Skip to main content
Glama
Knuckles-Team

CISO Assistant MCP Server

Api validation flows create

ciso_assistant_api_validation_flows_create

Create validation flows in CISO Assistant to define approval or validation steps for GRC workflows.

Instructions

API endpoint that allows validation flows to be viewed or edited.

Input Schema

NameRequiredDescriptionDefault
bodyNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.3.6

TDQS

D1.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false and openWorldHint=true, so the write/non-idempotent nature is covered structurally. The description adds nothing about what is created, required permissions, side effects, or what happens on duplicate submission, and its "viewed or edited" phrasing softly conflicts with a create-only endpoint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence, so there is no bloat, but that brevity comes from under-specification rather than efficiency: the sentence is generic boilerplate that conveys no tool-specific information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a non-idempotent mutation endpoint with an opaque free-form body, no output schema, and no annotations describing the payload, the description supplies none of the missing context an agent would need to construct a valid create request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter is an untyped `body` (anyOf object/null) with 0% schema description coverage, and the description provides zero information about what payload fields a validation flow requires. With the schema carrying no semantics, the description was the only place this could be explained and does not do so.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is generic Django-REST boilerplate ("allows validation flows to be viewed or edited") and never states that this endpoint creates a validation flow, which is what the tool name and create semantics imply. It does name the resource (validation flows) but not the operation, so it fails to distinguish itself from the many sibling list/retrieve/update tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no reference to alternatives such as validation_flows_list, validation_flows_update, or validation_flows_partial_update. Worse, "viewed or edited" actively points the agent toward read/update usage, which is the opposite of this create endpoint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools