Skip to main content
Glama
mcp-server-scf

mcp-server-scf

by MarkAC007

scf_org_read

Read-only

Read organization data by method: list accessible organizations, retrieve details, settings, members, audit log, change cursor, or work queue to support compliance monitoring.

Instructions

Read organization data: list organizations, one organization, its settings, members, audit log, change cursor, or the organization work queue. Pick with method.

Input Schema

NameRequiredDescriptionDefault
limitNoPage size (1–200, default 50) Used by: audit_log.
actionNoFilter by action: create, update or delete Used by: audit_log.
methodYeslist: List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need. get: Get one organization's detail: subscription tier, member count, usage limits, and settings. settings: Get an organization's settings (read — viewer): profile (business_size, mission_statement), per-domain maturity_targets, name, industry, owner teams and feature switches. members: List members of one organization with their role (admin, editor, or viewer). audit_log: Query one organization's append-only audit trail (read — viewer role): field-level changes with actor, source and before/after values. Filter by entity, control, action, actor, source, date or text. change_cursor: Cheap has-anything-changed probe (read — viewer role): newest audit timestamp and row count for one organization. Compare with the pair you last saw; poll this before re-pulling the audit log. work_queue: Get one org's GRC work queue (read — viewer): overdue evidence tasks, blocking controls (material first, then catalogue weighting), stale schedules. assigned_to_me narrows to the caller.
offsetNoPagination offset — number of results to skip (default 0) Used by: audit_log.
org_idNoOrganization UUID — obtain from scf_list_organizations Used by: get, settings, members, audit_log, change_cursor, work_queue.
scf_idNoFilter by SCF control ID in DOMAIN-NN format Used by: audit_log.
date_toNoInclude changes at or before this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log.
actor_idNoFilter by actor user UUID — platform alias of changed_by_user_id Used by: audit_log.
date_fromNoInclude changes at or after this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log.
entity_idNoFilter by the changed entity's UUID Used by: audit_log.
request_idNoFilter by request correlation ID — groups every change one API call made Used by: audit_log.
entity_typeNoFilter by exact entity type as written in the log, e.g. scoped_control, evidence_file, audit_engagement, vendor — unsure of the spelling? use search_text Used by: audit_log.
search_textNoCase-insensitive search across entity_type, field_name, old_value and new_value Used by: audit_log.
action_sourceNoFilter by origin of the change: ui, api_key, mcp or system Used by: audit_log.
assigned_to_meNoOnly items owned by or assigned to the caller (default false) Used by: work_queue.
changed_by_user_idNoFilter by the user who made the change — obtain from scf_list_members Used by: audit_log.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv4.1.0

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered and the description carries a lower burden. What remains undisclosed is genuinely useful context the description could have supplied: that most methods require an org_id obtained elsewhere, that audit_log is append-only and filter-heavy, that change_cursor is a cheap polling probe to run before re-pulling the log, and the viewer-role requirements — all of which appear only in the schema's method enum, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the verb and resource, and the enumeration of methods is the right way to signal scope in minimal space. It is not padded, though 'Pick with method' is filler that could have been spent on real selection guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter, seven-method multiplexer with no output schema, the definition is only adequate: the schema does the heavy lifting on parameter applicability and per-method return content, and readOnlyHint covers safety. An agent can invoke it correctly, but the description itself gives no picture of what to expect back from each method or how to sequence calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter is annotated with its purpose and which method consumes it ('Used by: audit_log', etc.), so the baseline of 3 applies. The description contributes essentially nothing beyond naming 'method' as the selector, adding no format, default, or interaction detail over what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Read organization data') and then enumerates the seven resource views covered (list, one org, settings, members, audit log, change cursor, work queue), which lets an agent tell this apart from read siblings like scf_user_read or scf_evidence_read. It stops short of naming any sibling or stating the boundary against scf_update_org_settings, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pick with method' only tells the agent that the method enum is the selector; it gives no guidance on which method to choose for a given intent, no ordering advice (the 'list first to get org_id' pattern lives only in the schema), and no when-not or alternative-sibling routing. The agent must open the schema to learn anything actionable about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.