Skip to main content
Glama
MarkAC007

mcp-server-scf

by MarkAC007

scf_bulk_unscope_framework

Destructive

Remove controls from scope when mapped only to specified frameworks, preserving controls shared with other in-scope frameworks and their notes/status. Records reason in audit trail.

Instructions

Remove from scope every control mapped only to the given frameworks (destructive write — editor role). Controls shared with another in-scope framework are kept; notes and status survive.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization UUID — obtain from scf_list_organizations
frameworksYesFramework slugs to remove, e.g. ['iso_27017_2015'] — obtain from scf_list_frameworks
removal_reasonNoWhy these controls leave scope — recorded in the audit trail

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv3.4.2

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, and the description reinforces this with 'destructive write' and 'editor role'. It adds valuable behavioral context beyond annotations: the precise removal condition (controls mapped only to given frameworks), the preservation of shared controls, and that 'notes and status survive'. This is strong disclosure for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero waste. The destructive warning and role requirement are front-loaded, followed by the precise scoping rule and the survival guarantee. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive bulk operation with no output schema, the description covers the key facts an agent needs: what gets removed, what gets kept, what survives, and the required role. It does not mention audit trail behavior (though removal_reason param hints at it) or whether the operation is reversible, but the core decision-making context is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description adds context about the overall operation but does not add meaning beyond the schema for individual parameters. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Remove from scope'), a precise resource ('every control mapped only to the given frameworks'), and the exact condition that distinguishes it from related scoping tools ('Controls shared with another in-scope framework are kept'). This clearly differentiates it from siblings like scf_scope_framework and scf_update_scoped_control.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains the semantics of the operation: only controls mapped exclusively to the given frameworks are removed, while shared controls are kept. It also notes the destructive nature and editor role requirement. However, it does not explicitly name alternative tools or state when to use this vs. scf_scope_framework or scf_update_scoped_control, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools