformatting, and return of validation results. It also mentions no user preview is required, providing useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long with bullet points and sections, which is well-structured but verbose. Some content could be condensed, but the structure aids scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all aspects: input parameters, supported formats, automatic processing, validation results, and output structure (including the return dict). Given the complexity, it is thorough and leaves no major gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description's Args section adds critical meaning: rule_name context, content encoding instructions, and the critical note that JSON must be stringified. This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool uploads file content and returns a URL for use in rules, with a specific verb and resource. It distinguishes the tool as an enhanced file upload with auto-detection and validation, which is distinct from simpler uploads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the tool is for use in rules but does not explicitly state when to use it over alternatives like upload_evidence. It lacks exclusions or context about prerequisites, leaving usage partially implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_collected_inputsA
Verify all collected inputs with user before rule creation.
MANDATORY VERIFICATION STEP (Enhanced):
This tool MUST be called after all inputs are collected but before final rule completion. It presents a comprehensive summary of all collected inputs for user verification.
ENHANCED WITH AUTOMATIC RULE FINALIZATION: After user confirms verification, this tool can automatically finalize the rule by:
Building complete I/O mapping based on task sequence and inputs
Adding mandatory compliance outputs
Setting rule status to ACTIVE
Completing the rule creation process
HANDLES DUPLICATE INPUT NAMES WITH TASK ALIASES (Preserved):
Uses unique identifiers (TaskAlias.InputName) for each input
Properly maps each unique input to its specific task alias
Creates structured inputs for rule creation with unique names when needed
Maintains clear separation between inputs from different task instances
VERIFICATION REQUIREMENTS (Preserved):
Show complete summary of ALL collected inputs with unique IDs
Display both template files and parameter values
Show file URLs for uploaded templates
Present clear verification checklist
Get explicit user confirmation
Allow user to modify values if needed
Prepare inputs for rule structure creation with proper task alias mapping
NEW: Automatically finalize rule after user confirmation
VERIFICATION PRESENTATION FORMAT (Preserved): "INPUT VERIFICATION SUMMARY:
Please review all collected inputs before rule creation:
TEMPLATE INPUTS (Uploaded Files): ✓ Task Input: [TaskAlias.InputName] Task: [TaskAlias] ([TaskName]) → Input: [InputName] Format: [Format] File: [filename] URL: [file_url] Size: [file_size] bytes Status: ✓ Validated
PARAMETER INPUTS (Values): ✓ Task Input: [TaskAlias.InputName] Task: [TaskAlias] ([TaskName]) → Input: [InputName] Type: [DataType] Value: [user_value] Required: [Yes/No] Status: ✓ Set
VERIFICATION CHECKLIST: □ All required inputs collected □ Template files uploaded and validated □ Parameter values set and confirmed □ No missing or invalid inputs □ Ready for rule creation
Are all these inputs correct?
Type 'yes' to proceed with rule creation
Type 'modify [TaskAlias.InputName]' to change a specific input
Type 'cancel' to abort rule creation"
CRITICAL VERIFICATION RULES (Enhanced):
NEVER proceed to final rule creation without user verification
ALWAYS show complete input summary with unique identifiers
ALWAYS get explicit user confirmation
Allow input modifications using unique IDs
Validate completeness before approval
Prepare structured inputs for rule creation with proper task mapping
NEW: Automatically finalize rule with I/O mapping after confirmation
Args: collected_inputs: Dict containing all collected template files and parameter values with unique IDs
Returns: Dict containing verification status, user confirmation, and structured inputs for rule finalization
| Name | Required | Description | Default |
|---|---|---|---|
| collected_inputs | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description provides full behavioral transparency: it details automatic rule finalization, handling of duplicate names, verification format, and side effects (building I/O mapping, setting status to ACTIVE). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy and repetitive with multiple sections (e.g., 'ENHANCED WITH AUTOMATIC RULE FINALIZATION' repeated). However, it is well-structured with headings and bullet points, aiding readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low schema coverage and no annotations, the description fully covers the tool's purpose, usage, behavior, parameter semantics, and return value (mentioning verification status and structured inputs). The presence of an output schema supports completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% coverage, but the description compensates by explaining the 'collected_inputs' parameter as a dict containing all collected files and values, and provides a detailed presentation format showing expected fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool is for verifying collected inputs with the user before rule creation. It specifies the action (verify) and the resource (collected inputs), distinguishing it from siblings like collect_parameter_input and create_rule.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it is a mandatory step after input collection and before rule finalization. It provides requirements, a format, and rules (e.g., 'NEVER proceed without user verification'), giving clear when-to-use and process guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_control_automationA
Verify if a control is automated or not based on the presence of ruleId. If ruleId exists, fetch and return basic rule information.
Args: control_id: The ID of the control to verify
Returns: Dictionary containing automation status and rule details if automated
| Name | Required | Description | Default |
|---|---|---|---|
| control_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It explains the logic: check ruleId, fetch info if automated. However, it does not specify what 'basic rule information' includes or what happens when ruleId is absent, leaving some behavior ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with no unnecessary words, and uses a clear Args/Returns structure that aids readability. Every sentence contributes to understanding the tool's purpose and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema, the description covers the core logic adequately. It could mention the case when ruleId is missing, but the output schema likely handles that, making the description sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to the lone parameter 'control_id' by stating it is the ID of the control to verify, overcoming the 0% schema coverage. This provides context beyond the schema's type-only indication.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool verifies automation status of a control by checking ruleId presence. It uses specific verbs ('verify', 'fetch') and resource ('control automation'), and distinguishes itself from sibling tools like 'fetch_rule' or 'attach_rule_to_control' by focusing on the automation check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking automation status, but does not explicitly state when to use this tool versus alternatives. No mention of prerequisites or when not to use it, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_control_in_assessmentA
Verify the existence of a specific control by alias within an assessment and confirm it is a leaf control.
CONTROL VERIFICATION AND VALIDATION:
Confirms the control with the specified alias exists in the given assessment.
Validates that the control is a leaf control (eligible for rule attachment).
Checks if a rule is already attached to the control.
Returns control details and attachment status.
LEAF CONTROL IDENTIFICATION:
A control is considered a leaf control if:
leafControl = true, OR
has no planControls array, OR
planControls array is empty.
Only leaf controls can have rules attached.
If the control is not a leaf control, an error will be returned.
Args: assessment_name: Name of the assessment. control_alias: Alias of the control to verify.
Returns: Dict containing control details, leaf status, and rule attachment info.
| Name | Required | Description | Default |
|---|---|---|---|
| assessment_name | Yes | ||
| control_alias | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the burden. It details that the tool confirms existence, validates leaf status (with specific conditions), checks if a rule is attached, and returns details. It also discloses that non-leaf controls cause an error. This is transparent and goes beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is organized into sections with bullet points, but it is somewhat verbose. The leaf control identification details could be condensed. The main purpose is front-loaded, but the extra details could be trimmed without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity and the presence of an output schema, the description adequately explains what it does, what parameters are required, and what is returned (control details, leaf status, rule attachment info). It covers key behavioral aspects, though it could mention the error case for non-existent controls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides one-line descriptions for both parameters ('Name of the assessment' and 'Alias of the control to verify'), which adds meaning but is minimal. No additional constraints, examples, or format details are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Verify the existence of a specific control by alias within an assessment and confirm it is a leaf control.' It lists specific sub-steps (confirms existence, validates leaf status, checks rule attachment) and distinguishes this from sibling tools like 'fetch_leaf_controls_of_an_assessment' (lists all leaf controls) and 'attach_rule_to_control' (attaches rules).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage before attaching rules ('Only leaf controls can have rules attached') but does not explicitly state when to use this tool versus alternatives like fetch_controls or fetch_leaf_controls_of_an_assessment. No direct comparison or triage guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
30 tool updates
v0.1.1- Changed
create_workflow1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
create_workflow_custom_event1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
fetch_cc_rules_list1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Removed
fetch_rule_readme - Added
fetch_rule_readme_documentaion - Changed
fetch_workflow_details1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
fetch_workflow_resource_data1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
get_rules_summary1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
get_tasks_summary1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
get_workflow_by_name1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
help1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
list_all_assessment_categories4 fields changed- added
Output schema / $defs / CategoryVO / properties / id / defaultAdded value: +"" - added
Output schema / $defs / CategoryVO / properties / name / defaultAdded value: +"" - removed
Output schema / $defs / CategoryVO / requiredRemoved value: -[ - "id", - "name" -] - changed
Output schema / properties / error / defaultPrevious value: -""New value: +null
- Added
list_all_assessments - Added
list_all_assets - Removed
list_assessments - Removed
list_assets - Added
list_assets_cc - Changed
list_workflow_activity_types1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
list_workflows1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
modify_workflow1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Removed
read_file - Removed
read_resource - Added
suggest_control_citations - Removed
suggest_control_config_citations - Changed
trigger_workflow1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Removed
update_control_config_note - Added
update_control_note - Changed
update_workflow_mermaid_diagram1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Changed
update_workflow_summary1 field changed- added
Output schema / descriptionAdded value: +"Generic wrapper for non-object return types."
- Added
upload_evidence
118 tool updates
v0.1.0- First observed
add_check_to_asset - First observed
add_citation_to_asset_control - First observed
add_unique_identifier_to_task - First observed
attach_rule_to_control - First observed
check_applications_publish_status - First observed
check_rule_publish_status - First observed
check_rule_status - First observed
collect_parameter_input - First observed
collect_template_input - First observed
configure_rule_output_schema - First observed
confirm_parameter_input - First observed
confirm_template_input - First observed
create_asset_and_check - First observed
create_control_note - First observed
create_design_notes - First observed
create_rule - First observed
create_rule_readme - First observed
create_support_ticket - First observed
create_workflow - First observed
create_workflow_custom_event - First observed
delete_asset_schedule - First observed
execute_action - First observed
execute_cypher_query - First observed
execute_rule - First observed
execute_task - First observed
fetch_applications - First observed
fetch_assessment_available_actions - First observed
fetch_assessment_run_details - First observed
fetch_assessment_run_leaf_control_evidence - First observed
fetch_assessment_run_leaf_controls - First observed
fetch_assessment_runs - First observed
fetch_assessments - First observed
fetch_assets_summary - First observed
fetch_automated_controls_of_an_assessment - First observed
fetch_available_control_actions - First observed
fetch_cc_rule_by_id - First observed
fetch_cc_rule_by_name - First observed
fetch_cc_rules_list - First observed
fetch_checks - First observed
fetch_checks_summary - First observed
fetch_controls - First observed
fetch_dashboard_framework_controls - First observed
fetch_dashboard_framework_summary - First observed
fetch_evidence_available_actions - First observed
fetch_evidence_record_schema - First observed
fetch_evidence_records - First observed
fetch_execution_progress - First observed
fetch_general_available_actions - First observed
fetch_leaf_controls_of_an_assessment - First observed
fetch_output_file - First observed
fetch_recent_assessment_runs - First observed
fetch_resource_types - First observed
fetch_resources - First observed
fetch_resources_by_check_name - First observed
fetch_resources_by_check_name_summary - First observed
fetch_resources_summary - First observed
fetch_rule - First observed
fetch_rule_design_notes - First observed
fetch_rule_readme - First observed
fetch_rules_suggestions - First observed
fetch_run_control_meta_data - First observed
fetch_run_controls - First observed
fetch_task_readme - First observed
fetch_unique_node_data_and_schema - First observed
fetch_workflow_details - First observed
fetch_workflow_resource_data - First observed
fetch_workflow_rule - First observed
generate_design_notes_preview - First observed
generate_rule_readme_preview - First observed
get_application_info - First observed
get_applications_for_tag - First observed
get_asset_control_hierarchy - First observed
get_dashboard_common_controls_details - First observed
get_dashboard_data - First observed
get_dashboard_review_periods - First observed
get_rules_summary - First observed
get_task_details - First observed
get_tasks_summary - First observed
get_template_guidance - First observed
get_top_non_compliant_controls_detail - First observed
get_top_over_due_controls_detail - First observed
get_workflow_by_name - First observed
help - First observed
list_all_assessment_categories - First observed
list_assessments - First observed
list_asset_schedules - First observed
list_assets - First observed
list_checks - First observed
list_control_notes - First observed
list_workflow_activity_types - First observed
list_workflow_condition_categories - First observed
list_workflow_conditions - First observed
list_workflow_event_categories - First observed
list_workflow_events - First observed
list_workflow_function_categories - First observed
list_workflow_functions - First observed
list_workflow_predefined_variables - First observed
list_workflow_rules - First observed
list_workflow_tasks - First observed
list_workflows - First observed
modify_workflow - First observed
prepare_applications_for_execution - First observed
prepare_input_collection_overview - First observed
publish_application - First observed
publish_rule - First observed
read_file - First observed
read_resource - First observed
schedule_asset_execution - First observed
suggest_control_config_citations - First observed
trigger_workflow - First observed
update_control_config_note - First observed
update_rule_readme - First observed
update_workflow_mermaid_diagram - First observed
update_workflow_summary - First observed
upload_file - First observed
verify_collected_inputs - First observed
verify_control_automation - First observed
verify_control_in_assessment
TDQS
Scored across 118 tools
Many tools have overlapping purposes (e.g., multiple fetch rule, multiple create rule, multiple list assessment tools) making it difficult for an agent to select the correct one. Long descriptions with embedded workflows further blur boundaries.
Most tools use snake_case, but verbs vary widely (add, attach, check, collect, configure, create, delete, execute, fetch, get, list, modify, prepare, publish, schedule, suggest, trigger, update, upload, verify) without a consistent pattern. Some tools have very long names.
118 tools is excessive for a single MCP server. This indicates poor scoping and likely many overlapping or unnecessary tools, overwhelming the agent and user.
The tool set covers a broad range of compliance management functions (assets, rules, workflows, evidence, reporting). However, there are notable gaps (no delete rule, limited update tools) and the domain is not comprehensively covered given the large number of tools.
Maintenance
Related MCP Connectors
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Connect AI agents to financial institution origination, analytics, and compliance workflows.
Compliance infrastructure API connecting AI agents to Norwegian government systems (Altinn, BRREG).
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceConnects AI agents with the CrowdStrike Falcon platform to enable intelligent security analysis, providing programmatic access to detections, incidents, threat intelligence, vulnerabilities, and other security capabilities for advanced security operations and automation.250MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI assistants to query software supply chain compliance data, including asset status, security vulnerabilities, and evidence lineage. It allows for natural language analysis of compliance posture, policy violations, and deployment blockers across an organization.-
- FlicenseNot gradedqualityDmaintenanceEnables authorized compliance verification and security auditing through natural language, bridging AI assistants with industry-standard security tools for enterprise audits.24-
- AlicenseNot gradedqualityCmaintenanceConnects AI agents with the CrowdStrike Falcon platform to programmatically access detections, threat intelligence, host management, and other security capabilities for intelligent security analysis and automation.MIT