Skip to main content
Glama
Knuckles-Team

CISO Assistant MCP Server

Api ebios rm kill chains retrieve

ciso_assistant_api_ebios_rm_kill_chains_retrieve
Read-onlyIdempotent

Retrieve a single EBIOS RM kill chain by ID, with unauthorized fields masked, to review risk scenarios while respecting access controls.

Instructions

Return a single object with unauthorized related fields masked.

Input Schema

NameRequiredDescriptionDefault
idYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.3.6

TDQS

C2.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so safety is covered. The description does add genuine value by disclosing that unauthorized related fields are masked, which affects how the agent should interpret missing fields. It does not mention behavior on a nonexistent or inaccessible id (error vs. empty response).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, front-loaded sentence with no filler, but the brevity is achieved by omitting essentials rather than by precision. Nothing is wasted, yet nothing is spent where it matters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple read with a 1-param schema and no output schema, so the description carries the load for identifying the resource, the id semantics, and the return shape. It covers only the masking caveat; the agent learns neither what entity is returned nor what its fields look like.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required 'id' parameter, so the description must compensate and does not: it never states that the id identifies a kill chain, nor what format the identifier takes (numeric pk, ref_id, or uuid). The description is silent on the only parameter that exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Return a single object" states a verb and cardinality, but never names the resource (EBiOS RM kill chain) or says the object is selected by id. The agent must fall back on the tool name to know what is being fetched, and nothing separates it from siblings like kill_chains_object_retrieve or kill_chains_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus the sibling retrieve variants (object_retrieve, list, cascade_info_retrieve) or on prerequisites such as needing a valid kill chain id. The agent is left to infer usage entirely from naming conventions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools