Skip to main content
Glama

coras-mcp

tests npm licence

Describe a risk picture in words; get a real CORAS diagram, in a file the SINTEF Threat Modelling Tool opens natively — laid out the way a CORAS diagram is meant to read, and rendered back so the assistant can check its own work before handing it to you.

The 2007 editor is bundled, so there is nothing else to download.

A CORAS risk diagram generated from sixteen lines of text

Produced by coras_create_diagram from examples/online-banking.coras, then rendered through the editor's own renderer — this is exactly what the tool draws.


Install

One line, if your assistant speaks MCP:

npx -y coras-mcp

That is the command to give it. Per client:

claude mcp add coras -s user -- npx -y coras-mcp
codex mcp add coras -- npx -y coras-mcp

or in ~/.codex/config.toml:

[mcp_servers.coras]
command = "npx"
args = ["-y", "coras-mcp"]

claude_desktop_config.json → Settings ▸ Developer ▸ Edit Config:

{ "mcpServers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{ "mcpServers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }

.vscode/mcp.json:

{ "servers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }

~/.codeium/windsurf/mcp_config.json, same mcpServers shape as Cursor.

settings.json"context_servers": { "coras": { "command": { "path": "npx", "args": ["-y", "coras-mcp"] } } }

It is an ordinary stdio MCP server. Command npx, arguments -y coras-mcp.

What it needs

Node 16+

only to run npx. Skip it by cloning and using bin/coras-mcp.

Python 3.8+

runs the server. Already on macOS and Linux; on Windows install it, or install uv and the launcher will use that instead.

Java 8+

optional. Needed only to render a diagram, validate it against the real editor, or open the editor. Writing and reading .dgx works without it.

The editor builds an AWT drag-and-drop target while loading a diagram, so those three tools need a display even when they draw off-screen. On a headless Linux box, run under Xvfb (xvfb-run -a …); everything else works without one.

No Python packages, no pip install, no virtualenv — the server has zero dependencies and talks MCP over stdio directly.

From a clone instead

git clone https://github.com/Drewnja/coras-mcp.git
cd coras-mcp
python3 tests/test_coras_mcp.py          # 54 tests, ~5 s
claude mcp add coras -s user -- "$PWD/bin/coras-mcp"

Related MCP server: UML-MCP

What you can ask for

"Draw the risk picture for our payment API: an outside attacker exploits a missing rate limit, brute-forces card numbers, cards get stolen — that hurts customer money and our reputation. Add 2FA as a treatment."

The assistant calls coras_create_diagram, gets back both the .dgx file and a picture of it, and can fix anything that looks wrong before you ever open the tool. Then coras_open_editor puts it in front of you, editable by hand.

Tools

Tool

What it does

coras_reference

Every element and relationship the editor understands, and which arrows are legal.

coras_create_diagram

Writes a .dgx from a structured spec or from the text notation, lays it out, returns a picture.

coras_read_diagram

Reads an existing .dgx back into a spec and into the text notation.

coras_edit_diagram

Add, remove, rename, recolour, move, re-lay-out. Keeps a .bak.

coras_render_diagram

PNG or SVG through the editor's own renderer.

coras_validate_file

Loads the file with the editor's own loader and reports what it found.

coras_open_editor

Starts the Threat Modelling Tool, optionally with a file open.


The text notation

diagram "Online banking"

stakeholder   "The bank"                as bank
asset         "Customer data"           as data
threat        "Script kiddie"           as kiddie kind=deliberate
vulnerability "Weak password policy"    as weakpw
scenario      "Password guessed"        as guess
incident      "Customer records leaked" as leak
treatment     "Enforce two-factor auth" as mfa
region        "Internet facing"         as dmz contains=weakpw,guess
comment       "Reviewed Sept 2026"      as note

bank   -> data
kiddie -> weakpw
weakpw -> guess  "likely"
guess  -> leak   "likely"
leak   -> data   "major"
mfa    -> guess  strategy=ReduceLikelihood
note   -> leak
  • <type> <name> [as <id>] [key=value ...] declares an element. Types: stakeholder, threat, vulnerability, scenario, incident, risk, asset, treatment, region, comment (aliases such as vuln, unwanted-incident, note, control work too).

  • a -> b "label" draws an arrow. The relationship type is worked out from the two elements, by the same rules the editor uses when you draw the arrow by hand. The label is the text on the arrow: the likelihood on an initiate arrow, the consequence on a harm arrow.

  • diagram "Name" starts another diagram in the same file. The same id used in two diagrams is one model element shown twice — which is exactly what the editor's model/diagram split is for.

  • # starts a comment.

Or as a structured spec:

{
  "diagrams": [{
    "name": "Online banking",
    "nodes": [
      {"id": "kiddie", "type": "threat", "name": "Script kiddie", "kind": "deliberate"},
      {"id": "data",   "type": "asset",  "name": "Customer data"}
    ],
    "edges": [{"from": "kiddie", "to": "data", "label": "…"}]
  }]
}

Nodes also take x, y, width, height (giving x/y pins an element and turns off automatic placement for it), color, font, and — on a region — contains, which sizes the region around the elements it names.

More in examples/: an asset diagram, a threat diagram, a treatment diagram and a risk diagram.


CORAS is a typed language and the editor refuses to open a file with an illegal relationship, so every arrow is checked before anything is written, with an error that says what would have been allowed instead.

From

may point at

stakeholder

asset (ownership)

asset

asset (dependency)

threat

vulnerability (exploit); threat scenario, risk (initiate)

vulnerability

vulnerability (exploit); vulnerability, threat scenario, unwanted incident (initiate)

threat scenario

vulnerability (exploit); vulnerability, threat scenario, unwanted incident (initiate)

unwanted incident

unwanted incident, threat scenario, risk (initiate); asset (harm)

risk

asset (harm)

treatment

threat, vulnerability, threat scenario, unwanted incident (treat)

comment

anything except another comment

Two quirks of the 2007 tool, worth knowing:

  • A treatment cannot point at a risk. The editor lets you draw that arrow and then drops it when it saves — the file format has no way to express it. Point the treatment at the incident behind the risk instead.

  • Treatment strategies are written but not read back. strategy=Avoid is stored in the file; the editor shows every treat arrow as ReduceLikelihood.


Layout

Layered, left to right, and aware of the canonical CORAS reading order:

stakeholder → threat → vulnerability → threat scenario → unwanted incident → risk → asset
  • Columns nothing lands in are dropped, so an asset diagram of stakeholders and assets comes out as two tidy columns rather than seven.

  • A treatment is pulled one column left of what it treats; a stakeholder sits beside the asset it owns — above it, once threats are in the picture, so the arrows harming that asset have a clear run.

  • An arrow that skips a column gets invisible waypoints in the columns it crosses, so it routes around the shapes in between instead of through them.

  • Shapes are sized from the real font metrics of the editor's default font (SansSerif 12, measured on the JVM), so a label never spills out of its oval; a name too long for any sensible oval is broken over lines.

  • Regions are drawn behind everything and sized around their contents.

direction: "down" lays the same diagram out top to bottom. layout: "preserve" keeps positions already in the file and only places what is new — the default when editing.


How it works

.dgx is the editor's own format: JAXB-marshalled XML in the http://coras.sourceforge.net/profile/1.0 namespace, with a model part (elements and relationships) and a diagram part (where each element sits, in which diagram). The writer reproduces that output element for element and attribute for attribute, in the order the editor writes it, so a generated file is indistinguishable from a hand-drawn one.

Validation and rendering re-implement nothing: java/src/coras/mcp/Bridge.java is compiled against the editor's own jars and calls its real loader (Model.unmarshalProfileToDgmMapper) and its real JGraph renderer. If the bridge can draw it, the tool can open it.

coras_mcp/
  server.py    MCP over stdio, JSON-RPC 2.0, no dependencies
  tools.py     the seven tools
  spec.py      the CORAS language and its legality rules, read off the editor's classes
  model.py     elements, relationships, diagrams, shape sizing
  layout.py    layered automatic layout
  dgx.py       .dgx reader and writer
  dsl.py       the text notation
  metrics.py   font metrics measured on the JVM
  bridge.py    finds Java and the tool, runs the helper
bin/cli.js     npx entry point
bin/coras-mcp  starts the server from anywhere
bin/coras-tool launches the editor with the flags a modern JRE needs
java/          the Java helper, its source and its build script
tool/          the CORAS diagram editor itself (LGPL, unmodified — see NOTICE)

Running the 2007 tool on a modern JRE

The editor ships JAXB 2.0.3, which generates accessor classes at run time. Java 9 and later block that, so on a current JRE it throws ExceptionInInitializerError the moment you open or save a file. One flag fixes it, and bin/coras-tool and this server both pass it:

-Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true

Double-clicking the jar does not pass it. Use bin/coras-tool or coras_open_editor.

Where the tool lives

The bundled copy in tool/ is used by default. To point at another one:

npx coras-mcp --set-tool-dir /path/to/folder/with/diagram-editor-2.0-SNAPSHOT.jar
npx coras-mcp --where     # what it found: tool, Java, helper jar

CORAS_TOOL_DIR overrides both; CORAS_JAVA picks a JDK/JRE; CORAS_PYTHON picks an interpreter.


Tests

python3 tests/test_coras_mcp.py

54 tests: the language rules, the notation, the layout, the file format, the seven tools, the MCP protocol over a real stdio pipe, and — when Java is present — a round trip through the editor itself, including one diagram holding every legal relationship in the language.


Licence

This project is MIT (see LICENSE).

tool/ contains the CORAS diagram editor 2.0 by SINTEF, redistributed unmodified under the LGPL 2.1. Upstream: sourceforge.net/projects/coras. See NOTICE for the details and for where to get its source.

Available Tools

7 tools
coras_create_diagramA

Build a CORAS diagram file (.dgx) from a description and lay it out automatically, then show you how the editor draws it. Give either a structured 'spec' or 'text' in the CORAS notation. Elements are placed in the canonical left-to-right order (stakeholder, threat, vulnerability, threat scenario, unwanted incident, risk, asset), sized to fit their labels, and relationship types are inferred from the elements they join. The resulting file opens in the Threat Modelling Tool as if it had been drawn by hand.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesWhere to write the .dgx file.
specNoThe model: one or more diagrams that may share elements.
textNoThe diagram in the CORAS text notation (see coras_reference). Use this or 'spec'.
scaleNoPreview scale, default 1.5.
layoutNo'auto' (default) positions everything; 'manual' uses only the x/y you supply.
dry_runNoValidate and lay out without writing anything.
previewNoRender the result and return it as an image (default true). This also proves the editor can open the file.
directionNoFlow direction; 'right' is the CORAS norm.
overwriteNoReplace an existing file (default true).

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses real behavior: it writes a file, lays elements out automatically in canonical left-to-right order, sizes them to labels, infers relationship types, and produces output that opens as if hand-drawn. It does not mention that overwrite defaults to true or that a dry_run skips writing, but those are documented in the schema; the description still provides substantial non-obvious behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the primary purpose in the first sentence. The later sentences earn their place by explaining layout order, input modes, and editor compatibility. The phrase 'show you how the editor draws it' is slightly indirect, but there is no wasted or redundant content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 9 parameters and nested spec objects, the description covers the main usage patterns, layout behavior, and output compatibility. It does not explicitly describe the return value or when to use dry_run/overwrite, but those are fully documented in the schema. The description is complete enough for an agent to decide to call the tool and choose an input mode correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces that 'spec' and 'text' are the two input modes and explains layout/inference behavior, but it does not add materially new per-parameter meaning beyond what the schema already says. This is acceptable given the schema's completeness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Build a CORAS diagram file (.dgx)...' and adds the automatic layout behavior. It distinguishes cleanly from siblings like coras_read_diagram, coras_edit_diagram, coras_render_diagram, and coras_validate_file by making 'create' the core action. The input modes ('spec' or 'text') are also clearly stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: use this to build a new .dgx file, and provide either a structured spec or CORAS text notation. It does not explicitly name alternatives or say 'use coras_read_diagram for reading', but the create-vs-read/edit/render distinction is strong enough that the intended condition is clear. No exclusions are stated, so it misses a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_edit_diagramA

Change an existing .dgx file in place: add or remove elements and arrows, rename things, recolour, move, add or drop whole diagrams, or re-run the automatic layout. Existing positions are kept unless you ask for a relayout, and a .bak copy is made first.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesThe .dgx file to change.
scaleNo
backupNoWrite a .bak copy (default true).
layoutNo'preserve' (default) keeps hand positions and only places new elements; 'auto' re-lays out every diagram that changed.
previewNoReturn an image (default true).
directionNo
operationsYesEdits, applied in order. Each has an 'op': add_node, add_edge, remove_node, remove_edge, rename, set, set_label, add_diagram, remove_diagram, rename_diagram, relayout. add_node takes the same fields as a node in coras_create_diagram; add_edge takes from/to/label/type/strategy; set takes id plus any of name, kind, color, font, x, y, width, height.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that existing positions are kept unless a relayout is requested, and that a .bak copy is made first, which are key behavioral traits. It does not cover permissions, reversibility, or failure modes, but the core mutation behavior and safety net are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with two sentences that front-load the main action and then add key behavioral notes. Every sentence adds information without redundancy, making it efficient for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core functionality and key behaviors (preserving positions, backup), and the schema handles detailed parameters. It does not explicitly mention the preview/return image behavior or the ordered application of operations, but these are available in the schema. For a modification tool with this complexity, the context is adequate but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, with descriptions for path, backup, layout, preview, and operations. The description adds little beyond what the schema already says about layout (preserve vs auto) and backup behavior. It does not elaborate on scale, direction, or operation specifics, so it provides marginal added value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool modifies an existing .dgx file in place, listing concrete operations like add/remove elements, rename, recolour, move, add/drop diagrams, and relayout. It distinguishes from siblings (create, read, render) by focusing on editing existing files. The verb 'change' is specific and resource is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for editing existing diagrams, as opposed to creating new ones (coras_create_diagram). It states that positions are preserved unless a relayout is requested, giving context on when to use the layout option. However, it does not explicitly name alternatives or exclude cases like reading or rendering, so it lacks explicit when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_open_editorA

Launch the Threat Modelling Tool GUI, optionally with a .dgx file already open, so the diagram can be looked at and edited by hand. The editor keeps running after this returns.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoOptional .dgx file to open on start-up.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful non-obvious behavior: 'The editor keeps running after this returns', which signals the tool is non-blocking and the GUI persists after invocation. It also notes the optional file-open behavior, though it does not discuss side effects such as whether the file is locked or whether the tool requires a graphical environment.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. It front-loads the core action ('Launch the Threat Modelling Tool GUI') and then adds the key behavioral detail about persistence, all in minimal words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description covers the essential invocation context and the non-blocking behavior. It does not mention possible failure modes like missing display or invalid file format, but these are not critical for correct invocation, so the description is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter's meaning is already fully documented ('Optional .dgx file to open on start-up'). The description reinforces the .dgx file type but adds little beyond what the schema already provides, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Launch the Threat Modelling Tool GUI'. It also clarifies the optional .dgx file and that the diagram is for manual viewing/editing, which clearly distinguishes this tool from siblings like coras_read_diagram, coras_edit_diagram, and coras_render_diagram that operate programmatically rather than via an interactive GUI.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used when a human needs to interact with a diagram by hand ('so the diagram can be looked at and edited by hand'), but it does not explicitly mention alternative tools or state when not to use it. No exclusions or sibling names are provided, leaving the route to alternatives implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_read_diagramA

Read an existing .dgx file and return it as a structured spec and as the CORAS text notation, so it can be inspected or rewritten. Optionally renders it so you can see the current state.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesThe .dgx file to read.
scaleNo
formatNoWhat to return, default 'both'.
previewNoAlso render it as an image.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the tool reads a file and returns representations (structured spec and text notation) and optionally renders it. However, it does not explicitly state that it performs no modifications, what happens with missing or invalid files, or how scale affects the render. These gaps limit transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. The primary action and output are front-loaded, and the every clause earns its place (read behavior, output formats, use case, optional render).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with no annotations or output schema, the description covers the core functionality but leaves scale completely undocumented (no schema description either). It also does not explain the precise return structure or error handling, which an agent would need for robust use. The tool's complexity is moderate, so this is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, with scale missing a description. The description's phrases 'structured spec and CORAS text notation' map to the format parameter's default 'both', and 'Optionally renders it' maps to preview, adding some semantic value. However, it does not clarify scale or parameter interactions, so it does not fully compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb ('Read'), resource ('an existing .dgx file'), and output ('structured spec and as the CORAS text notation'). It also indicates the purpose ('so it can be inspected or rewritten') and an optional rendering behavior. This distinguishes it from siblings like coras_create_diagram (creation) and coras_render_diagram (rendering alone).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for inspecting or rewriting diagrams, but does not explicitly state when to choose this tool over alternatives such as coras_render_diagram or coras_open_editor. There are no when-not-to-use conditions or references to sibling tools, leaving the decision partly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_referenceA

The CORAS language as this 2007 Threat Modelling Tool implements it: every element type, every relationship and which elements it may connect, the treatment strategies, and the text notation. Read this first when you are unsure whether an arrow is allowed - the editor refuses to open a file with an illegal relationship.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It explains the tool's scope and the editor's rejection behavior, which is useful context. However, it does not explicitly state whether the call is read-only or what form the returned reference takes, leaving some operational behavior implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences: the first defines the scope with a compact list, and the second gives a concrete when-to-use trigger. Every clause earns its place and there is no filler or repetition of schema/annotation information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter reference tool, the description is largely complete: it states what the reference covers, when to use it, and why it matters. A minor gap is that it does not describe the output format or length, but the enumerated content list makes the expected information clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and an empty input schema, so there is no parameter ambiguity to resolve. The description correctly avoids inventing parameters and instead focuses on the tool's content and purpose, which is the appropriate baseline for a parameterless reference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as a reference for the CORAS language as implemented by this 2007 tool, and enumerates its contents: element types, relationships, treatments, and text notation. It also distinguishes the tool from siblings by positioning it as the first thing to read when checking whether an arrow is legal. It lacks an explicit action verb like 'returns' or 'provides,' but the 'reference' role is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit use condition: 'Read this first when you are unsure whether an arrow is allowed.' It also supplies a concrete reason (the editor refuses to open files with illegal relationships), which helps an agent decide when to consult it. It does not compare against named alternatives, but the sibling set makes the reference role distinct.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_render_diagramA

Render a .dgx file to PNG or SVG using the editor's own renderer, so the image is pixel-identical to what the tool shows. Returns the picture inline and writes it to disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
outNoOutput file, or a folder when rendering every diagram. Omit to use a temporary folder.
pathYesThe .dgx file to render.
scaleNoDefault 2.0.
formatNo
inlineNoReturn the PNG in the reply (default true).
diagramNoName or 0-based index of one diagram; omit for all of them.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states that the tool returns the picture inline and writes it to disk, which are key side effects, and it adds the pixel-identical guarantee. However, it does not mention error conditions, file overwrite policy, or whether the source file is modified, though the render verb implies non-destructiveness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core action ('Render a .dgx file to PNG or SVG') and immediately followed by the key distinguishing detail (pixel-identical) and output behavior. Every word contributes value; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderately complex tool with six parameters and no output schema, the description covers the core purpose, the main side effects, and the output format. It does not elaborate on return value structure or edge cases like multiple diagrams or temporary folder behavior, but the schema's high coverage compensates for parameter details. Overall, an agent likely has enough to invoke it correctly, though some behavioral nuances remain only in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, which is high, so the baseline is 3. The description does not explain individual parameters beyond what the schema already states; it only rephrases the purpose. It does add that output is written to disk and returned inline, which relates to 'out' and 'inline', but this adds limited meaning beyond the schema's descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Render'), a resource ('.dgx file'), and output formats (PNG or SVG). It also distinguishes the tool from siblings by emphasizing the editor's own renderer and pixel-identical output, making it clear this is the dedicated rendering tool among read, edit, create, validate, and open actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool (when a rendered image of a .dgx file is needed), but it does not explicitly mention alternatives or when not to use it. It does not reference sibling tools like coras_read_diagram or coras_edit_diagram, so the agent must infer the use case from the purpose alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

coras_validate_fileA

Check that a .dgx file is well formed and that the Threat Modelling Tool itself can load it, reporting what it found in each diagram.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool reports what it found in each diagram, which is a useful behavioral detail. However, with no annotations provided, the description carries the full burden of behavioral disclosure. It does not mention whether the tool modifies the file, what happens on failure, or whether it requires specific permissions. The 'check' verb implies a read-only operation, but this is not explicitly stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the primary action ('Check that a .dgx file is well formed') and adds a secondary detail about reporting. Every word earns its place, and there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple validation tool with one parameter and no output schema, the description is mostly complete. It explains what the tool does and what it reports. However, it lacks details about the return format or how the results are presented, which could be important for an agent deciding whether to call this tool. The absence of annotations increases the burden, but the simplicity of the tool keeps the gap moderate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has only one parameter, 'path', with no description. The description mentions '.dgx file' but does not explicitly state that 'path' should point to a .dgx file. Since schema description coverage is 0%, the description must compensate, and it partially does by implying the file type, but it could be more explicit about the parameter's meaning and format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: validating a .dgx file for well-formedness and loadability by the Threat Modelling Tool, and reporting findings per diagram. It uses a specific verb ('Check') and resource ('.dgx file'), and it distinguishes itself from sibling tools like coras_read_diagram or coras_edit_diagram by focusing on validation rather than reading or editing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you need to validate a .dgx file before loading or editing it. However, it does not explicitly state when not to use it or mention alternatives like coras_read_diagram for inspecting content. The context is clear but lacks explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv1.0.0
    • First observedcoras_create_diagram
    • First observedcoras_edit_diagram
    • First observedcoras_open_editor
    • First observedcoras_read_diagram
    • First observedcoras_reference
    • First observedcoras_render_diagram
    • First observedcoras_validate_file

TDQS

A4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinct operation—create, read, edit, render, validate, open in the GUI, or consult the language reference—so there is little risk of selecting the wrong one. The only close pair, read vs. render, is clearly separated by output type: structured spec/text vs. PNG/SVG image.

Naming Consistency4/5

Most tools follow a consistent coras_<verb>_<noun> pattern: coras_read_diagram, coras_edit_diagram, coras_render_diagram, coras_create_diagram, coras_open_editor. The exceptions are coras_reference, which is a bare noun, and coras_validate_file, which uses 'file' rather than 'diagram', but these are minor deviations.

Tool Count5/5

Seven tools is well-scoped for a CORAS diagram server. Each tool has a clear role covering creation, inspection, editing, rendering, validation, GUI launch, and language reference, with no apparent redundancy.

Completeness4/5

The core diagram lifecycle is well covered: create, read, edit, render, validate, and even open in the desktop editor. Minor gaps exist—there is no explicit file listing/deletion or a tool to close the launched editor—but these do not block the main workflows.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    F
    maintenance
    Enables AI-driven graphical diagram creation and manipulation using natural language, with support for BPMN workflows, analysis, and manual editing via the Model Context Protocol.
    1
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI-powered threat modeling with tools for creating threat models, analyzing security threats, generating security controls, and validating architecture against best practices.
    -