Skip to main content
Glama

coras_create_diagram

Create CORAS risk and threat diagrams from text or structured specs, auto-layout elements in canonical order, and generate .dgx files ready for the Threat Modelling Tool.

Instructions

Build a CORAS diagram file (.dgx) from a description and lay it out automatically, then show you how the editor draws it. Give either a structured 'spec' or 'text' in the CORAS notation. Elements are placed in the canonical left-to-right order (stakeholder, threat, vulnerability, threat scenario, unwanted incident, risk, asset), sized to fit their labels, and relationship types are inferred from the elements they join. The resulting file opens in the Threat Modelling Tool as if it had been drawn by hand.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesWhere to write the .dgx file.
specNoThe model: one or more diagrams that may share elements.
textNoThe diagram in the CORAS text notation (see coras_reference). Use this or 'spec'.
scaleNoPreview scale, default 1.5.
layoutNo'auto' (default) positions everything; 'manual' uses only the x/y you supply.
dry_runNoValidate and lay out without writing anything.
previewNoRender the result and return it as an image (default true). This also proves the editor can open the file.
directionNoFlow direction; 'right' is the CORAS norm.
overwriteNoReplace an existing file (default true).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses real behavior: it writes a file, lays elements out automatically in canonical left-to-right order, sizes them to labels, infers relationship types, and produces output that opens as if hand-drawn. It does not mention that overwrite defaults to true or that a dry_run skips writing, but those are documented in the schema; the description still provides substantial non-obvious behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the primary purpose in the first sentence. The later sentences earn their place by explaining layout order, input modes, and editor compatibility. The phrase 'show you how the editor draws it' is slightly indirect, but there is no wasted or redundant content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 9 parameters and nested spec objects, the description covers the main usage patterns, layout behavior, and output compatibility. It does not explicitly describe the return value or when to use dry_run/overwrite, but those are fully documented in the schema. The description is complete enough for an agent to decide to call the tool and choose an input mode correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reinforces that 'spec' and 'text' are the two input modes and explains layout/inference behavior, but it does not add materially new per-parameter meaning beyond what the schema already says. This is acceptable given the schema's completeness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Build a CORAS diagram file (.dgx)...' and adds the automatic layout behavior. It distinguishes cleanly from siblings like coras_read_diagram, coras_edit_diagram, coras_render_diagram, and coras_validate_file by making 'create' the core action. The input modes ('spec' or 'text') are also clearly stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: use this to build a new .dgx file, and provide either a structured spec or CORAS text notation. It does not explicitly name alternatives or say 'use coras_read_diagram for reading', but the create-vs-read/edit/render distinction is strong enough that the intended condition is clear. No exclusions are stated, so it misses a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.