Skip to main content
Glama
mcp-server-scf

mcp-server-scf

by MarkAC007

mcp-server-scf

CI Security OpenSSF Scorecard Socket.dev

npm version npm downloads install size License: MIT MCP

MCP Registry

TypeScript Node.js

Security compliance controls, frameworks, and risk management for AI agents.

Give your AI assistant access to 1,451 SCF security controls, 354+ framework mappings (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), evidence tracking, risk registers, and vendor risk management โ€” all through the Model Context Protocol.

Built for the SCF Controls Platform. Maintained by ComplianceGenie.io.

๐Ÿ†• The platform is now open-source, self-hosted software. The SCF Controls Platform โ€” SCF-native GRC tooling for the free Secure Controls Framework content โ€” is published under AGPL-3.0 at scf-controls-platform-oss. Companies download and host it themselves via Docker Compose.

Having trouble? โ†’ docs/troubleshooting.md ยท API key setup โ†’ docs/authentication.md ยท How it works โ†’ docs/architecture.md


Overview

mcp-server-scf connects AI assistants to the SCF Controls Platform via MCP, enabling natural language interaction with your compliance program. Your AI can browse the full SCF control catalog, track implementation progress, manage evidence collection, assess risks, and monitor third-party vendors โ€” all without leaving your editor or chat.

42 tools over 225 platform operations, in 16 groups. Each tool is one noun and direction โ€” scf_vendor_read, scf_vendor_write โ€” and its method argument picks the operation; the method description explains each one. Read tools are readOnlyHint: true, so a client can allow them all at once.

Only the core groups are in the tool list at startup (26 tools, about 27k tokens of schema instead of 71k). Call scf_load_tools with the groups you need โ€” or all โ€” and the rest appear; the server sends notifications/tools/list_changed. A client that ignores that notification can set SCF_LOAD_ALL_TOOLS=true to get everything up front. Per-group docs list every method with its parameters; docs/migration-consolidation.md maps each pre-v4 tool name to its tool and method.

Group

Loaded

Operations

Tools

catalog

core

8

scf_catalog_read

controls

core

15

scf_control_read, scf_control_write

evidence

core

25

scf_evidence_read, scf_evidence_write, scf_evidence_file_read, scf_evidence_file_write, scf_list_evidence_tasks, scf_evidence_task_write

assessments

core

17

scf_assessment_read, scf_assessment_write

risk

core

19

scf_risk_read, scf_risk_write, scf_custom_risk_read, scf_custom_risk_write

vendors

core

23

scf_vendor_read, scf_vendor_write, scf_vendor_record_write

systems

core

19

scf_system_read, scf_system_write, scf_capability_theme_read

organization

core

12

scf_org_read, scf_update_org_settings, scf_user_read, scf_mark_notifications_read

teams

on demand

11

scf_team_read, scf_team_write

collaboration

on demand

7

scf_collaboration_read, scf_collaboration_write

documents

on demand

15

scf_document_read, scf_document_write

engagements

on demand

16

scf_engagement_read, scf_engagement_write

assurance

on demand

19

scf_assurance_read, scf_assurance_write

catalog-reconciliation

on demand

9

scf_catalog_reconciliation_read, scf_catalog_reconciliation_write

webhooks

on demand

6

scf_webhook_read, scf_webhook_write

journey

on demand

4

scf_journey_read, scf_journey_write

Related MCP server: Fianu Compliance Intelligence MCP Server

Try it with MCP Inspector

Kick the tires without adding the server to a client โ€” MCP Inspector launches a local UI that introspects every tool, its schema, and its description:

npx @modelcontextprotocol/inspector npx -y mcp-server-scf

Inspector opens on http://localhost:6274 and connects to mcp-server-scf over stdio. You'll see the 26 core tools (set SCF_LOAD_ALL_TOOLS=true for all 42), each with a method picker and its Zod schema rendered as a live form.

Live tool calls need your instance's URL and an API key โ€” export SCF_API_URL and SCF_API_KEY in the same shell before launching Inspector, or set them under the "Environment Variables" tab inside the Inspector UI. Without them, you can still browse schemas and descriptions; tool calls return a configuration error.


Quick Start

1. Self-host the platform & get an API key

The SCF Controls Platform is open-source software you host yourself โ€” there is no sign-up. Deploy it from scf-controls-platform-oss (a Docker Compose stack with bundled PostgreSQL, Redis, and MinIO), then:

  1. Set an API_KEY in the platform's .env (generate one with openssl rand -hex 32), or create a key in Settings โ†’ API Keys once the app is running.

  2. Note your instance's API URL โ€” http://localhost:8000 by default, or your deployed host.

Use that key as SCF_API_KEY and the instance URL as SCF_API_URL (see Configuration).

2. Install โ€” one-click

Pick the route for your client.

Claude Desktop โ€” the one-click path is the signed .mcpb Desktop Extension below. Claude Desktop does not register a custom URL scheme, so there is no clickable deeplink; instead you drag the .mcpb onto Settings โ†’ Extensions and paste your API key once. See anthropics/claude-code#26952 for the upstream tracking issue.

Cursor โ€” click the badge below. Cursor registers the cursor:// scheme, so the deeplink opens the IDE with the server config pre-filled:

Install in Cursor

After install, edit the pre-filled SCF_API_URL to point at your instance โ€” there is no hosted default.

Prefer to edit config by hand, or on a client without a deeplink (Windsurf, Docker)? See 3. Manual config below.

Claude Desktop Extension (.mcpb)

For Claude Desktop โ‰ฅ 0.11.0, the easiest install is a signed .mcpb bundle โ€” no JSON editing, no npx runtime, no Node required on the host:

  1. Download mcp-server-scf-<version>.mcpb from the latest GitHub release.

  2. Double-click the file (or drag it onto Claude Desktop โ†’ Settings โ†’ Extensions).

  3. When prompted, paste your scf_โ€ฆ API key. It's stored in your OS keychain, not in a config file.

  4. Claude Desktop restarts the server and the core tools are available; ask for more with scf_load_tools.

To uninstall or update the API key later: Settings โ†’ Extensions โ†’ SCF Controls Platform โ†’ Configure.

3. Manual config

Claude Desktop โ€” edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "scf": {
      "command": "npx",
      "args": ["-y", "mcp-server-scf"],
      "env": {
        "SCF_API_KEY": "your_api_key_here",
        "SCF_API_URL": "http://localhost:8000"
      }
    }
  }
}

Claude Code:

claude mcp add scf -- npx -y mcp-server-scf
export SCF_API_KEY="your_api_key_here"
export SCF_API_URL="http://localhost:8000"

Cursor / Windsurf โ€” same JSON shape as Claude Desktop in .cursor/mcp.json (or the equivalent Windsurf path).

Docker:

{
  "mcpServers": {
    "scf": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "SCF_API_KEY", "-e", "SCF_API_URL", "markac007/mcp-server-scf"],
      "env": {
        "SCF_API_KEY": "scf_your_api_key_here",
        "SCF_API_URL": "https://scf.your-domain.example"
      }
    }
  }
}

Configuration

Variable

Required

Default

Description

SCF_API_KEY

Yes

โ€”

API key from your self-hosted platform instance

SCF_API_URL

Yes

โ€”

Base URL of your self-hosted platform (e.g. http://localhost:8000). The former hosted default is decommissioned.


SCF_LOAD_ALL_TOOLS=true lists every tool at startup instead of the core groups โ€” for a client that does not act on notifications/tools/list_changed after scf_load_tools.

Remote (Streamable HTTP): mcp-server-scf-http serves the same tools by URL for a hosted, multi-user deployment. No server-side key: each caller sends their own Authorization: Bearer scf_โ€ฆ, forwarded to the one platform in SCF_API_URL. Connect with claude mcp add --transport http scf https://<host>/mcp --header "Authorization: Bearer scf_โ€ฆ". Details and a hardened Compose example in docs/authentication.md.

Example Prompts

Once connected, try asking your AI assistant:

  • "What NIST 800-53 controls apply to access control?"

  • "Show me my organization's control implementation progress."

  • "List all critical vendors and their risk scores."

  • "Create a risk assessment for our cloud migration."

  • "What evidence do I need to collect for SOC 2 audit?"

  • "Show the 5x5 risk matrix for my organization."

  • "Run a DPSIA on our cloud provider vendor."

More examples live in each per-domain doc under docs/tools/.


Documentation


Security

  • API keys are never logged or included in error messages.

  • Keys are SHA-256 hashed server-side. Use HTTPS for any instance reachable beyond localhost.

  • Rate limiting: 100 req/min read, 20 req/min write.

  • Multi-tenant โ€” all operations scoped to your organization.

  • npm package published with provenance attestation via OIDC trusted publishing.

  • CI includes Gitleaks secret detection, CodeQL analysis, and Semgrep SAST.

See SECURITY.md to report a vulnerability.


Privacy Policy

mcp-server-scf is a stateless connector โ€” it stores no user data itself. All data flows directly between your MCP client and your own SCF Controls Platform instance, authenticated with your API key; nothing is sent to, or retained by, any third party. See the full privacy policy for details.


Development

git clone https://github.com/MarkAC007/mcp-server-scf.git
cd mcp-server-scf
npm install
npm run build
npm run dev        # Watch mode
npm run lint       # ESLint
npm test           # Vitest

Testing with MCP Inspector

SCF_API_KEY=scf_your_key npx @modelcontextprotocol/inspector node build/index.js

Contributing

Contributions welcome! Please read CONTRIBUTING.md before submitting PRs.

This project follows the Contributor Covenant โ€” see CODE_OF_CONDUCT.md. By participating, you are expected to uphold this code.

  1. Fork the repository

  2. Create your feature branch (git checkout -b feature/amazing-feature)

  3. Commit your changes (git commit -m 'Add amazing feature')

  4. Push to the branch (git push origin feature/amazing-feature)

  5. Open a Pull Request


License

MIT โ€” see LICENSE.


Available Tools

26 tools
scf_assessment_readB
Read-only

Read AI evidence assessments: a file's verdict, the file summary, review queues, window assessments (list, one, versions, summary), and control composites. Pick with method.

NameRequiredDescriptionDefault
tierNofile (default): entries carry file_id, act with scf_review_evidence_assessment. window: entries carry window_assessment_id, act with scf_review_window_assessment_verdict Used by: review_queue.
limitNoPage size (1โ€“200, default 50) [review_queue] | Page size (1โ€“100, default 10) [list_windows] | Page size (1โ€“500, default 100) [list_control_composites] Used by: review_queue, list_windows, list_control_composites.
cursorNoOpaque pagination cursor โ€” pass next_cursor from a prior response Used by: list_control_composites.
domainNoFilter by SCF domain code (e.g., 'BCD', 'GOV', 'AST') Used by: list_control_composites.
methodYesfile_assessment: Get the AI assessment for an evidence file: status, relevance score (0โ€“100), findings, summary, audit metadata (model, tokens, cost). Findings name catalogue-mapped controls, not only in-scope ones. file_summary: Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents. review_queue: List AI verdicts awaiting a human decision, worst first (read โ€” viewer role). tier=file (default) lists per-file verdicts; tier=window is the web app's Awaiting-confirmation queue. list_windows: List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost. window: Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost. window_versions: List every AI verdict a window assessment has received, newest first (read โ€” viewer role). Each version is frozen as reached (model, prompt version, designations) plus any human decision on it. window_summary: Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including `insufficient_sample`), average relevance score, and total cost in cents. control_composite: Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async). list_control_composites: List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient โ†’ sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.
offsetNoPagination offset (default 0) [review_queue] | Pagination offset โ€” number of results to skip (default 0) [list_windows] Used by: review_queue, list_windows.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
scf_idNoSCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') Used by: control_composite.
statusNoQueue filter (default awaiting) [review_queue] | Comma-separated composite_status values to include (e.g., 'insufficient,partial'). Valid values: insufficient, insufficient_sample, partial, pending, no_evidence, sufficient [list_control_composites] Used by: review_queue, list_control_composites.
file_idNoEvidence file UUID โ€” obtain from scf_list_evidence_files Used by: file_assessment.
evidence_idNoEvidence ID (e.g., 'ERL-IAM-001') โ€” obtain from scf_list_evidence [file_assessment] | Evidence ID (e.g., 'E-IAM-01') โ€” obtain from scf_list_evidence [list_windows] Used by: file_assessment, list_windows.
assessment_idNoWindowed assessment UUID โ€” obtain from scf_list_window_assessments [window] | Window assessment UUID โ€” obtain from scf_list_window_assessments [window_versions] Used by: window, window_versions.
computation_versionNoRestrict to composites computed at this algorithm version Used by: list_control_composites.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is consistent with readOnlyHint=true and adds scope by listing the assessment types covered. However, it does not add behavioral context such as role requirements, async composite availability, or pagination behavior beyond what annotations and schema already provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no wasted wording, and it efficiently lists the supported assessment categories. The ending "Pick with method" is terse but functional, though the sentence could better structure the method-selection instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-method, 13-parameter polymorphic read tool, the description is minimal and relies heavily on the detailed method enum in the schema. It gives enough orientation to select the tool, but it does not explain return shapes or method-specific behavior at the top level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameter meanings are already fully documented in the input schema. The description adds only the high-level instruction to select behavior with method, which is useful but already reflected in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific read operation for AI evidence assessments and enumerates the main assessment categories: file verdict, file summary, review queues, window assessments, and control composites. It is clearly distinct from a write tool, though it does not explicitly name sibling alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "Pick with method" gives essential dispatch guidance for a polymorphic tool, but it does not explain when to use this tool versus related read tools or when each method is appropriate. The detailed method guidance lives in the schema rather than in the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_assessment_writeA

Run and review AI evidence assessments (editor+, async): assess a file or many, assess a window or many, refresh stale windows, confirm or override verdicts, set window acceptance.

NameRequiredDescriptionDefault
ewa_idNoWindow assessment UUID โ€” obtain from scf_list_window_assessments Used by: review_window.
methodYesassess_file: Queue an AI assessment of one evidence file (write โ€” editor+, async); poll scf_get_evidence_assessment. Judged against the catalogue's mapped controls, which may include controls not in scope. assess_files_bulk: Queue AI assessments for multiple evidence files (write โ€” editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued. review_file_verdict: Record a human decision on a file's current AI assessment (write โ€” editor role). confirmed keeps the verdict; overridden needs a reason and at least one objective re-designation. assess_window: Queue a windowed AI assessment of every file in the item's frequency window as one portfolio (write โ€” editor+, async). 422 without tracking/frequency. Judged against catalogue-mapped controls. assess_windows_bulk: Queue windowed AI assessments for up to 25 evidence IDs (write โ€” editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response. refresh_stale_windows: Queue a fresh windowed AI assessment for every evidence item whose newest file postdates its last assessment (write โ€” editor role). Capped per run; returns how many were queued. review_window: Set a windowed assessment's acceptance review (write โ€” editor): approved, rejected (raises a deficiency per in-scope control), needs_revision, or not_reviewed to revoke. review_window_verdict: Confirm or override a window's current AI verdict (write โ€” editor role). overridden needs a reason and โ‰ฅ1 objective re-designation. One decision per version; 422 without objectives: confirm.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
reasonNoWhy the verdict is overridden โ€” required when decision is overridden Used by: review_file_verdict, review_window_verdict.
file_idNoEvidence file UUID โ€” obtain from scf_list_evidence_files Used by: assess_file, review_file_verdict.
decisionNoconfirmed = AI verdict stands; overridden = you are changing it Used by: review_file_verdict, review_window_verdict.
file_idsNoSpecific evidence file UUIDs to assess Used by: assess_files_bulk.
evidence_idNoEvidence ID (e.g., 'ERL-IAM-001') โ€” obtain from scf_list_evidence [assess_file] | Evidence ID โ€” assesses every file under this evidence item [assess_files_bulk] | Catalog evidence ID the file belongs to, e.g. E-IAM-01 [review_file_verdict] | Evidence ID (e.g., 'E-IAM-01'). Tracking row with a frequency must exist โ€” set via scf_update_evidence first [assess_window] Used by: assess_file, assess_files_bulk, review_file_verdict, assess_window.
ao_overridesNoObjectives to re-designate โ€” required (โ‰ฅ1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation. 422 if the version has no per-objective answers: confirm instead Used by: review_file_verdict, review_window_verdict.
evidence_idsNoEvidence IDs to assess (e.g., ['E-IAM-01','E-BCM-11']); 1โ€“25 per request Used by: assess_windows_bulk.
review_notesNoReviewer notes Used by: review_window.
assessment_idNoWindow assessment UUID โ€” obtain from scf_get_assessment_review_queue (window_assessment_id) or scf_list_window_assessments Used by: review_window_verdict.
review_statusNoReview state to set; not_reviewed revokes Used by: review_window.
assess_unassessedNoAlso assess every file that has no existing assessment (default false) Used by: assess_files_bulk.
assessment_sourceNoOrigin tag for the request (default on_demand) Used by: assess_file, assess_window.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false; the description adds the editor+ role requirement and the async/queued nature, which the annotations do not cover. It omits the more consequential behaviors โ€” that rejecting a window raises deficiencies, that verdict decisions are version-bound, that bulk calls cap at 50/25 โ€” leaving those to the schema. Notably, 'rejected raises a deficiency per in-scope control' is a side effect sitting under destructiveHint=false, but that disclosure exists in the schema rather than contradicting the description text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that compresses eight dispatch methods into parallel clauses ('assess a file or many, assess a window or many'), with no wasted words and the permission/async qualifier placed high.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter polymorphic dispatcher with no output schema, the description is thin: it never states that exactly one method must be chosen and that required parameters vary by method, nor what each method returns (counts, skipped_detail, poll targets). The schema carries most of that load, so the definition is workable, but the top-level description does not fully prepare an agent for method dispatch.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the enum descriptions already tag each parameter with its applicable method ('Used by: ...'), including prerequisites and 422 conditions. The description contributes no parameter semantics beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Run and review AI evidence assessments') and enumerates the eight concrete operations (assess file/window, bulk, refresh stale, confirm/override verdicts, set acceptance). The '(write)' title and the tool name separate it from scf_assessment_read, though the description never names that read sibling as the alternative, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'(editor+, async)' tells the agent the required role and that operations are queued rather than synchronous, which is real selection context. However, no when-to-use guidance appears in the description itself โ€” the per-method routing (which method to pick, what to poll afterward, when to skip) lives entirely in the schema's enum descriptions, so the description alone only implies usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_capability_theme_readB
Read-only

Read capability themes (KSIs): list themes, one theme, the multi-axis scorecard, per-theme evidence posture, or the controls mapped to a theme. Pick with method.

NameRequiredDescriptionDefault
limitNoMax results per page (1โ€“200, default 50) Used by: controls.
methodYeslist: List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view. get: Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage. scorecard: Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands. evidence_posture: Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards. controls: List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering โ€” ideal for KSI drill-down.
offsetNoPagination offset โ€” number of results to skip (default 0) Used by: controls.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
theme_codeNoCapability theme code (e.g., 'ACCESS_CONTROL', 'INCIDENT_RESPONSE') โ€” obtain from scf_list_capability_themes [get] | Capability theme code (e.g., 'ACCESS_CONTROL') โ€” obtain from scf_list_capability_themes [controls] Used by: get, controls.
scope_statusNoFilter by scoping status (default: in_scope) Used by: controls.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already establishes the safety profile, so the description only needs to add depth. It hints at return content for each mode (multi-axis scorecard, per-theme evidence posture) but says nothing about pagination behavior, cost of the scorecard mode, or how bands/confidence values are derived. Adequate but thin given annotations already cover safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence lists the five modes, followed by a short imperative on how to choose among them. Nearly every clause earns its place, though 'Pick with method' is terse to the point of being cryptic for a first-time reader.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, a five-mode read tool needs to convey what comes back per mode; the description does so only at a high level and omits band semantics, evidence confidence meaning, and the fact that org_id originates from scf_list_organizations. It is passable because the method enum compensates, but the description alone is not self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the method enum already spells out each mode's output in detail, so the schema does the heavy lifting. The description only reinforces that method drives behavior; it adds no meaning about limit, offset, scope_status, or theme_code beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb (Read) plus resource (capability themes/KSIs) and enumerates the five result shapes: theme list, single theme, scorecard, evidence posture, and mapped controls. That distinguishes it well from sibling read tools such as scf_control_read, though it does not name any sibling outright and leaves the 'KSI' acronym unexplained.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' is the only routing guidance, telling the agent that mode selection is done via the method parameter. It does not say when to prefer this tool over scf_control_read or scf_assessment_read, nor does it warn which modes require theme_code, leaving that to the schema's per-value 'Used by' notes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_catalog_readB
Read-only

Read the SCF reference catalog (no org): controls, one control with its objectives and evidence, domains, frameworks, assessment objectives, evidence definitions. Pick with method.

NameRequiredDescriptionDefault
limitNoPage size (1โ€“100, default 25) Used by: list_controls, list_assessment_objectives, list_evidence.
domainNoSCF domain code (e.g., 'GOV', 'AST', 'IAC') โ€” obtain from scf_list_domains Used by: list_controls.
methodYeslist_controls: List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search. get_control: Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog. list_domains: List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control). get_domain: Get one SCF domain with its controls (read, no org). Deprecated controls are excluded unless include_deprecated is set; a deprecated domain still resolves, badged. list_frameworks: List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names. list_assessment_objectives: List SCF assessment objectives โ€” the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination. list_evidence: List the SCF reference catalog's 272 evidence types (read, no org). control_mappings is the catalogue-wide mapping, not scope โ€” see scf_get_evidence_requiring_controls. Free-text search, pagination. get_evidence: Get one catalog evidence entry (read, no org): title, description, area of focus, control_mappings โ€” the catalogue-wide mapping, not scope. In-scope requirers: scf_get_evidence_requiring_controls.
offsetNoPagination offset โ€” number of results to skip (default 0) Used by: list_controls, list_assessment_objectives, list_evidence.
scf_idNoSCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'IAC-15', 'GOV-02') Used by: get_control.
searchNoFree-text filter applied to control title and description [list_controls] | Free-text filter applied to objective text [list_assessment_objectives] | Free-text filter applied to evidence title and description [list_evidence] Used by: list_controls, list_assessment_objectives, list_evidence.
frameworkNoFramework slug (e.g., 'nist-800-53', 'iso-27001') โ€” obtain from scf_list_frameworks Used by: list_controls.
control_idNoLimit to one SCF control in DOMAIN-NN format (e.g., 'GOV-01', 'AST-02') Used by: list_assessment_objectives.
identifierNoDomain code or slug, e.g. 'IAC' โ€” obtain from scf_list_domains Used by: get_domain.
evidence_idNoCatalog evidence ID, e.g. E-IAM-01 โ€” obtain from scf_list_evidence_catalog Used by: get_evidence.
include_deprecatedNoInclude catalog rows deprecated by a later SCF version. Default false โ€” the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included. [list_controls, list_domains, list_assessment_objectives, list_evidence] | Include deprecated controls (default false) [get_domain] Used by: list_controls, list_domains, get_domain, list_assessment_objectives, list_evidence.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already declares the safety profile, so the description's main contribution is the catalog-versus-org scoping note and the hint that a single-control read returns objectives and evidence. It does not disclose pagination behavior, result caps, or deprecated-row handling beyond what the schema enumerates. Useful but not rich behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the resource and scope front-loaded and the operation list following. Every clause maps to real functionality. It is dense list-style prose but has no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter, eight-method multiplexed tool with no output schema, the description is thin; most of the actionable detail lives in the method enum descriptions rather than the top-level description. It is adequate because the schema compensates, but the description alone would not tell an agent enough about method-specific behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, including per-method descriptions and per-parameter 'Used by' mappings, so the schema carries parameter semantics. The description adds the dispatch pattern ('Pick with method') but no parameter format or constraint detail beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Read the SCF reference catalog') and enumerates the object types available (controls, single control with objectives/evidence, domains, frameworks, assessment objectives, evidence definitions). The '(no org)' qualifier is a meaningful scope distinction against the org-scoped sibling tools, though no sibling is named explicitly and the agent must infer that scf_control_read / scf_evidence_read are the org-scoped counterparts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' tells the agent how the operation is selected but gives no when-to-use versus when-not guidance, and no explicit routing to the sibling read tools for org-scoped data. The '(no org)' hint implies the alternative exists without stating it, leaving usage selection to inference from the name and the method enum.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_control_readA
Read-only

Read the organization's control scope: list scoped controls with filters, one control in full, scoping stats, framework scope summary, or preview a framework scope change. Pick with method.

NameRequiredDescriptionDefault
sortNoOrder: 'scf_id' (default), or 'weighting' โ€” material controls first, then catalogue weighting highest first, then scf_id. Rows also carry target_maturity, target_source (control | domain), target_maturity_reason, procedure_document_id, procedure_document_status, last_validated_at, last_validated_by and last_validation_note Used by: list.
basisNoFilter by obligation basis: 'mcr', 'dsr', or 'unclassified' (no classified framework and no override). Each row carries obligation_basis, basis_source (override | framework) and basis_override_reason Used by: list.
limitNoPage size (1โ€“200, default 50) Used by: list.
domainNoSCF domain code (e.g., 'GOV', 'AST', 'IAC') Used by: list.
methodYeslist: List controls scoped to the organization with status, basis, target maturity, materiality, procedure and last validation. Filter by scope, domain, framework, team, basis, material. Paginated. get: Get one scoped control: owner, notes, scope/basis/target/material overrides with reason, set_at and set_by, procedure_document_id, last validation. Identify by scf_id, not UUID. stats: Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown. framework_scope: Get framework coverage and selection state (read โ€” viewer): each framework's coverage, basis, obligation_type and obligation_source, and basis_counts (in-scope controls by mcr/dsr/unclassified). preview_framework_change: Preview adding or removing frameworks WITHOUT applying it (read โ€” viewer): controls entering or leaving scope, orphaned evidence, and on remove basis_downgrades (controls whose basis weakens).
offsetNoPagination offset โ€” number of results to skip (default 0) Used by: list.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
scf_idNoSCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') โ€” NOT the UUID Used by: get.
searchNoFree-text filter applied to control ID, name, or description Used by: list.
team_idNoFilter to controls this team is assigned to, accountable or consulted โ€” obtain from scf_list_teams Used by: list.
materialNoFilter by materiality: true for material controls (catalogue weighting 10, or an admin override), false for the rest. Rows carry material, material_source (control | weighting) and material_reason Used by: list.
my_teamsNoFilter to controls assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing โ€” use team_id instead. Used by: list.
frameworkNoFramework slug (e.g., 'nist-800-53') to filter mapped controls Used by: list.
operationNo'add' to preview scoping these frameworks in, 'remove' to preview taking them out Used by: preview_framework_change.
frameworksNoFramework slugs to model โ€” obtain from scf_list_frameworks Used by: preview_framework_change.
function_idNoFilter to controls assigned to any team aligned to this function โ€” obtain from scf_list_functions Used by: list.
csf_functionNoNIST CSF function: 'GOVERN', 'IDENTIFY', 'PROTECT', 'DETECT', 'RESPOND', or 'RECOVER' Used by: list.
scope_statusNoScope filter: 'in_scope' (selected), 'out_of_scope' (deselected), or 'all' (default โ€” everything) Used by: list.
control_weightingNoWeighting threshold on a 0โ€“10 scale Used by: list.
accountable_owner_typeNoFilter by the accountable team's primary owner: 'internal' or 'external_contractor' Used by: list.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and 'Read' is consistent with that. The description flags that preview_framework_change is non-mutating by calling it a preview, but omits the important caveats (permission level for the preview/framework_scope modes, pagination semantics for list) that live only in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the resource first and the modes enumerated in the same order as the method enum, followed by the routing hint. Nothing is redundant or buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 20-parameter, five-mode multiplexed tool with no output schema, the description gives enough to understand the surface and select a mode, and the method enum carries the detailed per-mode behavior. It stops short of describing what list/stats return in any useful shape, but the schema shoulder most of that burden.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema is unusually explicit, including per-parameter 'Used by:' tags, so the baseline would be 3. The description adds a small amount by pairing each mode name with the data it returns, but contributes no syntax or constraints beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource ('Read the organization's control scope') and enumerates all five modes the method parameter selects (list, get, stats, framework_scope, preview). An agent can tell this is the read-side counterpart to scf_control_write, though it never names that sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' is the only routing instruction, and it defers entirely to the method enum's schema text for when to choose each mode. There is no when-not guidance and no mention of alternatives outside the tool; usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_control_writeB
Destructive

Change the organization's control scope (editor+; some methods admin): update or batch-update controls, scope or unscope a framework, set scope, basis, maturity, materiality or procedure overrides.

NameRequiredDescriptionDefault
basisNo'mcr' or 'dsr' to override; null clears the override (and its reason) so the basis is derived from the org's classified frameworks again [set_basis_override] | 'mcr' (mandatory compliance requirement) or 'dsr' (discretionary security requirement); null leaves it unclassified. Reclassifying MCR to DSR changes which exclusions need an approver, hence admin-only [set_framework_basis] Used by: set_basis_override, set_framework_basis.
levelNoTarget CMM level L0โ€“L5 for this control; null clears the override (and its reason) and the control inherits its domain target Used by: set_target_maturity.
ownerNoAccountable owner of the control Used by: update.
actionNo'include' pins the control in scope, 'exclude' pins it out, 'inherit' clears the override AND discards the recorded rationale (it stays in the audit trail) Used by: set_scope_override.
methodYesupdate: Update a scoped control's implementation fields (write โ€” editor+). Identify by scf_id. Only provided fields apply. Material controls: admin for not_applicable. at_risk raises a deficiency. batch_update: Batch-update up to 500 scoped controls in one transaction (write โ€” editor+). Each operation targets an scf_id. Material/MCR controls: no deselect (409); at_risk raises a deficiency. scope_framework: Bulk-scope every control mapped to a framework into the organization (write โ€” editor+ role). Creates a scoped-control entry for each control in the framework. unscope_framework: Unscope every control mapped only to these frameworks (destructive write โ€” editor). Shared controls are kept. An MCR framework, or one taking out a material control, needs an admin and a reason. set_scope_override: Force one control in or out of scope (write โ€” editor+). 'include'/'exclude' pin it; 'inherit' clears it. Excluding an MCR or material control needs an admin key and a reason (editors 403). set_basis_override: Override one control's derived obligation basis (write โ€” ADMIN role): mcr or dsr with a reason, or null to clear and derive it from its frameworks again. 404 if the control has no scope record. set_framework_basis: Record why a scoped framework is in scope (write โ€” ADMIN role): basis mcr|dsr, obligation_type and obligation_source. Replaces all three; null clears. Only an active (scoped) framework, else 404. set_target_maturity: Override one control's target maturity (write โ€” ADMIN role): a level L0โ€“L5 with a reason, or null to inherit its domain's target again (domain targets: scf_update_org_settings). set_materiality: Set whether one control is material (write โ€” ADMIN's own key; a platform key gets 403): true/false with a reason, or null for the catalogue default (material at weighting 10). set_procedure: Link one control to its signed-off procedure document, or null to unlink (write โ€” editor+). The document must be this org's procedure, approved or published when linked (400 otherwise).
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
reasonNoWhy this control is being overridden โ€” recorded in the audit trail (max 2000 characters). Required for 'exclude'. The admin making an MCR or material exclusion is recorded as its approver; there is no approver parameter [set_scope_override] | Why the derived basis is wrong for this control (max 2000 characters) โ€” required when basis is set [set_basis_override] | Why this control departs from its domain target (max 2000 characters) โ€” required when level is set [set_target_maturity] | Why (max 2000 characters). Required when material is true or false, and when a null clear makes a control weighted below 10 not material (400 otherwise) [set_materiality] Used by: set_scope_override, set_basis_override, set_target_maturity, set_materiality.
scf_idNoSCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') โ€” NOT the UUID [update] | SCF control identifier in DOMAIN-NN format โ€” obtain from scf_list_scoped_controls [set_scope_override, set_basis_override, set_target_maturity, set_materiality, set_procedure] Used by: update, set_scope_override, set_basis_override, set_target_maturity, set_materiality, set_procedure.
materialNotrue or false overrides the catalogue default; null clears the override. The admin is recorded as the approver: deciding a control is not material lets it be excluded or marked not_applicable without one Used by: set_materiality.
priorityNoImplementation priority: 'high', 'medium', or 'low' Used by: update.
frameworksNoFramework slugs to remove, e.g. ['iso_27017_2015'] โ€” obtain from scf_list_frameworks Used by: unscope_framework.
operationsNoUpdate operations to apply (1โ€“500 per call) Used by: batch_update.
assigned_toNoAssignee responsible for implementation Used by: update.
document_idNoProcedure document UUID โ€” obtain from scf_list_documents; null unlinks. A later edit sends the document back to review; the link stays and scf_list_scoped_controls shows procedure_document_status Used by: set_procedure.
target_dateNoTarget completion date in ISO-8601 (YYYY-MM-DD) Used by: update.
framework_idNoFramework slug to scope (e.g., 'nist-800-53-r5') โ€” obtain from scf_list_frameworks [scope_framework] | Framework slug of a framework the org has scoped โ€” obtain from scf_get_framework_scope_summary [set_framework_basis] Used by: scope_framework, set_framework_basis.
maturity_levelNoMaturity level with L prefix: L0 Not Performed, L1 Performed, L2 Planned, L3 Well Defined, L4 Quantitatively Controlled, L5 Continuously Improving Used by: update.
removal_reasonNoWhy these controls leave scope โ€” recorded in the audit trail. Required (400 without it), with an admin key (403 otherwise), when a framework carries an MCR obligation or its removal would take a material control out of scope Used by: unscope_framework.
completion_dateNoActual completion date in ISO-8601 (YYYY-MM-DD) Used by: update.
obligation_typeNoWhere the obligation comes from: statutory, regulatory, contractual or discretionary; omitted or null clears it Used by: set_framework_basis.
selection_reasonNoJustification for scoping decision โ€” required for not_applicable or deferred Used by: update.
obligation_sourceNoThe law, regulation or contract behind it (max 2000 characters); omitted, null or blank clears it Used by: set_framework_basis.
implementation_notesNoFree-text implementation notes and context Used by: update.
implementation_statusNoNew implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred. Moving to at_risk raises a deficiency (see scf_list_deficiencies). A material control (catalogue weighting 10, or set material by an admin) can only leave scope through scf_set_scope_override by an admin (other paths 409), and only an admin may mark it not_applicable (403 otherwise). Used by: update.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, so the write/destructive profile is covered. The description adds the authorization dimension (editor+ baseline, admin for some methods) which annotations do not carry. It does not itself disclose irreversibility, the audit-trail recording, or the 403/404/409 failure semantics โ€” those live only in the schema text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the resource and permission level up front and the operation list after. It is dense but every clause maps to real capability; the only weakness is that the long comma-run of overrides is slightly harder to scan than a short bulleted mapping would be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a ten-method polymorphic mutation tool, the description covers purpose and role requirements but omits the single most important structural fact โ€” that the tool is dispatched by a required `method` parameter. Given the very rich schema and the destructive annotation, the remaining gaps are tolerable, but an agent must open the schema to call it at all.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across 24 parameters, with per-parameter "Used by: <method>" tags that fully document the polymorphism, so the baseline of 3 applies. The description only restates the operation families and the role floor; it adds no meaning beyond the schema's own method/parameter mapping.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Change the organization's control scope") and then enumerates the concrete operations: update/batch-update controls, scope/unscope a framework, and the scope, basis, maturity, materiality and procedure overrides. An agent can map the ten schema methods onto these phrases. It stops short of naming when this is preferred over the sibling read tools, but the write/read naming pair makes that largely self-evident.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Adds permission gating ("editor+; some methods admin"), which is real usage context, but gives no criterion for choosing among the ten methods or for preferring this over scf_update_org_settings / scf_list_scoped_controls. The description never mentions the required `method` discriminator, so an agent reading only prose would not know operations are selected by a parameter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_custom_risk_readA
Read-only

Read organization-defined custom risks: list them, or list the controls linked to one. Pick with method.

NameRequiredDescriptionDefault
methodYeslist: List the organization's custom risk definitions โ€” org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes. controls: List controls linked to a custom risk: catalog_control_ids, links (scf_id + document_id of the standard it is an exception against) and scoped_controls with implementation status.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
risk_codeNoCustom risk code in R-ORG-N format (e.g., 'R-ORG-1') โ€” obtain from scf_list_custom_risks Used by: controls.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already establishes the safety profile, so the description only needs to add scoping context. It confirms this read covers org-defined risks and their linked controls, but adds nothing about permissions, whether custom risks are mutable through this path, or output shape beyond what the schema's enum text already supplies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, with the resource and both modes front-loaded before the method hint. Nothing is repeated or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity read tool with a fully documented three-parameter schema and no output schema, the definition covers what is needed to call it. The one soft spot is that the conditional dependency of risk_code on the controls method is only implied by 'linked to one' and carried by the schema, not stated in the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the method enum text is unusually rich (R-ORG-N codes, catalog_control_ids, links, scoped_controls with implementation status), so the baseline is 3. The description contributes 'list them, or list the controls linked to one', which paraphrases the enum semantics in task-oriented language and slightly clarifies intent beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read) and resource (organization-defined custom risks) and enumerates both modes: listing risks or listing controls linked to one. It does not differentiate itself from scf_risk_read (static catalog risks) or scf_custom_risk_write, so an agent must infer that boundary from the name prefix alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' tells the agent that the method parameter selects the operation, and the two modes are named. However, there is no explicit when-to-use guidance against alternatives such as scf_risk_read or scf_custom_risk_write, nor a statement that the controls mode requires an existing risk_code.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_custom_risk_writeA
Destructive

Manage custom risks (editor+): create, update or delete a risk (destructive); add, update or remove a linked control. Pick with method.

NameRequiredDescriptionDefault
titleNoRisk title (required, max 100 chars) [create] | New risk title (max 100 chars) [update] Used by: create, update.
methodYescreate: Create a custom org-defined risk (write โ€” editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record. update: Update a custom risk definition's metadata โ€” title, description, category (write โ€” editor+ role). Only provided fields are applied. delete: Delete a custom risk definition, its assessment record, and every control mapping (destructive write โ€” editor+ role). Irreversible. add_control: Link a control to a custom risk (write โ€” editor+), optionally with the document whose standard it is an exception against. Changing an accepted exception's links clears its approval. update_control: Set or clear the standard's document on a custom risk's control link (write โ€” editor). A changed document clears an accepted exception's approval. remove_control: Unlink a control from a custom risk (write โ€” editor+ role). The control and risk both remain; only the mapping is removed. Unlinking clears an accepted exception's approval.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
scf_idNoSCF control ID to link (e.g., 'AST-01') โ€” obtain from scf_list_scoped_controls [add_control] | SCF control ID of an existing link โ€” obtain from scf_list_custom_risk_controls [update_control] | SCF control ID to unlink (e.g., 'AST-01') โ€” obtain from scf_list_custom_risk_controls [remove_control] Used by: add_control, update_control, remove_control.
risk_codeNoCustom risk code in R-ORG-N format (e.g., 'R-ORG-1') โ€” obtain from scf_list_custom_risks [update, delete, add_control, remove_control] | Custom risk code in R-ORG-N format โ€” obtain from scf_list_custom_risks [update_control] Used by: update, delete, add_control, update_control, remove_control.
descriptionNoRisk description (required) [create] | New risk description [update] Used by: create, update.
document_idNoOrganisation document that sets the standard this risk is an exception against โ€” obtain from scf_list_documents (404 if not this org's). A link with a document makes the custom risk a standards exception [add_control] | Organisation document whose standard this risk is an exception against (404 if not this org's), or null to clear. Required: the platform refuses a call without it (422) [update_control] Used by: add_control, update_control.
category_nameNoCategory label shown in UI (default 'Custom') [create] | New category label [update] Used by: create, update.
category_colorNoHex color for the category badge, e.g., '#6b7280' (default '#6b7280') [create] | New hex color for the category badge [update] Used by: create, update.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, so the description's "destructive" adds little; the real added value is the editor+ role gate. The deeper consequences (delete removes the assessment record and all control mappings; link changes clear an accepted exception's approval) live only in the method's schema entry, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence that front-loads the resource, the role requirement, and the operation groupings before the routing hint. Minor density cost from the parenthetical "(destructive)" sitting mid-clause, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, six-method polymorphic write tool it correctly signals the method-dispatch pattern and the role gate, and the per-method parameter mapping is fully covered by the schema, so no output schema is needed. The only shortfall is the absence of any guidance on precedence between scf_custom_risk_write and scf_custom_risk_read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter is documented per-method with format hints and provenance (e.g., obtain from scf_list_custom_risks), so the schema does the heavy lifting. The description only says to choose via method and contributes no additional field semantics, which is the baseline 3 case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (custom risks) and enumerates the six concrete operations grouped into risk-level (create/update/delete) and control-link-level (add/update/remove) actions, which is well beyond restating the name. It stops short of naming the sibling read tool (scf_custom_risk_read) as the non-destructive alternative, so the write/read split is only inferable from the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Pick with method" gives a minimal dispatch cue and the "(editor+)" tag flags a permission prerequisite, but there is no explicit when-to-use vs. when-not guidance and no pointer to the read counterpart for fetching risks. An agent must open the schema to learn which method suits its intent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_evidence_file_readA
Read-only

Read an evidence item's files: list them, one file with its download URL, one file's validation result, or the organization's validation summary. Pick with method.

NameRequiredDescriptionDefault
methodYeslist: List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry). get: Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact. validation: Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp. validation_summary: Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
file_idNoEvidence file UUID โ€” obtain from scf_list_evidence_files Used by: get, validation.
evidence_idNoEvidence ID (e.g., 'ERL-IAM-001') โ€” obtain from scf_list_evidence Used by: list, get, validation.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already establishes the safe-read profile, and the description is consistent with it, adding that results include download URLs and validation outcomes. It does not mention the 15-minute URL expiry, scope breadth, or any rate/consumption caveats, all of which sit only in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that enumerates the four modes and closes with the selection instruction โ€” no filler and nothing buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only dispatcher with a fully documented schema and no output schema, the description is nearly complete for selection purposes. The only gap is that the mapping between modes and the optional file_id/evidence_id arguments is left entirely to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline of 3 applies. The description names the method as the discriminator but adds no format, dependency, or required-parameter-pairing detail beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (read) and resource (an evidence item's files) and enumerates the four concrete result shapes the caller can obtain. It is clearly distinguishable from scf_evidence_file_write by naming the read modes, though it does not explicitly contrast itself with scf_evidence_read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Pick with method" signals that the enum is the selector, but the description itself gives no when-to-use criteria across the four modes or against the sibling evidence tools. The real guidance lives in the method enum's schema descriptions rather than in the description text.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_evidence_file_writeA
Destructive

Act on an uploaded evidence file (editor+): approve, reject or request revision; re-run validation; or soft-delete it (destructive). Pick with method.

NameRequiredDescriptionDefault
methodYesreview: Approve, reject or request revision on one uploaded file (write โ€” editor). Rejecting raises a deficiency on each in-scope control it supports. 410 where per-window review is on. revalidate: Re-run the validation engine against an evidence file (write โ€” editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result. delete: Soft-delete an evidence file (destructive write โ€” editor role). The record is marked deleted and drops out of listings; the stored object is retained for audit and retention.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
file_idYesEvidence file UUID โ€” obtain from scf_list_evidence_files
evidence_idYesCatalog evidence ID the file belongs to, e.g. E-IAM-01 [review, delete] | Evidence ID (e.g., 'ERL-IAM-001') โ€” obtain from scf_list_evidence [revalidate]
review_notesNoReviewer notes Used by: review.
review_statusNoReview decision Used by: review.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, so the description's '(destructive)' label mostly restates structured data. It does add the editor+ authorization requirement, which is genuine added context, but it says nothing about what review/revalidate return or about side effects like deficiencies being raised (that detail lives only in the schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that lists the operations and ends with the dispatch instruction. No filler, no restatement of the title, and the destructive element is called out inline.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, 3-mode write tool with no output schema, the description covers all modes and the required role. It does not explain return values or the mode-specific edge cases (e.g. the 410 per-window review case), but those are documented in the schema, so nothing critical is missing at the description layer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter including the method enum is already fully documented in structured data. The description's only contribution is signaling that 'method' is the discriminator, which is minimal added meaning over the enum descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete verb and resource ('Act on an uploaded evidence file') and enumerates the three actions it covers: approve/reject/request revision, re-run validation, and soft-delete. That is enough to separate it from the read sibling scf_evidence_file_read, though it never names that sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the agent is told to 'Pick with method' and given the list of operations, but there is no explicit when-to-use/when-not guidance or any routing statement versus scf_evidence_task_write or scf_evidence_write. The role hint '(editor+)' gives a precondition but not a selection rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_evidence_readB
Read-only

Read evidence tracking: list records, one record with its in-scope requiring controls, requiring controls alone, gaps, health, upcoming, frequency health, maturity and upgrade guidance, suggestions.

NameRequiredDescriptionDefault
daysNoLook-ahead window in days (1โ€“90, default 14) Used by: upcoming.
methodYeslist: List the organization's evidence tracking records: tracking status, maturity, owner, system, file count, required_by_scope. Names no controls โ€” use scf_get_evidence_requiring_controls for those. get: Get one evidence tracking record (read) plus required_by_in_scope_controls (the org's in-scope controls that require it) and, as labelled context, catalog_control_mappings. 404 if untracked. requiring_controls: Which in-scope controls require one evidence item (read; works untracked). Primary: required_by_in_scope_controls with status and maturity. Context: catalog_control_mappings and what is not in scope. gaps: List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage. health: Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary. upcoming: List evidence whose next collection falls due within N days (read โ€” viewer role), computed from each item's frequency and last upload. The daily 'what is due' view. frequency_health: Report evidence whose declared frequency disagrees with the observed upload cadence over the last 90 days (read โ€” viewer role). Only misaligned items are returned. maturity_summary: Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities. item_maturity: Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state. upgrade_recommendations: Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions โ€” the same guidance shown in the platform UI. suggestions: Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
team_idNoFilter to evidence this team is assigned to, accountable or consulted โ€” obtain from scf_list_teams Used by: list.
my_teamsNoFilter to evidence assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing โ€” use team_id instead. Used by: list.
system_idNoSystem UUID to filter by โ€” obtain from scf_list_systems Used by: list.
evidence_idNoCatalog evidence ID, e.g. E-IAM-01 โ€” obtain from scf_list_evidence_catalog [get] | Catalog evidence ID, e.g. E-AST-09 โ€” obtain from scf_list_evidence or scf_list_evidence_catalog [requiring_controls] | Evidence ID (e.g., 'E-RSK-02') โ€” obtain from scf_list_evidence [item_maturity, upgrade_recommendations, suggestions] Used by: get, requiring_controls, item_maturity, upgrade_recommendations, suggestions.
function_idNoFilter to evidence assigned to any team aligned to this function โ€” obtain from scf_list_functions Used by: list.
accountable_owner_typeNoFilter by the accountable team's primary owner: 'internal' or 'external_contractor' Used by: list.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered and the description's 'Read' prefix is consistent with it. But beyond that the description adds no behavioral context of its own: no mention of the viewer-role requirement on `upcoming`/`frequency_health`, the 90-day observation window, the 404 for untracked evidence, or the 90-day cap on `days` โ€” all of which live only in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single front-loaded sentence with no filler, which is structurally sound. However, most of its content is a compressed restatement of the method enum names already fully documented in the schema, and the telegraphic list style ('gaps, health, upcoming, frequency health, maturity and upgrade guidance, suggestions') sacrifices parseability without adding new information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nine-parameter, eleven-mode endpoint with no output schema, the description gives only mode labels and never characterizes what any mode returns (record fields, coverage percentage, green/amber/red statuses, maturity levels). The rich schema compensates for parameter completeness, but the absence of return-shape signal leaves a real gap for a multi-mode read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters, including per-method applicability ('Used by: list'), enum meanings, and where to obtain IDs. The description adds no parameter meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Read evidence tracking') and enumerates the operation families the single multiplexed endpoint covers (list, get, requiring controls, gaps, health, upcoming, frequency health, maturity, upgrade guidance, suggestions). It is distinguishable from the write sibling and from scf_evidence_file_read by naming the tracking records themselves, though the compressed phrasing ('one record with its in-scope requiring controls, requiring controls alone') makes several modes hard to separate at a glance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Listing the modes implies which value to pass to `method`, but the description never says when to prefer one mode over another, nor when to use a sibling such as scf_get_evidence_requiring_controls instead of the `requiring_controls` method. That routing guidance exists only in the schema's method descriptions, so usage selection is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_evidence_task_writeA

Manage evidence collection tasks (editor+): create one against a tracking record, update its fields, or mark it completed with notes. Pick with method.

NameRequiredDescriptionDefault
titleNoTask title Used by: create, update.
methodYescreate: Create a manual evidence collection task against a tracking record (write โ€” editor role). Due date and evidence_tracking_id are required; status defaults to not_started, priority to medium. update: Update an evidence collection task (write โ€” editor role). Only passed fields change: due date, status, type, priority, title, description, notes, assignee, owning team. complete: Mark an evidence collection task completed (write โ€” editor role). Sets status to completed and stamps the completion date; optional completion notes are stored with it.
statusNoInitial status (default not_started) [create] | Status [update] Used by: create, update.
task_idNoEvidence task UUID โ€” obtain from scf_list_evidence_tasks Used by: update, complete.
due_dateNoDue date, YYYY-MM-DD Used by: create, update.
priorityNoPriority (default medium) [create] | Priority [update] Used by: create, update.
task_typeNoTask type (default collection) [create] | Task type [update] Used by: create, update.
descriptionNoWhat has to be collected and how Used by: create, update.
owning_team_idNoTeam that owns the task โ€” obtain from scf_list_teams Used by: create, update.
assigned_user_idNoAssignee user UUID โ€” obtain from scf_list_members Used by: create, update.
completion_notesNoNotes recorded on completion Used by: update, complete.
evidence_tracking_idNoEvidence tracking record UUID (the id field from scf_list_evidence, not the E-xxx catalog id) Used by: create.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this is a non-read-only, non-destructive write tool, and the description corroborates that with the editor+ requirement. Beyond that it adds little: it doesn't say whether updates are partial, whether completion is reversible, or what happens on invalid state transitions โ€“ most of that lives only in the method enum's schema text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the resource and the three operations front-loaded, followed by the dispatch instruction. No filler, though it is arguably too terse given 12 parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a polymorphic 12-parameter write tool, the schema carries the heavy lifting: per-method required fields, defaults, and UUID sourcing hints are all documented, and there is no output schema to explain. The description covers the operation set and the role gate adequately, leaving only cross-tool routing implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the method enum text already spells out per-method requirements, defaults, and field applicability. The description's only added signal is that create targets a tracking record and complete accepts notes, which is redundant with the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ("Manage evidence collection tasks") and enumerates the three concrete operations: create against a tracking record, update fields, and mark completed with notes. It distinguishes itself from evidence-record siblings (scf_evidence_write, scf_evidence_file_write) by naming tasks explicitly, though it never names those siblings directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It tells the agent to select an operation via the method parameter, which is genuine dispatch guidance, and notes the editor+ role prerequisite. However, it gives no when-not guidance and no routing to related tools such as scf_list_evidence_tasks for obtaining IDs or scf_evidence_write for the underlying tracking records.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_evidence_writeA

Create or update evidence tracking records (editor+): create one from a catalog id, upsert one record's tracking fields, or batch-upsert up to 500 in one transaction. Pick with method.

NameRequiredDescriptionDefault
ownerNoPerson accountable for this evidence item Used by: create, update.
methodYescreate: Create an evidence tracking record from a catalog evidence ID (write โ€” editor+ role). Starts tracking an evidence item for the organization. update: Upsert an evidence item's tracking fields (write โ€” editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied. batch_update: Create or update up to 500 evidence tracking records in one transaction (write โ€” editor role). Each upserts by evidence_id; only fields given change. Use instead of 500 scf_update_evidence calls.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
commentsNoFree-text notes or context Used by: create, update.
frequencyNoCollection cadence: 'daily', 'weekly', 'monthly', 'quarterly', or 'annually' Used by: create, update.
system_idNoSystem UUID to link this evidence to โ€” obtain from scf_list_systems Used by: create, update.
is_trackedNoStart actively tracking this item (default false) [create] | Toggle active tracking for this item [update] Used by: create, update.
operationsNoUpsert operations, max 500 โ€” each keyed by evidence_id Used by: batch_update.
evidence_idNoCatalog evidence ID (e.g., 'E-IAM-01') โ€” obtain from scf_list_evidence_catalog [create] | Catalog evidence ID (e.g., 'E-IAM-01') โ€” obtain from scf_list_evidence or scf_list_evidence_catalog [update] Used by: create, update.
maturity_levelNoEvidence maturity level L0โ€“L5 (e.g., 'L3'); omit to leave unset [create] | Evidence maturity level L0โ€“L5 (e.g., 'L3'); omitting never clears the stored value [update] Used by: create, update.
collecting_systemNoName of the tool or system that collects the evidence Used by: create, update.
method_of_collectionNoCollection approach: 'automated', 'manual', or 'hybrid' Used by: create, update.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover readOnlyHint=false and destructiveHint=false; the description adds real context beyond them โ€” the editor+ permission floor, the 500-record batch ceiling, the transactional nature of batch_update, and the fact that update upserts a row if missing. It omits what a failed batch does (partial vs full rollback) and what the response contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that leads with the verb and resource, then enumerates the modes in the order an agent needs them, ending with the discriminator. No filler or redundant restatement of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter mutation tool whose schema is fully documented and whose annotations declare the safety profile, the description supplies the essential framing: role gate, batch limit, and mode selection. The only gap is response behavior, which matters somewhat given no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so per-parameter meaning (including the detailed method enum semantics and the 'Use instead of 500 scf_update_evidence calls' note) is already documented in structured data. The description only restates the method names and the catalog-id concept, adding no syntax or edge-case detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create or update evidence tracking records') and enumerates the three modes it supports: single create from a catalog id, single-record upsert, and batch upsert of up to 500. It is clearly a write counterpart to scf_evidence_read, though it never names that sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear selection rule โ€” 'Pick with method' โ€” plus an upfront role requirement ('editor+') that gates who may call it. It does not state when to prefer this over scf_evidence_task_write or other write siblings, leaving that routing to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_list_evidence_tasksA
Read-only

List evidence collection tasks โ€” the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

NameRequiredDescriptionDefault
org_idNoOrganization UUID โ€” obtain from scf_list_organizations
statusNoFilter by task status: not_started, in_progress or completed
assigneeNoFilter by assigned user UUID
overdue_onlyNoOnly tasks past their due date
assigned_to_meNoOnly tasks assigned to the caller
evidence_tracking_idNoOnly tasks for one evidence tracking record

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations declare readOnlyHint=true, so safety is already covered. The description adds useful behavioral context by framing the result as a work queue and mentioning optional filters, but it does not disclose pagination, ordering, or whether some parameters are mutually exclusive. This is acceptable for a read-only list tool but does not go beyond the baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the verb and resource, and contains no filler or redundant restatement of the tool name. The second sentence efficiently summarizes the optional filtering capability. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with a fully documented schema and readOnlyHint annotation, the description provides sufficient conceptual framing: it identifies the resource, the queue semantics, and the key filters. It does not describe the exact return fields or pagination, but the description's 'what needs to be collected, by whom, and by when' partially conveys return content, and no output schema was provided. The missing pieces are relatively minor for this tool type.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters clearly, including enums and filter semantics. The description re-states only 'filter by assignee or status' and does not add meaning beyond the schema. The baseline of 3 is appropriate because the schema carries the parameter-documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List evidence collection tasks. It further clarifies what this means by describing the tool as 'the work queue showing what needs to be collected, by whom, and by when', which distinguishes it from other list tools like scf_list_assignments or scf_get_work_queue. The verb-resource pair directly matches the tool name and clearly signals a read-only listing operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does and that filtering is optional, but it gives no guidance on when to choose this tool over closely related siblings such as scf_get_org_work_queue, scf_get_work_queue, or scf_list_assignments. There are no explicit exclusions, preconditions, or alternative-routing clues, so an agent must infer usage from the resource name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_load_toolsA
Read-only

Load more SCF tool groups into this session (teams, collaboration, documents, engagements, assurance, catalog-reconciliation, webhooks, journey, or all). Returns the tools now available.

NameRequiredDescriptionDefault
groupsYesteams โ€” Business functions, teams, rosters and team accountability for controls and evidence (scf_team_read, scf_team_write) collaboration โ€” User assignments and comment threads on controls, evidence and tasks (scf_collaboration_read, scf_collaboration_write) documents โ€” ISMS document generation, sections, lifecycle transitions and export (scf_document_read, scf_document_write) engagements โ€” Audit engagements: scope, auditors, queries and responses (scf_engagement_read, scf_engagement_write) assurance โ€” Deficiencies, organization compensating controls, control validations, posture snapshots, capability tests (scf_assurance_read, scf_assurance_write) catalog-reconciliation โ€” Per-organization SCF catalog upgrade reconciliation runs (scf_catalog_reconciliation_read, scf_catalog_reconciliation_write) webhooks โ€” Webhook endpoints, secrets and delivery logs (scf_webhook_read, scf_webhook_write) journey โ€” The guided implementation journey: stages, templates, attestation (scf_journey_read, scf_journey_write) all โ€” every group above Already loaded at startup: catalog, controls, evidence, assessments, risk, vendors, systems, organization.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true is consistent with this being a session-capability operation rather than a data mutation, so there is no contradiction; the description usefully adds that the response surfaces the newly available tools and that loading is incremental. It does not disclose whether repeated loads are idempotent, whether previously loaded groups persist, or any cost/limit on session size โ€” context an agent would want before calling with "all".

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and scope, with the return behavior appended last. Nothing is redundant and no sentence could be dropped without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with full schema documentation and no output schema, the description covers what it does and what it yields. The only gap is the absence of an explicit precondition statement telling the agent when a group must be loaded before its tools can be invoked.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the enum description already spells out each group and the sibling read/write tools it unlocks, so the schema does the heavy lifting. The description's parenthetical list of group names only echoes the enum values and adds no new semantics (e.g. no note on ordering, minItems handling, or "all" equivalence).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Load") and resource ("SCF tool groups") plus an explicit enumeration of the loadable groups, and the closing sentence clarifies the effect ("Returns the tools now available"). This is clearly distinguishable from every sibling, all of which are per-resource read/write tools rather than a capability loader.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "Load more ... into this session" implies the trigger is needing a group that isn't yet available, and the description hints that new tools appear afterward. However, it never states the condition explicitly (e.g. "call this when a required scf_*_read/write tool is missing") and gives no guidance on batching groups versus calling "all".

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_mark_notifications_readA

Mark notifications read for the current user (write โ€” self only): one by notification_id, or every notification when all=true. Acknowledge after processing scf_get_notifications.

NameRequiredDescriptionDefault
allNoMark every notification read โ€” explicit opt-in, ignored when notification_id is given
notification_idNoNotification UUID to mark read

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=false and destructiveHint=false. The description adds useful context beyond annotations: the operation is self-only, supports bulk marking, and is meant as an acknowledgment step. It does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence that front-loads the action and scope, then efficiently covers both parameter modes and the intended workflow. There is no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple self-scoped write operation with two optional parameters and no output schema, the description is complete enough: it names the parameters' roles and the correct sequencing relative to scf_get_notifications. It does not describe return values or error behavior, but these are low-risk omissions for an acknowledgment operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains both parameters, including the precedence rule ('ignored when notification_id is given'). The description restates this behavior but adds no new semantic detail beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Mark notifications read'), the scope ('for the current user (write โ€” self only)'), and the two invocation modes (by notification_id or all=true). It also distinguishes itself from the sibling scf_get_notifications by framing this as the write/acknowledgment counterpart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to use the tool: 'Acknowledge after processing scf_get_notifications.' This gives the agent a clear workflow context. It does not list exclusions, but there is no competing sibling for marking notifications read, so the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_org_readC
Read-only

Read organization data: list organizations, one organization, its settings, members, audit log, change cursor, or the organization work queue. Pick with method.

NameRequiredDescriptionDefault
limitNoPage size (1โ€“200, default 50) Used by: audit_log.
actionNoFilter by action: create, update or delete Used by: audit_log.
methodYeslist: List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need. get: Get one organization's detail: subscription tier, member count, usage limits, and settings. settings: Get an organization's settings (read โ€” viewer): profile (business_size, mission_statement), per-domain maturity_targets, name, industry, owner teams and feature switches. members: List members of one organization with their role (admin, editor, or viewer). audit_log: Query one organization's append-only audit trail (read โ€” viewer role): field-level changes with actor, source and before/after values. Filter by entity, control, action, actor, source, date or text. change_cursor: Cheap has-anything-changed probe (read โ€” viewer role): newest audit timestamp and row count for one organization. Compare with the pair you last saw; poll this before re-pulling the audit log. work_queue: Get one org's GRC work queue (read โ€” viewer): overdue evidence tasks, blocking controls (material first, then catalogue weighting), stale schedules. assigned_to_me narrows to the caller.
offsetNoPagination offset โ€” number of results to skip (default 0) Used by: audit_log.
org_idNoOrganization UUID โ€” obtain from scf_list_organizations Used by: get, settings, members, audit_log, change_cursor, work_queue.
scf_idNoFilter by SCF control ID in DOMAIN-NN format Used by: audit_log.
date_toNoInclude changes at or before this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log.
actor_idNoFilter by actor user UUID โ€” platform alias of changed_by_user_id Used by: audit_log.
date_fromNoInclude changes at or after this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log.
entity_idNoFilter by the changed entity's UUID Used by: audit_log.
request_idNoFilter by request correlation ID โ€” groups every change one API call made Used by: audit_log.
entity_typeNoFilter by exact entity type as written in the log, e.g. scoped_control, evidence_file, audit_engagement, vendor โ€” unsure of the spelling? use search_text Used by: audit_log.
search_textNoCase-insensitive search across entity_type, field_name, old_value and new_value Used by: audit_log.
action_sourceNoFilter by origin of the change: ui, api_key, mcp or system Used by: audit_log.
assigned_to_meNoOnly items owned by or assigned to the caller (default false) Used by: work_queue.
changed_by_user_idNoFilter by the user who made the change โ€” obtain from scf_list_members Used by: audit_log.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered and the description carries a lower burden. What remains undisclosed is genuinely useful context the description could have supplied: that most methods require an org_id obtained elsewhere, that audit_log is append-only and filter-heavy, that change_cursor is a cheap polling probe to run before re-pulling the log, and the viewer-role requirements โ€” all of which appear only in the schema's method enum, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the verb and resource, and the enumeration of methods is the right way to signal scope in minimal space. It is not padded, though 'Pick with method' is filler that could have been spent on real selection guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter, seven-method multiplexer with no output schema, the definition is only adequate: the schema does the heavy lifting on parameter applicability and per-method return content, and readOnlyHint covers safety. An agent can invoke it correctly, but the description itself gives no picture of what to expect back from each method or how to sequence calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter is annotated with its purpose and which method consumes it ('Used by: audit_log', etc.), so the baseline of 3 applies. The description contributes essentially nothing beyond naming 'method' as the selector, adding no format, default, or interaction detail over what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Read organization data') and then enumerates the seven resource views covered (list, one org, settings, members, audit log, change cursor, work queue), which lets an agent tell this apart from read siblings like scf_user_read or scf_evidence_read. It stops short of naming any sibling or stating the boundary against scf_update_org_settings, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' only tells the agent that the method enum is the selector; it gives no guidance on which method to choose for a given intent, no ordering advice (the 'list first to get org_id' pattern lives only in the schema), and no when-not or alternative-sibling routing. The agent must open the schema to learn anything actionable about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_risk_readA
Read-only

Read the risk register: list risks, one risk, the 5x5 matrix, summary, profile, risks for a control, or controls for a risk. Pick with method.

NameRequiredDescriptionDefault
methodYeslist: List the whole risk register (ordered by risk code): scores, treatment status and any acceptance (accepted_by, accepted_at, rationale, expiry, acceptance_state). Filter by status, level, category. get: Get one risk assessment: inherent and residual scores, treatment plan, owner, review date, and any acceptance (accepted_by, accepted_at, rationale, expires_on, acceptance_state). matrix: Get the 5ร—5 risk matrix data for the organization โ€” risk distribution across likelihood ร— impact, ready for visualization. summary: Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data. profile: Get the organization's risk profile (read โ€” viewer role): the severity thresholds that band the 5ร—5 matrix into low, medium, high and critical. Auto-created with defaults if unset. for_control: List the risk codes a control addresses and this organization's assessments of them (read โ€” viewer role). Control-to-risk traceability from the SCF catalog mapping. controls_for_risk: List the controls that address a risk code (read โ€” viewer role). Works for catalog risks (R-XX-N via the SCF mapping) and custom risks (R-ORG-N via the org's control mappings).
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
scf_idNoSCF control ID in DOMAIN-NN format, e.g. IAC-01 Used by: for_control.
statusNoFilter by treatment status: identified, analysed, treating, treated, accepted or monitoring (sent as the platform's treatment_status) Used by: list.
risk_idNoRisk assessment ID โ€” obtain from scf_list_risks Used by: get.
categoryNoFilter by catalog risk category code, e.g. 'AC' matches R-AC-N Used by: list.
risk_codeNoRisk code โ€” catalog R-XX-N or custom R-ORG-N Used by: controls_for_risk.
risk_levelNoFilter by inherent risk level, banded by the org's risk profile Used by: list.
acceptance_stateNoAccepted risks only, by their approval: 'approved' (in force), 'expired' (past acceptance_expires_on) or 'unapproved' (accepted with no approval recorded) Used by: list.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation establishes non-mutating behavior, and the description consistently presents read operations without contradicting it. Beyond listing the available views, it adds little operational context; authorization requirements and the schema's caveat that an unset profile is auto-created with defaults are not surfaced in the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences front-load the purpose and then provide the dispatch instruction. The operation list is dense but efficient, with each item identifying a distinct capability and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a seven-method, nine-parameter read dispatcher, the description supplies an adequate top-level map while the rich schema covers per-method results, identifiers, and filters. Explicit sibling routing and important read-side caveats would improve it, but the supplied definition generally enables correct selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already documents the method values, method-specific parameters, filters, formats, and sources for identifiers. "Pick with method" and the plain-English operation list provide a useful overview but little parameter meaning beyond the schema, so the baseline score applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb "Read" and resource "risk register" are explicit, and the enumerated views clarify the tool's scope. It does not explicitly distinguish itself from siblings such as scf_custom_risk_read or scf_risk_write, leaving that differentiation to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Read the risk register" establishes the usage context, while "Pick with method" explains how to select an operation. There are no when-not conditions or named alternatives for writes, custom-risk reads, or other related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_risk_writeA
Destructive

Change the risk register (editor+; accept is admin): create a risk assessment, update one, delete one (destructive), or record or renew a risk acceptance. Pick with method.

NameRequiredDescriptionDefault
notesNoFree-text notes on this risk assessment Used by: update.
ownerNoName or identifier of the risk owner Used by: create.
titleNoRisk title (required, max ~100 chars) Used by: create.
impactNoInherent impact on a 1โ€“5 scale Used by: create, update.
methodYescreate: Create a new risk assessment in the risk register (write โ€” editor+ role). Likelihood and impact scores populate the 5ร—5 risk matrix. update: Update a scored risk by code (write โ€” editor). Only passed fields change. Setting accepted records no approval (use scf_accept_risk); re-scoring an accepted risk clears its approval. delete: Delete an organization's scoring of a risk code (destructive write โ€” editor role). The catalog or custom risk definition itself remains; only this org's assessment row is removed. accept: Accept a risk (write โ€” admin): records you as approver, now, the rationale and expiry. Renews an accepted risk. Also accepts a standards exception. A platform key without a user gets 403.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
rationaleNoWhy the risk is accepted (required, non-blank; stored trimmed). Blank is refused Used by: accept.
risk_codeNoRisk code โ€” catalog R-XX-N or custom R-ORG-N [update, delete] | Risk code โ€” catalog R-XX-N or custom R-ORG-N โ€” obtain from scf_list_risks or scf_list_custom_risks [accept] Used by: update, delete, accept.
control_idNoSCF control ID to link (e.g., 'AST-01') โ€” obtain from scf_list_controls Used by: create.
expires_onNoDate the acceptance lapses (YYYY-MM-DD); must be after today (400 otherwise) Used by: accept.
likelihoodNoInherent likelihood on a 1โ€“5 scale Used by: create, update.
descriptionNoRisk description (required) Used by: create.
owner_user_idNoRisk owner โ€” obtain from scf_list_members Used by: update.
treatment_planNoHow the risk is being treated Used by: update.
residual_impactNoResidual impact after treatment, 1โ€“5 scale Used by: update.
next_review_dateNoYYYY-MM-DD Used by: update.
treatment_statusNoTreatment workflow status (default identified) [create] | Treatment lifecycle state. 'accepted' set here records no approval โ€” scf_accept_risk does. Below admin, moving an accepted risk with an approval in force off accepted is ignored (it stays accepted); an admin's move clears the acceptance [update] Used by: create, update.
treatment_due_dateNoYYYY-MM-DD Used by: update.
residual_likelihoodNoResidual likelihood after treatment, 1โ€“5 scale Used by: update.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, and the description reinforces this by labeling delete as destructive and noting only this org's assessment row is removed while the catalog definition persists. It further adds non-obvious constraints โ€“ accept requires admin, a platform key without a user gets 403, expiry must be in the future โ€“ that go beyond the annotations, though it does not describe the response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence plus a routing instruction, with the resource, the role gate, and the destructive warning all front-loaded. No filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 19-parameter multiplexed mutation tool with no output schema, the description plus the fully documented method enum give an agent enough to pick the right method and understand the permission and destructive implications. Residual gap is that nothing describes the return payload, but that is minor given the schema's richness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already carries per-method 'Used by' annotations, so the description adds essentially nothing per-parameter beyond restating which method is chosen. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("Change the risk register") and then enumerates the four operations the single tool multiplexes (create, update, delete, record/renew acceptance), which clearly separates it from the read-side sibling scf_risk_read and from scf_custom_risk_write.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states that method selects the operation and flags role gates (editor+ for changes, admin for accept), plus the schema's method enum explicitly routes approval recording to scf_accept_risk instead of setting treatment_status to accepted. There is no explicit statement of when to prefer this over scf_custom_risk_write, which keeps it below a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_system_readB
Read-only

Read the systems inventory: list systems, one system, catalog templates, a system's capabilities and recipes, recipe status, org evidence capabilities, systems for an evidence type.

NameRequiredDescriptionDefault
slugNoTemplate slug โ€” obtain from scf_list_system_catalog Used by: catalog_template.
methodYeslist: List the organization's systems with boundary and recovery record (in_scope, criticality, RTO/RPO hours, data classification, hosting). Filter by linked vendor or boundary decision. get: Get one system from the organization's inventory (read โ€” viewer role): name, type, vendor, description, catalog template link and the evidence it is configured to provide. catalog_templates: List system-catalog templates โ€” the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name. catalog_template: Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time). capabilities: List the evidence types a system can provide and how (read โ€” viewer role): capability status potential/configured/active, collection method, confidence and data format. recipes: Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps. recipe_status: Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes. evidence_capabilities: List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports. systems_for_evidence: Find every system that can provide a given evidence type (read โ€” viewer role) โ€” the inverse of the per-system capability list. Filter by capability status.
org_idNoOrganization UUID โ€” obtain from scf_list_organizations Used by: list, get, capabilities, recipes, recipe_status, evidence_capabilities, systems_for_evidence.
searchNoFree-text search across template names, vendors, and aliases Used by: catalog_templates.
in_scopeNoFilter by assessment boundary: 'true' (inside), 'false' (outside) or 'undecided' (not recorded) Used by: list.
system_idNoSystem UUID โ€” obtain from scf_list_systems Used by: get, capabilities, recipes, recipe_status.
vendor_idNoFilter to systems structurally linked to this vendor UUID โ€” obtain from scf_list_vendors Used by: list.
evidence_idNoCatalog evidence ID, e.g. E-IAM-01 Used by: systems_for_evidence.
capability_statusNoFilter by capability status Used by: capabilities, systems_for_evidence.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe read, so the description only needs to add context. It does add that recipe_status is a queued AI job (inferable polling semantics) but omits permission requirements, pagination, and result limits; the 'viewer role' and return-shape notes appear only in the schema, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the verb and resource come first and the method list follows. It is dense but compact, though the listed phrases are not verbatim method names, forcing a small mental mapping to the enum.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter multiplexed tool with no output schema, the description is thin: it never says what a call returns or that behavior varies sharply by method, leaving that entirely to the schema's enum text. It is adequate to identify the tool but not to predict responses.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter is documented with its applicable methods, so the schema does the heavy lifting. The description adds only a high-level mapping of names to operations ('one system', 'recipe status') and no format, ID-source, or enum semantics beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read the systems inventory') and then enumerates the nine sub-operations the tool covers, so an agent can see the full scope without opening the schema. It does not name siblings such as scf_system_write or scf_evidence_read to sharpen the boundary, which keeps it from a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The enumeration implies which method to pick for a given information need, but there is no explicit when-to-use / when-not-to-use guidance and no routing to alternative tools for overlapping needs (e.g., evidence lookups via scf_evidence_read). The real routing hints ('Poll this after scf_generate_system_recipes', 'obtain from scf_list_system_catalog') live in the schema's enum description, not the tool description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_system_writeA

Manage the systems inventory (editor+): create or update a system, declare or update an evidence capability, or generate collection recipes (async). Pick with method.

NameRequiredDescriptionDefault
nameNoHuman-readable system name (required) [create] | New system name [update] Used by: create, update.
notesNoFree-text notes about the capability Used by: create_capability, update_capability.
methodYescreate: Create a system in the organization's infrastructure inventory (write โ€” editor+ role). Systems can be linked to capabilities and evidence. update: Update a system record (write โ€” editor+ role), including its boundary and recovery record. All fields are optional; only provided fields are applied. create_capability: Declare that a system can provide one evidence type (write โ€” editor role). One entry per evidence_id per system; status defaults to potential, confidence to medium. update_capability: Update a system's evidence capability (write โ€” editor role). Only passed fields change; move status potential โ†’ configured โ†’ active as the collector is wired up. generate_recipes: Queue AI generation of evidence-collection recipes for a system (write โ€” editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
statusNoLifecycle status (default: active) [create] | New lifecycle status [update] Used by: create, update.
vendorNoLegacy free-text vendor name (prefer vendor_id for a structural link) [create] | New legacy free-text vendor name (prefer vendor_id) [update] Used by: create, update.
categoryNoFree-text category (e.g., 'SIEM', 'Endpoint', 'Identity') [create] | New free-text category [update] Used by: create, update.
in_scopeNoInside the assessment boundary (true) or outside (false); omit when not decided [create] | Assessment boundary: true (inside), false (outside), or null to mark it undecided [update] Used by: create, update.
rpo_hoursNoRecovery point objective, in hours (โ‰ฅ 0) [create] | Recovery point objective in hours (โ‰ฅ 0); null clears [update] Used by: create, update.
rto_hoursNoRecovery time objective, in hours (โ‰ฅ 0) [create] | Recovery time objective in hours (โ‰ฅ 0); null clears [update] Used by: create, update.
system_idNoSystem UUID to update โ€” obtain from scf_list_systems [update] | System UUID โ€” obtain from scf_list_systems [create_capability, update_capability, generate_recipes] Used by: update, create_capability, update_capability, generate_recipes.
vendor_idNoVendor UUID to structurally link this system to โ€” obtain from scf_list_vendors (same org) [create] | New structural vendor link (UUID, same org) โ€” obtain from scf_list_vendors [update] Used by: create, update.
criticalityNoBusiness criticality โ€” one of: low, medium, high, critical [create] | Business criticality โ€” one of: low, medium, high, critical; null clears [update] Used by: create, update.
data_formatNoFormat of the collected data, e.g. 'csv', 'json', 'pdf' Used by: create_capability, update_capability.
descriptionNoFree-text description of the system [create] | New system description [update] Used by: create, update.
evidence_idNoCatalog evidence ID, e.g. E-IAM-01 Used by: create_capability.
system_typeNoSystem classification โ€” one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom [create] | New system classification โ€” one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom [update] Used by: create, update.
capability_idNoCapability UUID โ€” obtain from scf_list_system_capabilities Used by: update_capability.
confidence_levelNoConfidence in evidence quality (default medium) [create_capability] | Confidence in evidence quality [update_capability] Used by: create_capability, update_capability.
hosting_locationNoWhere the system runs, e.g. a cloud region or data centre [create] | Where the system runs; null clears [update] Used by: create, update.
capability_statusNoCapability status (default potential) [create_capability] | Capability status [update_capability] Used by: create_capability, update_capability.
collection_methodNoHow the evidence is collected Used by: create_capability, update_capability.
catalog_template_idNoSystem-catalog template ID to link โ€” obtain from scf_list_system_catalog [create] | New system-catalog template ID link โ€” obtain from scf_list_system_catalog [update] Used by: create, update.
data_classificationNoHighest classification of data held โ€” one of: public, internal, confidential, restricted [create] | Highest classification of data held โ€” one of: public, internal, confidential, restricted; null clears [update] Used by: create, update.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false; the description adds genuinely non-structured context: the editor+/editor role requirement per operation, and that generate_recipes is asynchronous returning HTTP 202 with progress tracked via a separate status tool. It still does not mention reversibility, what a null field does on update (that detail is in the schema), or rate limits, but for a write tool it goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The role scope is front-loaded in a parenthetical and the three capability families follow in one compact sentence, so it reads quickly with little waste. The single dense sentence forces the reader to parse a comma-heavy list, and "(async)" is tacked on without saying what is returned.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 24-parameter, five-mode multiplexed write tool with no output schema, the description covers the mode inventory, role gates, and the async follow-up, which is the core framing. It stops short of summarizing the mode-to-parameter contract (e.g. that system_id is required for four of the five methods, or that update treats all fields as optional/partial) or what the non-async methods return, leaving the agent to reconstruct that from the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already carries per-method "Used by:" annotations plus enum value explanations, so the schema does all the parameter work. The description adds only the generic instruction "Pick with method" and no per-mode parameter guidance or conditional-requirement summary beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ("Manage the systems inventory") and then enumerates all five things the tool can do: create/update a system, declare/update an evidence capability, and generate collection recipes. The name is scf_system_write and the sibling scf_system_read exists, so the write-vs-read split is inferable, but the description never names that sibling or otherwise explicitly differentiate itself from the read tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a meaningful selector ("Pick with method") and flags that generate_recipes is async, plus a follow-up pointer to scf_get_recipe_generation_status. However, it does not say when to use scf_system_write versus scf_system_read (or scf_capability_theme_read / scf_catalog_read) for related lookups, and the when-to-use detail lives almost entirely in the per-method enum descriptions inside the schema rather than in the description itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_update_org_settingsA

Update the organization profile and maturity targets (write โ€” admin): business_size, mission_statement, maturity_targets. Partial: only passed fields change.

NameRequiredDescriptionDefault
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
business_sizeNoBusiness size, which picks the matching row of each control's right-sizing guidance: micro_small, small, medium, large, enterprise; null clears
maturity_targetsNoTarget maturity per SCF domain code (domain code โ†’ L0โ€“L5), e.g. {"GOV": "L3"}. Replaces the whole map; {} clears every target. Unknown domain codes, or one code given twice in different case, are refused (422). A control's own target (scf_set_target_maturity) overrides its domain's
mission_statementNoMission statement (up to 4000 chars); blank or null clears

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnlyHint=false and destructiveHint=false. The description adds two things annotations cannot: it is an admin-gated write, and it is a partial update where only passed fields change โ€” important behavior for a PATCH-style call. It stops short of describing the clear/replace semantics of null and {} values, which the schema carries instead.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, zero filler. The operation, the scope of writable fields, the admin gate, and the partial-update contract are all front-loaded before any detail is deferred to the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should ideally say something about what a successful update returns or whether it echoes the new settings. It covers fields, partial semantics, and the admin gate, and safety is handled by annotations, so the gap is small but present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter in depth (enum values, 4000-char limit, whole-map replacement rules, 422 on unknown domain codes). The description only echoes the three field names, adding little beyond that. With coverage this high, it does what is expected and no more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (update) and resource (organization profile and maturity targets) and enumerates the exact writable fields: business_size, mission_statement, maturity_targets. An agent can immediately distinguish this from the read-side sibling scf_get_org_settings and from scf_set_target_maturity (per-control targets).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The '(write โ€” admin)' tag signals a permission precondition, which is useful for deciding whether the agent can call it at all. However, it gives no when-to-use vs when-not guidance and never names the obvious alternative, scf_set_target_maturity, for per-control targets โ€” that precedence rule lives only in the parameter schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_user_readA
Read-only

Read the caller's own view: the current user (the API key's identity), their work queue, or their notifications. Pick with method.

NameRequiredDescriptionDefault
limitNoPage size (1โ€“100, default 25) Used by: notifications.
methodYesme: Get the authenticated caller's profile: name, email, organization memberships, and per-org role. work_queue: Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to. notifications: Get the caller's notifications: assignments, comments, status changes and alerts, including risk_acceptance_expired (a risk) and control_validation_due (a control).
unread_onlyNoReturn only unread notifications (default false) Used by: notifications.

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds a genuinely useful behavioral fact beyond them: the identity returned is the API key's identity, meaning there is no parameter to target another user โ€” an agent could otherwise waste calls trying to pass a user id. It does not mention pagination behavior beyond the limit param or response size.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the scope constraint before the method list, with no filler. 'Pick with method' is mildly instructional and repeats what the required enum already makes obvious, which keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a small, read-only, three-parameter tool with no output schema, the description covers scope, identity semantics, and the mode selector adequately. Minor gaps remain around result ordering/pagination across the modes, but nothing essential to invoking it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the method enum descriptions are far richer than the tool description (work queue contents, notification types such as risk_acceptance_expired). The description adds no syntax, format, or default details beyond what the schema already states, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Read') and a clearly bounded resource ('the caller's own view'), then names the three variants: current user, work queue, notifications. This implicitly separates it from org- or entity-scoped siblings like scf_org_read, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' tells the agent how to choose among the three modes, but that routing is already fully enumerated in the method schema description. There is no guidance on when to use this instead of sibling reads (e.g., scf_org_read for organization data) or instead of scf_mark_notifications_read when handling notifications.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_vendor_readB
Read-only

Read third-party risk data: list vendors, one vendor, its research, assessments (list, one, latest, status), certifications, compensating controls, action items. Pick with method.

NameRequiredDescriptionDefault
pageNo1-indexed page number (default 1) Used by: list.
methodYeslist: List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated. get: Get one vendor's detail: certifications, assessments, computed risk score, and latest research results. research: Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research. list_assessments: List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record. assessment: Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources. latest_assessment: Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet. assessment_status: Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment. certifications: List a vendor's certifications (read โ€” viewer role): name, issuing body, certificate number, status, issue and expiry dates, scope and verification URL. compensating_controls: List compensating controls recorded against a vendor's gaps (read โ€” viewer): gap, offsetting control, effectiveness, notes. For the org's own controls use scf_list_org_compensating_controls. action_items: List remediation action items for one vendor, or across every vendor when vendor_id is omitted (read โ€” viewer role). Filter by status or priority.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
statusNoLifecycle status filter โ€” one of: prospect, active, under_review, approved, suspended, offboarded [list] | Filter by status [action_items] Used by: list, action_items.
per_pageNoPage size (1โ€“100, default 25) Used by: list.
priorityNoFilter by priority Used by: action_items.
vendor_idNoVendor UUID โ€” obtain from scf_list_vendors [get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls] | Vendor UUID โ€” omit to list action items across all vendors [action_items] Used by: get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls, action_items.
criticalityNoCriticality tier filter Used by: list.
assessment_idNoAssessment UUID โ€” obtain from scf_list_vendor_assessments or the trigger response [assessment] | Assessment UUID โ€” returned by scf_trigger_vendor_assessment [assessment_status] Used by: assessment, assessment_status.

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true already supplied, the description adds essentially no behavioral context beyond what annotations and schema cover โ€” no mention of pagination behavior, 404 conditions, permission requirements, or freshness of research results. Its only contribution is a resource inventory that duplicates the method enum descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two terse sentences, front-loaded with purpose and then the resource list; nothing is padded or redundant. The dense parenthetical list is compact at the modest cost of readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a ten-method multiplexed read tool with no output schema, the description at least enumerates the full method surface, and the schema fills in per-method semantics. However it does not describe return shapes, pagination handling, or the polling relationship to the trigger tools, leaving gaps for an agent that never reads the full enum text.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the method enum documents each of the ten options in detail, so the baseline of 3 applies. The description's only parameter-related content is "Pick with method," which restates the schema rather than adding syntax, defaults, or cross-parameter constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("Read third-party risk data") and enumerates the sub-resources covered (vendors, research, assessments, certifications, compensating controls, action items), so an agent can tell this is the TPRM read surface rather than a write tool. It stops short of naming scf_vendor_write or other siblings as alternatives, so it falls just below 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Pick with method" points the agent at the required method parameter as the routing mechanism, which is implied usage guidance. There is no explicit when-to-use/when-not, no pointer to scf_vendor_write for mutations, and no note on sequencing (e.g. poll after triggers) despite such ordering existing in the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_vendor_record_writeB
Destructive

Manage a vendor's sub-records (editor+): create, update or delete a certification, a compensating control, or an action item. Deletes are destructive. Pick with method.

NameRequiredDescriptionDefault
cc_idNoCompensating control UUID โ€” obtain from scf_list_compensating_controls Used by: update_compensating_control, delete_compensating_control.
scopeNoCertification scope statement Used by: create_certification, update_certification.
titleNoAction item title Used by: create_action_item, update_action_item.
methodYescreate_certification: Record a certification a vendor holds (write โ€” editor role), e.g. ISO 27001 or SOC 2 Type II. Status defaults to valid; track expiry_date so renewals surface. update_certification: Update a vendor certification (write โ€” editor role). Only passed fields change; use it to mark a certificate expired or revoked, or to record the renewed expiry date. delete_certification: Delete a vendor certification record (destructive write โ€” editor role). Prefer status=expired or revoked when the history matters. create_compensating_control: Record a compensating control for a vendor gap (write โ€” editor role): what the gap is, what offsets it, and how effective that is (full, partial or minimal โ€” default partial). update_compensating_control: Update a vendor compensating control (write โ€” editor role). Only passed fields change: gap description, control text, effectiveness rating, risk-reduction notes. delete_compensating_control: Delete a vendor compensating control record (destructive write โ€” editor role). create_action_item: Create a remediation action item against a vendor (write โ€” editor role), typically from an assessment finding. Priority defaults to medium, status to open. update_action_item: Update a vendor action item (write โ€” editor role). Only passed fields change; set status=completed with completed_date to close it. delete_action_item: Delete a vendor action item (destructive write โ€” editor role). Prefer status=cancelled when the record should stay visible.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
statusNoStatus (default valid) [create_certification] | Status [update_certification, update_action_item] | Status (default open) [create_action_item] Used by: create_certification, update_certification, create_action_item, update_action_item.
cert_idNoCertification UUID โ€” obtain from scf_list_vendor_certifications Used by: update_certification, delete_certification.
item_idNoAction item UUID โ€” obtain from scf_list_vendor_action_items Used by: update_action_item, delete_action_item.
categoryNoFree-text category, e.g. 'contractual', 'technical' Used by: create_action_item, update_action_item.
due_dateNoYYYY-MM-DD Used by: create_action_item, update_action_item.
priorityNoPriority (default medium) [create_action_item] | Priority [update_action_item] Used by: create_action_item, update_action_item.
vendor_idYesVendor UUID โ€” obtain from scf_list_vendors
issue_dateNoYYYY-MM-DD Used by: create_certification, update_certification.
owner_nameNoOwner name Used by: create_action_item, update_action_item.
descriptionNoAction item detail Used by: create_action_item, update_action_item.
expiry_dateNoYYYY-MM-DD Used by: create_certification, update_certification.
owner_user_idNoOwner โ€” obtain from scf_list_members Used by: create_action_item, update_action_item.
completed_dateNoYYYY-MM-DD Used by: create_action_item, update_action_item.
gap_descriptionNoThe gap the control offsets Used by: create_compensating_control, update_compensating_control.
verification_urlNoPublic verification URL Used by: create_certification, update_certification.
certificate_numberNoCertificate number Used by: create_certification, update_certification.
certification_bodyNoIssuing body Used by: create_certification, update_certification.
certification_nameNoCertification name, e.g. 'ISO 27001:2022' Used by: create_certification, update_certification.
compensating_controlNoThe control that offsets the gap Used by: create_compensating_control, update_compensating_control.
effectiveness_ratingNoEffectiveness (default partial) Used by: create_compensating_control, update_compensating_control.
risk_reduction_notesNoHow much residual risk this removes Used by: create_compensating_control, update_compensating_control.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, so 'Deletes are destructive' largely restates structured data. The description does add one thing not in annotations: the editor+ role requirement, which tells the agent an authorization bar exists. It does not disclose what a delete removes, whether deletes cascade, or any confirmation/irreversibility detail for a mutation tool with a destructive flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the resource and access level, followed by the destructive warning and the dispatch hint. Nothing is padded, though 'Pick with method' is slightly cryptic phrasing that assumes the reader will inspect the enum.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nine-method, 26-parameter multiplexed mutation tool with no output schema, the description is a thin wrapper that delegates almost everything to the schema. It conveys resource scope, role requirement, and destructiveness, but says nothing about what the create/update calls return or what happens to linked records on delete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; each of the 26 parameters is already documented with a 'Used by' mapping to specific methods. The description adds only the framing that 'method' selects among nine operations. It does not restate required field combinations per method, but it does not need to given the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (vendor sub-records), enumerates the three record types (certification, compensating control, action item) and the operations (create/update/delete), and says the dispatch key is 'method'. That is far more specific than the tool name alone. It stops short of the top mark because it never names the sibling it is not, e.g. scf_vendor_write for the vendor record itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives the access precondition '(editor+)' and warns that deletes are destructive, which is real usage context. 'Pick with method' only points at the dispatch mechanism rather than explaining when to choose each method or when to use this tool instead of its siblings. The substantive when-to-use detail (e.g. prefer status=expired over deleting, set status=completed with completed_date) lives in the schema enum descriptions, not here.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scf_vendor_writeA

Manage vendors (editor+): create or update a vendor, trigger AI research, or trigger a DPSIA assessment (async). Pick with method.

NameRequiredDescriptionDefault
nameNoVendor legal or trading name (required) [create] | New vendor name [update] Used by: create, update.
methodYescreate: Create a vendor in the TPRM registry (write โ€” editor+ role). Platform auto-scores risk based on criticality and data handling. update: Update an existing vendor record (write โ€” editor+ role). Only provided fields are applied. research: Queue AI security research for a vendor (write โ€” editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research. assess: Queue an AI vendor security assessment (write โ€” editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status.
org_idYesOrganization UUID โ€” obtain from scf_list_organizations
statusNoLifecycle status (default prospect) โ€” one of: prospect, active, under_review, approved, suspended, offboarded [create] | New lifecycle status โ€” one of: prospect, active, under_review, approved, suspended, offboarded [update] Used by: create, update.
websiteNoVendor website URL [create] | New website URL [update] Used by: create, update.
categoryNoCategory label (e.g., 'SaaS', 'Infrastructure', 'Consulting') [create] | New category label [update] Used by: create, update.
data_roleNoGDPR data role (default 'Processor') Used by: assess.
vendor_idNoVendor UUID โ€” obtain from scf_list_vendors Used by: update, research, assess.
criticalityNoBusiness criticality tier (default 'medium') [create] | New criticality tier [update] Used by: create, update.
descriptionNoShort free-text description of the vendor [create] | New free-text description [update] Used by: create, update.
contact_emailNoPrimary contact email address [create] | New primary contact email [update] Used by: create, update.
data_locationNoWhere the vendor stores or processes our data [create] | Where the vendor stores or processes our data; null clears [update] Used by: create, update.
services_usedNoDescription of services the vendor provides, 1โ€“2000 chars (auto-derived from the vendor record if omitted) Used by: assess.
assessment_typeNoAssessment type: 'initial', 'annual', or 'adhoc' (default 'initial') Used by: assess.
domain_overrideNoOverride the vendor's website domain used for research lookup (e.g., 'example.com') Used by: research.
additional_contextNoFree-text context, scope notes, or specific concerns to feed the assessor (max 5000 chars) Used by: assess.
flow_down_requirementsNoRequirements passed down to the vendor by contract [create] | Requirements passed down to the vendor by contract; null clears [update] Used by: create, update.
shared_responsibility_noteNoWho is responsible for what between us and the vendor [create] | Who is responsible for what between us and the vendor; null clears [update] Used by: create, update.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description adds real behavioral context: an editor+ role gate on all operations, that research and assess are async, and that assess supersedes the deprecated DPSIA trigger. It stops short of noting that update is a partial/patch-style mutation or what the queued jobs entail, which the schema covers instead.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no wasted words, listing operations before mechanics. It is arguably over-compressed for a four-in-one tool with 18 parameters, but nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 18-parameter, four-method multiplexed write tool with no output schema, the description is thin โ€” it omits how method-specific requirements interact (vendor_id for update/research/assess, name for create) and relies entirely on schema text. The key facts an agent needs (role requirement, async behavior, polling siblings) are present, so it is minimally sufficient rather than complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter including per-method applicability via 'Used by:' tags, which sets the baseline at 3. The description adds only 'Pick with method' and the async hint; it contributes no additional meaning about the 18 parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (vendors) and enumerates the four concrete operations โ€” create, update, AI research, DPSIA assessment โ€” so an agent immediately knows what the tool does. It falls short of a 5 because it gives no differentiation from the closely-named sibling scf_vendor_record_write, leaving overlap ambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' identifies the discriminator but gives no when-to-use guidance between the four operations, and no exclusions relative to scf_vendor_read or scf_vendor_record_write. The per-method context (async, polling targets) lives in the method enum's schema description rather than in the tool description, so usage is only implied here.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 244 tool updatesv4.1.0
    • Removedscf_accept_risk
    • Removedscf_add_capability_test_finding
    • Removedscf_add_custom_risk_control
    • Removedscf_add_engagement_auditor
    • Removedscf_add_team_member
    • Removedscf_apply_catalog_reconciliation
    • Addedscf_assessment_read
    • Addedscf_assessment_write
    • Removedscf_attest_journey_stage
    • Removedscf_batch_create_team_assignments
    • Removedscf_batch_update_controls
    • Removedscf_batch_update_evidence
    • Removedscf_bulk_assess_evidence
    • Removedscf_bulk_assess_windows
    • Removedscf_bulk_unscope_framework
    • Removedscf_cancel_catalog_reconciliation
    • Addedscf_capability_theme_read
    • Addedscf_catalog_read
    • Removedscf_complete_evidence_task
    • Addedscf_control_read
    • Addedscf_control_write
    • Removedscf_create_assignment
    • Removedscf_create_capability_test
    • Removedscf_create_comment
    • Removedscf_create_compensating_control
    • Removedscf_create_custom_risk
    • Removedscf_create_deficiency
    • Removedscf_create_engagement
    • Removedscf_create_engagement_query
    • Removedscf_create_evidence
    • Removedscf_create_evidence_task
    • Removedscf_create_org_compensating_control
    • Removedscf_create_risk
    • Removedscf_create_system
    • Removedscf_create_system_capability
    • Removedscf_create_team
    • Removedscf_create_team_assignment
    • Removedscf_create_vendor
    • Removedscf_create_vendor_action_item
    • Removedscf_create_vendor_certification
    • Removedscf_create_webhook
    • Addedscf_custom_risk_read
    • Addedscf_custom_risk_write
    • Removedscf_delete_assignment
    • Removedscf_delete_comment
    • Removedscf_delete_compensating_control
    • Removedscf_delete_custom_risk
    • Removedscf_delete_engagement
    • Removedscf_delete_evidence_file
    • Removedscf_delete_risk_assessment
    • Removedscf_delete_team_assignment
    • Removedscf_delete_vendor_action_item
    • Removedscf_delete_vendor_certification
    • Removedscf_delete_webhook
    • Addedscf_evidence_file_read
    • Addedscf_evidence_file_write
    • Addedscf_evidence_read
    • Addedscf_evidence_task_write
    • Addedscf_evidence_write
    • Removedscf_export_document
    • Removedscf_generate_documents
    • Removedscf_generate_system_recipes
    • Removedscf_get_assessment_review_queue
    • Removedscf_get_audit_log
    • Removedscf_get_capability_test
    • Removedscf_get_capability_theme
    • Removedscf_get_capability_theme_evidence_posture
    • Removedscf_get_capability_theme_scorecard
    • Removedscf_get_catalog_changelog
    • Removedscf_get_catalog_evidence
    • Removedscf_get_catalog_reconciliation_status
    • Removedscf_get_change_cursor
    • Removedscf_get_control
    • Removedscf_get_control_assessment_composite
    • Removedscf_get_controls_for_risk
    • Removedscf_get_current_user
    • Removedscf_get_deficiency
    • Removedscf_get_deficiency_summary
    • Removedscf_get_document
    • Removedscf_get_document_generation_status
    • Removedscf_get_document_history
    • Removedscf_get_document_section_generated
    • Removedscf_get_document_settings
    • Removedscf_get_domain
    • Removedscf_get_engagement
    • Removedscf_get_engagement_presentation
    • Removedscf_get_engagement_query
    • Removedscf_get_engagement_scope
    • Removedscf_get_evidence
    • Removedscf_get_evidence_assessment
    • Removedscf_get_evidence_assessment_summary
    • Removedscf_get_evidence_file
    • Removedscf_get_evidence_health
    • Removedscf_get_evidence_item_maturity
    • Removedscf_get_evidence_maturity
    • Removedscf_get_evidence_suggestions
    • Removedscf_get_evidence_upgrade_recommendations
    • Removedscf_get_evidence_validation
    • Removedscf_get_evidence_validation_summary
    • Removedscf_get_framework_scope_summary
    • Removedscf_get_frequency_health
    • Removedscf_get_journey
    • Removedscf_get_latest_vendor_assessment
    • Removedscf_get_notifications
    • Removedscf_get_org_compensating_control
    • Removedscf_get_org_settings
    • Removedscf_get_org_work_queue
    • Removedscf_get_organization
    • Removedscf_get_posture_snapshot
    • Removedscf_get_recipe_generation_status
    • Removedscf_get_reconciliation_run
    • Removedscf_get_risk
    • Removedscf_get_risk_matrix
    • Removedscf_get_risk_profile
    • Removedscf_get_risk_summary
    • Removedscf_get_risks_for_control
    • Removedscf_get_scoped_control
    • Removedscf_get_scoping_stats
    • Removedscf_get_system
    • Removedscf_get_system_catalog_template
    • Removedscf_get_system_recipes
    • Removedscf_get_systems_for_evidence
    • Removedscf_get_team
    • Removedscf_get_upcoming_evidence
    • Removedscf_get_vendor
    • Removedscf_get_vendor_assessment
    • Removedscf_get_vendor_assessment_status
    • Removedscf_get_vendor_research
    • Removedscf_get_webhook
    • Removedscf_get_window_assessment
    • Removedscf_get_window_assessment_summary
    • Removedscf_get_window_assessment_versions
    • Removedscf_get_work_queue
    • Removedscf_import_journey
    • Removedscf_list_assessment_objectives
    • Removedscf_list_assignments
    • Removedscf_list_capabilities
    • Removedscf_list_capability_tests
    • Removedscf_list_capability_theme_controls
    • Removedscf_list_capability_themes
    • Removedscf_list_comments
    • Removedscf_list_compensating_controls
    • Removedscf_list_control_assessment_composites
    • Removedscf_list_control_validations
    • Removedscf_list_controls
    • Removedscf_list_custom_risk_controls
    • Removedscf_list_custom_risks
    • Removedscf_list_deficiencies
    • Removedscf_list_document_domains
    • Removedscf_list_document_generators
    • Removedscf_list_documents
    • Removedscf_list_domains
    • Removedscf_list_engagement_auditors
    • Removedscf_list_engagement_queries
    • Removedscf_list_engagements
    • Removedscf_list_evidence
    • Removedscf_list_evidence_catalog
    • Removedscf_list_evidence_files
    • Removedscf_list_evidence_gaps
    • Removedscf_list_frameworks
    • Removedscf_list_functions
    • Removedscf_list_journey_templates
    • Removedscf_list_members
    • Removedscf_list_my_engagements
    • Removedscf_list_org_compensating_controls
    • Removedscf_list_organizations
    • Removedscf_list_posture_snapshots
    • Removedscf_list_reconciliation_runs
    • Removedscf_list_risks
    • Removedscf_list_scoped_controls
    • Removedscf_list_system_capabilities
    • Removedscf_list_system_catalog
    • Removedscf_list_systems
    • Removedscf_list_team_assignments
    • Removedscf_list_teams
    • Removedscf_list_vendor_action_items
    • Removedscf_list_vendor_assessments
    • Removedscf_list_vendor_certifications
    • Removedscf_list_vendors
    • Removedscf_list_webhook_deliveries
    • Removedscf_list_webhooks
    • Removedscf_list_window_assessments
    • Addedscf_load_tools
    • Addedscf_org_read
    • Removedscf_preview_catalog_reconciliation
    • Removedscf_preview_document
    • Removedscf_preview_framework_scope_change
    • Removedscf_record_control_validation
    • Removedscf_refresh_stale_window_assessments
    • Removedscf_remove_custom_risk_control
    • Removedscf_remove_engagement_auditor
    • Removedscf_remove_team_member
    • Removedscf_resolve_document_section
    • Removedscf_respond_to_engagement_query
    • Removedscf_revalidate_evidence_file
    • Removedscf_review_evidence_assessment
    • Removedscf_review_evidence_file
    • Removedscf_review_window_assessment
    • Removedscf_review_window_assessment_verdict
    • Addedscf_risk_read
    • Addedscf_risk_write
    • Removedscf_rollback_catalog_reconciliation
    • Removedscf_rotate_webhook_secret
    • Removedscf_scope_framework
    • Removedscf_set_control_basis_override
    • Removedscf_set_control_materiality
    • Removedscf_set_control_procedure
    • Removedscf_set_framework_basis
    • Removedscf_set_reconciliation_actions
    • Removedscf_set_scope_override
    • Removedscf_set_target_maturity
    • Addedscf_system_read
    • Addedscf_system_write
    • Removedscf_take_posture_snapshot
    • Removedscf_transition_document
    • Removedscf_trigger_evidence_assessment
    • Removedscf_trigger_vendor_assessment
    • Removedscf_trigger_vendor_research
    • Removedscf_trigger_window_assessment
    • Removedscf_update_capability_test
    • Removedscf_update_comment
    • Removedscf_update_compensating_control
    • Removedscf_update_custom_risk
    • Removedscf_update_custom_risk_control
    • Removedscf_update_deficiency
    • Removedscf_update_document_section
    • Removedscf_update_document_settings
    • Removedscf_update_engagement
    • Removedscf_update_engagement_query_status
    • Removedscf_update_evidence
    • Removedscf_update_evidence_task
    • Removedscf_update_org_compensating_control
    • Removedscf_update_risk_assessment
    • Removedscf_update_scoped_control
    • Removedscf_update_system
    • Removedscf_update_system_capability
    • Removedscf_update_team
    • Removedscf_update_vendor
    • Removedscf_update_vendor_action_item
    • Removedscf_update_vendor_certification
    • Addedscf_user_read
    • Addedscf_vendor_read
    • Addedscf_vendor_record_write
    • Addedscf_vendor_write
  2. 43 tool updatesv3.7.2
    • Addedscf_accept_risk
    • Addedscf_add_capability_test_finding
    • Changedscf_add_custom_risk_control1 field changed
      • addedInput schema / properties / document_id
        Added value: +{
        +  "description": "Organisation document that sets the standard this risk is an exception against โ€” obtain from scf_list_documents (404 if not this org's). A link with a document makes the custom risk a standards exception",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
    • Changedscf_batch_update_controls2 fields changed
      • changedInput schema / properties / operations / items / properties / implementation_status / description
        Previous value: -"Implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, deferred"New value: +"Implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, deferred. at_risk raises a deficiency; not_applicable on a material control needs an admin (403)"
      • changedInput schema / properties / operations / items / properties / selected / description
        Previous value: -"Toggle in-scope membership"New value: +"Toggle in-scope membership. Deselecting an MCR-basis or material control is refused (409) โ€” use scf_set_scope_override"
    • Changedscf_bulk_unscope_framework1 field changed
      • changedInput schema / properties / removal_reason / description
        Previous value: -"Why these controls leave scope โ€” recorded in the audit trail"New value: +"Why these controls leave scope โ€” recorded in the audit trail. Required (400 without it), with an admin key (403 otherwise), when a framework carries an MCR obligation or its removal would take a material control out of scope"
    • Addedscf_create_capability_test
    • Addedscf_create_deficiency
    • Addedscf_create_org_compensating_control
    • Changedscf_create_system6 fields changed
      • addedInput schema / properties / criticality
        Added value: +{
        +  "description": "Business criticality โ€” one of: low, medium, high, critical",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high",
        +    "critical"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / data_classification
        Added value: +{
        +  "description": "Highest classification of data held โ€” one of: public, internal, confidential, restricted",
        +  "enum": [
        +    "public",
        +    "internal",
        +    "confidential",
        +    "restricted"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / hosting_location
        Added value: +{
        +  "description": "Where the system runs, e.g. a cloud region or data centre",
        +  "maxLength": 255,
        +  "type": "string"
        +}
      • addedInput schema / properties / in_scope
        Added value: +{
        +  "description": "Inside the assessment boundary (true) or outside (false); omit when not decided",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / rpo_hours
        Added value: +{
        +  "description": "Recovery point objective, in hours (โ‰ฅ 0)",
        +  "minimum": 0,
        +  "type": "number"
        +}
      • addedInput schema / properties / rto_hours
        Added value: +{
        +  "description": "Recovery time objective, in hours (โ‰ฅ 0)",
        +  "minimum": 0,
        +  "type": "number"
        +}
    • Changedscf_create_vendor3 fields changed
      • addedInput schema / properties / data_location
        Added value: +{
        +  "description": "Where the vendor stores or processes our data",
        +  "maxLength": 255,
        +  "type": "string"
        +}
      • addedInput schema / properties / flow_down_requirements
        Added value: +{
        +  "description": "Requirements passed down to the vendor by contract",
        +  "type": "string"
        +}
      • addedInput schema / properties / shared_responsibility_note
        Added value: +{
        +  "description": "Who is responsible for what between us and the vendor",
        +  "type": "string"
        +}
    • Changedscf_generate_documents1 field changed
      • changedInput schema / properties / requests / items / properties / generator / description
        Previous value: -"Generator name from scf_list_document_generators"New value: +"Generator name from scf_list_document_generators, e.g. 'soa' or 'governance-report' (the Governance Oversight Report for board due-care review; not domain-scoped)"
    • Addedscf_get_capability_test
    • Addedscf_get_deficiency
    • Addedscf_get_deficiency_summary
    • Addedscf_get_org_compensating_control
    • Addedscf_get_org_settings
    • Addedscf_get_posture_snapshot
    • Changedscf_import_journey1 field changed
      • changedInput schema / properties / template / properties / stages / items / properties / precondition_spec / description
        Previous value: -"Machine-checked preconditions evaluated for display only โ€” they never advance a stage on their own"New value: +"Machine-checked preconditions evaluated for display only โ€” they never advance a stage on their own. Each entry is {type, label?, ...params}; an unknown type or a parameter the type does not take reads as 'cannot evaluate', never as met. Types: frameworks_scoped(min_count); controls_with_decision, controls_with_owner(min_fraction, domains, scf_ids); controls_at_status(statuses, min_fraction, domains, scf_ids); controls_at_risk_max(max_count, domains, scf_ids); documents_approved(min_count, generator e.g. 'soa' or '<generator>:<domain>' such as 'policy:GOV', within_days 1โ€“3660 = approved in the last N days); evidence_items_tracked(min_count); evidence_files_uploaded(min_count); evidence_upload_spread_days(min_days, default 30); engagement_exists; frameworks_with_basis(basis mcr|dsr required, min_count); controls_with_basis(basis?, min_fraction, domains, scf_ids); systems_with_criticality(min_fraction); controls_with_target, controls_at_target(min_fraction, domains, scf_ids); material_controls_at_status(statuses required, min_fraction, domains, scf_ids); risks_accepted_without_approver_max(max_count, default 0); open_deficiencies_max, material_deficiencies_max(max_count default 0, domains); controls_validated_within_cadence(min_fraction, domains, scf_ids); capability_tests_within_days(days 1โ€“3660 required, min_count default 1, test_types: incident_response|continuity|other). scf_ids and domains apply only where listed; an unknown control ID or domain code is refused at upload (422). Example: {\"type\": \"documents_approved\", \"generator\": \"soa\"}. Full table: docs/tools/journey.md"
    • Addedscf_list_capability_tests
    • Addedscf_list_control_validations
    • Addedscf_list_deficiencies
    • Addedscf_list_org_compensating_controls
    • Addedscf_list_posture_snapshots
    • Changedscf_list_risks7 fields changed
      • addedInput schema / properties / acceptance_state
        Added value: +{
        +  "description": "Accepted risks only, by their approval: 'approved' (in force), 'expired' (past acceptance_expires_on) or 'unapproved' (accepted with no approval recorded)",
        +  "enum": [
        +    "approved",
        +    "expired",
        +    "unapproved"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / category
        Added value: +{
        +  "description": "Filter by catalog risk category code, e.g. 'AC' matches R-AC-N",
        +  "type": "string"
        +}
      • removedInput schema / properties / page
        Removed value: -{
        -  "default": 1,
        -  "description": "1-indexed page number (default 1)",
        -  "maximum": 9007199254740991,
        -  "minimum": 1,
        -  "type": "integer"
        -}
      • removedInput schema / properties / per_page
        Removed value: -{
        -  "default": 25,
        -  "description": "Page size (1โ€“100, default 25)",
        -  "maximum": 100,
        -  "minimum": 1,
        -  "type": "integer"
        -}
      • addedInput schema / properties / risk_level
        Added value: +{
        +  "description": "Filter by inherent risk level, banded by the org's risk profile",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high",
        +    "critical"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / status / description
        Previous value: -"Filter by treatment status (e.g., 'mitigate', 'accept', 'transfer', 'avoid')"New value: +"Filter by treatment status: identified, analysed, treating, treated, accepted or monitoring (sent as the platform's treatment_status)"
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "identified",
        +  "analysed",
        +  "treating",
        +  "treated",
        +  "accepted",
        +  "monitoring"
        +]
    • Changedscf_list_scoped_controls3 fields changed
      • addedInput schema / properties / basis
        Added value: +{
        +  "description": "Filter by obligation basis: 'mcr', 'dsr', or 'unclassified' (no classified framework and no override). Each row carries obligation_basis, basis_source (override | framework) and basis_override_reason",
        +  "enum": [
        +    "mcr",
        +    "dsr",
        +    "unclassified"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / material
        Added value: +{
        +  "description": "Filter by materiality: true for material controls (catalogue weighting 10, or an admin override), false for the rest. Rows carry material, material_source (control | weighting) and material_reason",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / sort
        Added value: +{
        +  "default": "scf_id",
        +  "description": "Order: 'scf_id' (default), or 'weighting' โ€” material controls first, then catalogue weighting highest first, then scf_id. Rows also carry target_maturity, target_source (control | domain), target_maturity_reason, procedure_document_id, procedure_document_status, last_validated_at, last_validated_by and last_validation_note",
        +  "enum": [
        +    "scf_id",
        +    "weighting"
        +  ],
        +  "type": "string"
        +}
    • Changedscf_list_systems1 field changed
      • addedInput schema / properties / in_scope
        Added value: +{
        +  "description": "Filter by assessment boundary: 'true' (inside), 'false' (outside) or 'undecided' (not recorded)",
        +  "enum": [
        +    "true",
        +    "false",
        +    "undecided"
        +  ],
        +  "type": "string"
        +}
    • Addedscf_record_control_validation
    • Addedscf_set_control_basis_override
    • Addedscf_set_control_materiality
    • Addedscf_set_control_procedure
    • Addedscf_set_framework_basis
    • Changedscf_set_scope_override1 field changed
      • changedInput schema / properties / reason / description
        Previous value: -"Why this control is being overridden โ€” recorded in the audit trail (max 2000 characters)"New value: +"Why this control is being overridden โ€” recorded in the audit trail (max 2000 characters). Required for 'exclude'. The admin making an MCR or material exclusion is recorded as its approver; there is no approver parameter"
    • Addedscf_set_target_maturity
    • Addedscf_take_posture_snapshot
    • Addedscf_update_capability_test
    • Addedscf_update_custom_risk_control
    • Addedscf_update_deficiency
    • Addedscf_update_org_compensating_control
    • Addedscf_update_org_settings
    • Changedscf_update_risk_assessment1 field changed
      • changedInput schema / properties / treatment_status / description
        Previous value: -"Treatment lifecycle state"New value: +"Treatment lifecycle state. 'accepted' set here records no approval โ€” scf_accept_risk does. Below admin, moving an accepted risk with an approval in force off accepted is ignored (it stays accepted); an admin's move clears the acceptance"
    • Changedscf_update_scoped_control1 field changed
      • changedInput schema / properties / implementation_status / description
        Previous value: -"New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred"New value: +"New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred. Moving to at_risk raises a deficiency (see scf_list_deficiencies). A material control (catalogue weighting 10, or set material by an admin) can only leave scope through scf_set_scope_override by an admin (other paths 409), and only an admin may mark it not_applicable (403 otherwise)."
    • Changedscf_update_system6 fields changed
      • addedInput schema / properties / criticality
        Added value: +{
        +  "anyOf": [
        +    {
        +      "enum": [
        +        "low",
        +        "medium",
        +        "high",
        +        "critical"
        +      ],
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Business criticality โ€” one of: low, medium, high, critical; null clears"
        +}
      • addedInput schema / properties / data_classification
        Added value: +{
        +  "anyOf": [
        +    {
        +      "enum": [
        +        "public",
        +        "internal",
        +        "confidential",
        +        "restricted"
        +      ],
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Highest classification of data held โ€” one of: public, internal, confidential, restricted; null clears"
        +}
      • addedInput schema / properties / hosting_location
        Added value: +{
        +  "anyOf": [
        +    {
        +      "maxLength": 255,
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Where the system runs; null clears"
        +}
      • addedInput schema / properties / in_scope
        Added value: +{
        +  "description": "Assessment boundary: true (inside), false (outside), or null to mark it undecided",
        +  "type": [
        +    "boolean",
        +    "null"
        +  ]
        +}
      • addedInput schema / properties / rpo_hours
        Added value: +{
        +  "anyOf": [
        +    {
        +      "minimum": 0,
        +      "type": "number"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Recovery point objective in hours (โ‰ฅ 0); null clears"
        +}
      • addedInput schema / properties / rto_hours
        Added value: +{
        +  "anyOf": [
        +    {
        +      "minimum": 0,
        +      "type": "number"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Recovery time objective in hours (โ‰ฅ 0); null clears"
        +}
    • Changedscf_update_vendor3 fields changed
      • addedInput schema / properties / data_location
        Added value: +{
        +  "anyOf": [
        +    {
        +      "maxLength": 255,
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "description": "Where the vendor stores or processes our data; null clears"
        +}
      • addedInput schema / properties / flow_down_requirements
        Added value: +{
        +  "description": "Requirements passed down to the vendor by contract; null clears",
        +  "type": [
        +    "string",
        +    "null"
        +  ]
        +}
      • addedInput schema / properties / shared_responsibility_note
        Added value: +{
        +  "description": "Who is responsible for what between us and the vendor; null clears",
        +  "type": [
        +    "string",
        +    "null"
        +  ]
        +}
  3. 10 tool updatesv3.6.0
    • Addedscf_attest_journey_stage
    • Addedscf_get_framework_scope_summary
    • Addedscf_get_journey
    • Addedscf_import_journey
    • Changedscf_list_evidence4 fields changed
      • addedInput schema / properties / accountable_owner_type
        Added value: +{
        +  "description": "Filter by the accountable team's primary owner: 'internal' or 'external_contractor'",
        +  "enum": [
        +    "internal",
        +    "external_contractor"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / function_id
        Added value: +{
        +  "description": "Filter to evidence assigned to any team aligned to this function โ€” obtain from scf_list_functions",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / my_teams
        Added value: +{
        +  "default": false,
        +  "description": "Filter to evidence assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing โ€” use team_id instead.",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / team_id
        Added value: +{
        +  "description": "Filter to evidence this team is assigned to, accountable or consulted โ€” obtain from scf_list_teams",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
    • Addedscf_list_journey_templates
    • Changedscf_list_scoped_controls4 fields changed
      • addedInput schema / properties / accountable_owner_type
        Added value: +{
        +  "description": "Filter by the accountable team's primary owner: 'internal' or 'external_contractor'",
        +  "enum": [
        +    "internal",
        +    "external_contractor"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / function_id
        Added value: +{
        +  "description": "Filter to controls assigned to any team aligned to this function โ€” obtain from scf_list_functions",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / my_teams
        Added value: +{
        +  "default": false,
        +  "description": "Filter to controls assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing โ€” use team_id instead.",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / team_id
        Added value: +{
        +  "description": "Filter to controls this team is assigned to, accountable or consulted โ€” obtain from scf_list_teams",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
    • Changedscf_list_teams1 field changed
      • addedInput schema / properties / mine
        Added value: +{
        +  "default": false,
        +  "description": "Only teams the caller is a member of (default false); each team then also carries membership_role. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing โ€” use team_id instead.",
        +  "type": "boolean"
        +}
    • Addedscf_preview_framework_scope_change
    • Addedscf_set_scope_override
  4. 9 tool updatesv3.5.0
    • Changedscf_create_system2 fields changed
      • changedInput schema / properties / system_type / description
        Previous value: -"System classification: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, or custom"New value: +"System classification โ€” one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom"
      • changedInput schema / properties / system_type / enum
        Previous value: -[
        -  "cloud_provider",
        -  "identity_provider",
        -  "ticketing",
        -  "logging",
        -  "security_tool",
        -  "code_repository",
        -  "document_management",
        -  "custom"
        -]New value: +[
        +  "cloud_provider",
        +  "identity_provider",
        +  "ticketing",
        +  "logging",
        +  "security_tool",
        +  "code_repository",
        +  "document_management",
        +  "endpoint_management",
        +  "vulnerability_management",
        +  "email_security",
        +  "security_awareness",
        +  "password_manager",
        +  "communication",
        +  "hr_system",
        +  "custom"
        +]
    • Changedscf_create_vendor2 fields changed
      • changedInput schema / properties / status / description
        Previous value: -"Lifecycle status (default 'prospect')"New value: +"Lifecycle status (default prospect) โ€” one of: prospect, active, under_review, approved, suspended, offboarded"
      • changedInput schema / properties / status / enum
        Previous value: -[
        -  "prospect",
        -  "active",
        -  "inactive",
        -  "under_review"
        -]New value: +[
        +  "prospect",
        +  "active",
        +  "under_review",
        +  "approved",
        +  "suspended",
        +  "offboarded"
        +]
    • Changedscf_get_assessment_review_queue1 field changed
      • addedInput schema / properties / tier
        Added value: +{
        +  "default": "file",
        +  "description": "file (default): entries carry file_id, act with scf_review_evidence_assessment. window: entries carry window_assessment_id, act with scf_review_window_assessment_verdict",
        +  "enum": [
        +    "file",
        +    "window"
        +  ],
        +  "type": "string"
        +}
    • Addedscf_get_window_assessment_versions
    • Changedscf_list_vendors2 fields changed
      • changedInput schema / properties / status / description
        Previous value: -"Lifecycle status filter"New value: +"Lifecycle status filter โ€” one of: prospect, active, under_review, approved, suspended, offboarded"
      • changedInput schema / properties / status / enum
        Previous value: -[
        -  "prospect",
        -  "active",
        -  "inactive",
        -  "under_review"
        -]New value: +[
        +  "prospect",
        +  "active",
        +  "under_review",
        +  "approved",
        +  "suspended",
        +  "offboarded"
        +]
    • Changedscf_review_evidence_assessment2 fields changed
      • changedInput schema / properties / ao_overrides / description
        Previous value: -"Objectives to re-designate โ€” required (โ‰ฅ1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation"New value: +"Objectives to re-designate โ€” required (โ‰ฅ1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation. 422 if the version has no per-objective answers: confirm instead"
      • addedInput schema / properties / ao_overrides / items / properties / ao_id / minLength
        Added value: +1
    • Addedscf_review_window_assessment_verdict
    • Changedscf_update_system2 fields changed
      • changedInput schema / properties / system_type / description
        Previous value: -"New system classification"New value: +"New system classification โ€” one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom"
      • changedInput schema / properties / system_type / enum
        Previous value: -[
        -  "cloud_provider",
        -  "identity_provider",
        -  "ticketing",
        -  "logging",
        -  "security_tool",
        -  "code_repository",
        -  "document_management",
        -  "custom"
        -]New value: +[
        +  "cloud_provider",
        +  "identity_provider",
        +  "ticketing",
        +  "logging",
        +  "security_tool",
        +  "code_repository",
        +  "document_management",
        +  "endpoint_management",
        +  "vulnerability_management",
        +  "email_security",
        +  "security_awareness",
        +  "password_manager",
        +  "communication",
        +  "hr_system",
        +  "custom"
        +]
    • Changedscf_update_vendor2 fields changed
      • changedInput schema / properties / status / description
        Previous value: -"New lifecycle status"New value: +"New lifecycle status โ€” one of: prospect, active, under_review, approved, suspended, offboarded"
      • changedInput schema / properties / status / enum
        Previous value: -[
        -  "prospect",
        -  "active",
        -  "inactive",
        -  "under_review"
        -]New value: +[
        +  "prospect",
        +  "active",
        +  "under_review",
        +  "approved",
        +  "suspended",
        +  "offboarded"
        +]
  5. 65 tool updatesv3.4.2
    • Addedscf_add_team_member
    • Addedscf_batch_create_team_assignments
    • Addedscf_batch_update_evidence
    • Addedscf_bulk_unscope_framework
    • Addedscf_complete_evidence_task
    • Addedscf_create_assignment
    • Addedscf_create_comment
    • Addedscf_create_compensating_control
    • Addedscf_create_evidence_task
    • Changedscf_create_risk2 fields changed
      • changedInput schema / properties / treatment_status / description
        Previous value: -"Treatment status: 'mitigate', 'accept', 'transfer', or 'avoid'"New value: +"Treatment workflow status (default identified)"
      • addedInput schema / properties / treatment_status / enum
        Added value: +[
        +  "identified",
        +  "analysed",
        +  "treating",
        +  "treated",
        +  "accepted",
        +  "monitoring"
        +]
    • Addedscf_create_system_capability
    • Addedscf_create_team
    • Addedscf_create_team_assignment
    • Addedscf_create_vendor_action_item
    • Addedscf_create_vendor_certification
    • Addedscf_delete_assignment
    • Addedscf_delete_comment
    • Addedscf_delete_compensating_control
    • Addedscf_delete_evidence_file
    • Addedscf_delete_risk_assessment
    • Addedscf_delete_team_assignment
    • Addedscf_delete_vendor_action_item
    • Addedscf_delete_vendor_certification
    • Addedscf_get_assessment_review_queue
    • Changedscf_get_audit_log13 fields changed
      • addedInput schema / properties / action
        Added value: +{
        +  "description": "Filter by action: create, update or delete",
        +  "enum": [
        +    "create",
        +    "update",
        +    "delete"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / action_source
        Added value: +{
        +  "description": "Filter by origin of the change: ui, api_key, mcp or system",
        +  "enum": [
        +    "ui",
        +    "api_key",
        +    "mcp",
        +    "system"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / actor_id
        Added value: +{
        +  "description": "Filter by actor user UUID โ€” platform alias of changed_by_user_id",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / changed_by_user_id
        Added value: +{
        +  "description": "Filter by the user who made the change โ€” obtain from scf_list_members",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / date_from
        Added value: +{
        +  "description": "Include changes at or after this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ)",
        +  "type": "string"
        +}
      • addedInput schema / properties / date_to
        Added value: +{
        +  "description": "Include changes at or before this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ)",
        +  "type": "string"
        +}
      • addedInput schema / properties / entity_id
        Added value: +{
        +  "description": "Filter by the changed entity's UUID",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / entity_type
        Added value: +{
        +  "description": "Filter by exact entity type as written in the log, e.g. scoped_control, evidence_file, audit_engagement, vendor โ€” unsure of the spelling? use search_text",
        +  "type": "string"
        +}
      • changedInput schema / properties / limit / description
        Previous value: -"Page size (1โ€“100, default 50)"New value: +"Page size (1โ€“200, default 50)"
      • changedInput schema / properties / limit / maximum
        Previous value: -100New value: +200
      • addedInput schema / properties / request_id
        Added value: +{
        +  "description": "Filter by request correlation ID โ€” groups every change one API call made",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / scf_id
        Added value: +{
        +  "description": "Filter by SCF control ID in DOMAIN-NN format",
        +  "type": "string"
        +}
      • addedInput schema / properties / search_text
        Added value: +{
        +  "description": "Case-insensitive search across entity_type, field_name, old_value and new_value",
        +  "type": "string"
        +}
    • Addedscf_get_catalog_evidence
    • Addedscf_get_change_cursor
    • Addedscf_get_controls_for_risk
    • Addedscf_get_domain
    • Addedscf_get_evidence
    • Addedscf_get_frequency_health
    • Addedscf_get_org_work_queue
    • Addedscf_get_risk_profile
    • Addedscf_get_risks_for_control
    • Addedscf_get_system
    • Addedscf_get_systems_for_evidence
    • Addedscf_get_team
    • Addedscf_get_upcoming_evidence
    • Addedscf_list_assignments
    • Addedscf_list_comments
    • Addedscf_list_compensating_controls
    • Changedscf_list_engagement_queries1 field changed
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "open",
        +  "answered",
        +  "closed"
        +]
    • Changedscf_list_engagements2 fields changed
      • changedInput schema / properties / status / description
        Previous value: -"Filter by engagement status (e.g. 'planning', 'fieldwork', 'closed')"New value: +"Filter by engagement status: draft, active, under_review or closed"
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "draft",
        +  "active",
        +  "under_review",
        +  "closed"
        +]
    • Changedscf_list_evidence_tasks8 fields changed
      • addedInput schema / properties / assigned_to_me
        Added value: +{
        +  "description": "Only tasks assigned to the caller",
        +  "type": "boolean"
        +}
      • changedInput schema / properties / assignee / description
        Previous value: -"Filter by assigned user ID"New value: +"Filter by assigned user UUID"
      • addedInput schema / properties / assignee / format
        Added value: +"uuid"
      • addedInput schema / properties / assignee / pattern
        Added value: +"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
      • addedInput schema / properties / evidence_tracking_id
        Added value: +{
        +  "description": "Only tasks for one evidence tracking record",
        +  "format": "uuid",
        +  "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
        +  "type": "string"
        +}
      • addedInput schema / properties / overdue_only
        Added value: +{
        +  "description": "Only tasks past their due date",
        +  "type": "boolean"
        +}
      • changedInput schema / properties / status / description
        Previous value: -"Filter by task status (e.g., 'open', 'in_progress', 'done')"New value: +"Filter by task status: not_started, in_progress or completed"
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "not_started",
        +  "in_progress",
        +  "completed"
        +]
    • Addedscf_list_functions
    • Addedscf_list_system_capabilities
    • Addedscf_list_team_assignments
    • Addedscf_list_teams
    • Addedscf_list_vendor_action_items
    • Addedscf_list_vendor_certifications
    • Addedscf_mark_notifications_read
    • Addedscf_refresh_stale_window_assessments
    • Addedscf_remove_team_member
    • Addedscf_review_evidence_assessment
    • Addedscf_review_evidence_file
    • Addedscf_review_window_assessment
    • Addedscf_update_comment
    • Addedscf_update_compensating_control
    • Changedscf_update_engagement2 fields changed
      • changedInput schema / properties / status / description
        Previous value: -"New engagement status (e.g. 'fieldwork', 'closed')"New value: +"New engagement status: draft, active, under_review or closed"
      • addedInput schema / properties / status / enum
        Added value: +[
        +  "draft",
        +  "active",
        +  "under_review",
        +  "closed"
        +]
    • Addedscf_update_evidence_task
    • Addedscf_update_risk_assessment
    • Addedscf_update_system_capability
    • Addedscf_update_team
    • Addedscf_update_vendor_action_item
    • Addedscf_update_vendor_certification
  6. 7 tool updatesv3.0.0
    • Removedscf_accept_cdm_proposal
    • Removedscf_dismiss_cdm_proposal
    • Removedscf_get_cdm_document_map
    • Removedscf_list_cdm_documents
    • Removedscf_list_cdm_mappings
    • Removedscf_list_cdm_proposals
    • Removedscf_query_cdm_corpus
  7. 51 tool updatesv2.1.0
    • Addedscf_accept_cdm_proposal
    • Addedscf_add_engagement_auditor
    • Addedscf_apply_catalog_reconciliation
    • Addedscf_cancel_catalog_reconciliation
    • Addedscf_create_engagement
    • Addedscf_create_engagement_query
    • Addedscf_delete_engagement
    • Addedscf_dismiss_cdm_proposal
    • Addedscf_export_document
    • Addedscf_generate_documents
    • Addedscf_get_catalog_changelog
    • Addedscf_get_catalog_reconciliation_status
    • Addedscf_get_cdm_document_map
    • Addedscf_get_document
    • Addedscf_get_document_generation_status
    • Addedscf_get_document_history
    • Addedscf_get_document_section_generated
    • Addedscf_get_document_settings
    • Addedscf_get_engagement
    • Addedscf_get_engagement_presentation
    • Addedscf_get_engagement_query
    • Addedscf_get_engagement_scope
    • Addedscf_get_reconciliation_run
    • Changedscf_list_assessment_objectives1 field changed
      • addedInput schema / properties / include_deprecated
        Added value: +{
        +  "description": "Include catalog rows deprecated by a later SCF version. Default false โ€” the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.",
        +  "type": "boolean"
        +}
    • Addedscf_list_cdm_documents
    • Addedscf_list_cdm_mappings
    • Addedscf_list_cdm_proposals
    • Changedscf_list_controls1 field changed
      • addedInput schema / properties / include_deprecated
        Added value: +{
        +  "description": "Include catalog rows deprecated by a later SCF version. Default false โ€” the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.",
        +  "type": "boolean"
        +}
    • Addedscf_list_document_domains
    • Addedscf_list_document_generators
    • Addedscf_list_documents
    • Changedscf_list_domains1 field changed
      • addedInput schema / properties / include_deprecated
        Added value: +{
        +  "description": "Include catalog rows deprecated by a later SCF version. Default false โ€” the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.",
        +  "type": "boolean"
        +}
    • Addedscf_list_engagement_auditors
    • Addedscf_list_engagement_queries
    • Addedscf_list_engagements
    • Changedscf_list_evidence_catalog1 field changed
      • addedInput schema / properties / include_deprecated
        Added value: +{
        +  "description": "Include catalog rows deprecated by a later SCF version. Default false โ€” the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.",
        +  "type": "boolean"
        +}
    • Addedscf_list_my_engagements
    • Addedscf_list_reconciliation_runs
    • Addedscf_preview_catalog_reconciliation
    • Addedscf_preview_document
    • Addedscf_query_cdm_corpus
    • Addedscf_remove_engagement_auditor
    • Addedscf_resolve_document_section
    • Addedscf_respond_to_engagement_query
    • Addedscf_rollback_catalog_reconciliation
    • Addedscf_set_reconciliation_actions
    • Addedscf_transition_document
    • Addedscf_update_document_section
    • Addedscf_update_document_settings
    • Addedscf_update_engagement
    • Addedscf_update_engagement_query_status
  8. 88 tool updatesv1.7.0
    • First observedscf_add_custom_risk_control
    • First observedscf_batch_update_controls
    • First observedscf_bulk_assess_evidence
    • First observedscf_bulk_assess_windows
    • First observedscf_create_custom_risk
    • First observedscf_create_evidence
    • First observedscf_create_risk
    • First observedscf_create_system
    • First observedscf_create_vendor
    • First observedscf_create_webhook
    • First observedscf_delete_custom_risk
    • First observedscf_delete_webhook
    • First observedscf_generate_system_recipes
    • First observedscf_get_audit_log
    • First observedscf_get_capability_theme
    • First observedscf_get_capability_theme_evidence_posture
    • First observedscf_get_capability_theme_scorecard
    • First observedscf_get_control
    • First observedscf_get_control_assessment_composite
    • First observedscf_get_current_user
    • First observedscf_get_evidence_assessment
    • First observedscf_get_evidence_assessment_summary
    • First observedscf_get_evidence_file
    • First observedscf_get_evidence_health
    • First observedscf_get_evidence_item_maturity
    • First observedscf_get_evidence_maturity
    • First observedscf_get_evidence_suggestions
    • First observedscf_get_evidence_upgrade_recommendations
    • First observedscf_get_evidence_validation
    • First observedscf_get_evidence_validation_summary
    • First observedscf_get_latest_vendor_assessment
    • First observedscf_get_notifications
    • First observedscf_get_organization
    • First observedscf_get_recipe_generation_status
    • First observedscf_get_risk
    • First observedscf_get_risk_matrix
    • First observedscf_get_risk_summary
    • First observedscf_get_scoped_control
    • First observedscf_get_scoping_stats
    • First observedscf_get_system_catalog_template
    • First observedscf_get_system_recipes
    • First observedscf_get_vendor
    • First observedscf_get_vendor_assessment
    • First observedscf_get_vendor_assessment_status
    • First observedscf_get_vendor_research
    • First observedscf_get_webhook
    • First observedscf_get_window_assessment
    • First observedscf_get_window_assessment_summary
    • First observedscf_get_work_queue
    • First observedscf_list_assessment_objectives
    • First observedscf_list_capabilities
    • First observedscf_list_capability_theme_controls
    • First observedscf_list_capability_themes
    • First observedscf_list_control_assessment_composites
    • First observedscf_list_controls
    • First observedscf_list_custom_risk_controls
    • First observedscf_list_custom_risks
    • First observedscf_list_domains
    • First observedscf_list_evidence
    • First observedscf_list_evidence_catalog
    • First observedscf_list_evidence_files
    • First observedscf_list_evidence_gaps
    • First observedscf_list_evidence_tasks
    • First observedscf_list_frameworks
    • First observedscf_list_members
    • First observedscf_list_organizations
    • First observedscf_list_risks
    • First observedscf_list_scoped_controls
    • First observedscf_list_system_catalog
    • First observedscf_list_systems
    • First observedscf_list_vendor_assessments
    • First observedscf_list_vendors
    • First observedscf_list_webhook_deliveries
    • First observedscf_list_webhooks
    • First observedscf_list_window_assessments
    • First observedscf_remove_custom_risk_control
    • First observedscf_revalidate_evidence_file
    • First observedscf_rotate_webhook_secret
    • First observedscf_scope_framework
    • First observedscf_trigger_evidence_assessment
    • First observedscf_trigger_vendor_assessment
    • First observedscf_trigger_vendor_research
    • First observedscf_trigger_window_assessment
    • First observedscf_update_custom_risk
    • First observedscf_update_evidence
    • First observedscf_update_scoped_control
    • First observedscf_update_system
    • First observedscf_update_vendor

TDQS

B3.4/5.0

Scored across 26 tools

Disambiguation4/5

Most tools are cleanly partitioned by domain (evidence, risks, vendors, controls, systems) and by read vs write, so tool selection is usually straightforward. However, the evidence area has several adjacent tools (tracking, files, tasks, and AI assessments), and work-queue/notification operations appear across org/user reads and standalone notification tools, creating some boundary ambiguity.

Naming Consistency4/5

The dominant pattern is scf_<domain>_<read|write>, used consistently across most paired domains. A few standalone names switch to verb_noun form (scf_load_tools, scf_list_evidence_tasks, scf_mark_notifications_read, scf_update_org_settings), and there are asymmetric pairs such as evidence_task_write with no matching read, so it is not fully uniform.

Tool Count3/5

26 tools is heavy for a single server and sits above the typical 3โ€“15 range. The breadth of the SCF domain and the read/write pairing across many entities make it less excessive than the raw count suggests, but it is still borderline crowded and some standalone tools could be consolidated.

Completeness4/5

Core SCF operations are well covered: catalog/reference reads, control scoping, evidence tracking/files/tasks, assessments, risks, vendors, systems, org settings, and user notifications mostly have read and write paths. Gaps remain: evidence-task reading is only exposed via a list tool, notification reading is implied but not present as its own tool, and org/member administration is limited; load_tools mitigates missing groups but the current surface is not fully complete.

Maintenance

ActivityActive
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers

  • F
    license
    C
    quality
    B
    maintenance
    Enables AI agents to interact with the ComplianceCow platform to retrieve compliance insights, dashboard data, and auditable evidence through a Compliance Graph. It also supports automated remediation actions such as fixing policies and creating tickets in external tools.
    100
    13
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to query software supply chain compliance data, including asset status, security vulnerabilities, and evidence lineage. It allows for natural language analysis of compliance posture, policy violations, and deployment blockers across an organization.
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides comprehensive access to NIST cybersecurity frameworks and controls, enabling AI assistants and applications to query, analyze, and manage NIST security controls through a standardized interface.
    10
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables searching and bidirectional mapping of 1,451 security controls across 262 SCF-mapped frameworks, including ISO 27001, NIST CSF, DORA, and many others, through natural language queries.
    14
    701 PyPI
    9
    Apache 2.0