Skip to main content
Glama
Knuckles-Team

CISO Assistant MCP Server

Api contracts retrieve

ciso_assistant_api_contracts_retrieve
Read-onlyIdempotent

Retrieve a single contract by ID and mask related fields the caller is not authorized to view.

Instructions

Return a single object with unauthorized related fields masked.

Input Schema

NameRequiredDescriptionDefault
idYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.3.6

TDQS

C2.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive, so the safety profile is covered. The description adds one genuinely new behavioral fact: unauthorized related fields are masked in the response. It stops short of saying masking depends on the caller's role or which fields are affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with no filler, front-loaded and readable. It is efficient, though the brevity reflects under-specification rather than disciplined editing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple read-by-id tool whose annotations cover safety and which has no output schema, but the description still omits the resource identity, the id format, and what masking means for downstream use. Throwaway sub-clauses like 'unauthorized related fields' are left undefined.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the sole required parameter id has no description at all, so the description carried the full burden and supplied nothing — not even the identifier format (UUID vs integer) or whether it is the contract id. The one useful detail an agent needs is missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Return a single object" restates the name's retrieve verb without naming the resource (a contract) or the identifying key. It never says this fetches one contract record by id, so an agent must infer the subject from the tool name and the crowded sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of the obvious alternatives such as contracts_list, contracts_object_retrieve, or contracts_cascade_info_retrieve. The agent gets no help choosing between this and the several near-identical retrieve siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools