ciso_assistant_api_contracts_object_retrieveRetrieve a specific contract by ID from CISO Assistant to view or edit its details, enabling targeted contract management through the GRC API.
API endpoint that allows contracts to be viewed or edited.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
Changes observed during successful MCP inspections.
v2.3.6Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, yet the description claims the endpoint allows contracts to be "edited" – a write capability the annotations explicitly deny. The description also adds nothing about what the object payload contains or what permissions are required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no padding, so nothing is wasted, but it is under-specified rather than efficient. The one clause it does contain ("or edited") is actively harmful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no schema descriptions, and a dense set of contracts siblings, the definition should carry the burden of explaining the return shape and the read/write distinction. It does neither, leaving the agent to guess.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single required parameter 'id' has 0% schema description coverage and the description says nothing about it – not whether it is a UUID, ref_id, or numeric key. With one documented-by-nothing parameter, the description fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource (contracts) but pairs it with the ambiguous verb phrase "viewed or edited," so an agent cannot tell whether this call reads or writes. It offers no differentiation from the sibling contracts_retrieve, contracts_object_retrieve vs contracts_retrieve is exactly the distinction the agent needs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus contracts_retrieve, contracts_list, or contracts_partial_update. The only usage signal is the generic "allows contracts to be viewed," which is implied rather than stated, and no prerequisites or exclusions appear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.