Skip to main content
Glama
MarkAC007

mcp-server-scf

by MarkAC007

scf_update_org_settings

Update organization profile fields and maturity targets, changing only the passed values. Set business size, mission statement, or SCF domain maturity levels for compliance planning.

Instructions

Update the organization profile and maturity targets (write — admin): business_size, mission_statement, maturity_targets. Partial: only passed fields change.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization UUID — obtain from scf_list_organizations
business_sizeNoBusiness size, which picks the matching row of each control's right-sizing guidance: micro_small, small, medium, large, enterprise; null clears
maturity_targetsNoTarget maturity per SCF domain code (domain code → L0–L5), e.g. {"GOV": "L3"}. Replaces the whole map; {} clears every target. Unknown domain codes, or one code given twice in different case, are refused (422). A control's own target (scf_set_target_maturity) overrides its domain's
mission_statementNoMission statement (up to 4000 chars); blank or null clears

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv3.7.2

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnlyHint=false and destructiveHint=false. The description adds two things annotations cannot: it is an admin-gated write, and it is a partial update where only passed fields change — important behavior for a PATCH-style call. It stops short of describing the clear/replace semantics of null and {} values, which the schema carries instead.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, zero filler. The operation, the scope of writable fields, the admin gate, and the partial-update contract are all front-loaded before any detail is deferred to the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should ideally say something about what a successful update returns or whether it echoes the new settings. It covers fields, partial semantics, and the admin gate, and safety is handled by annotations, so the gap is small but present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter in depth (enum values, 4000-char limit, whole-map replacement rules, 422 on unknown domain codes). The description only echoes the three field names, adding little beyond that. With coverage this high, it does what is expected and no more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (update) and resource (organization profile and maturity targets) and enumerates the exact writable fields: business_size, mission_statement, maturity_targets. An agent can immediately distinguish this from the read-side sibling scf_get_org_settings and from scf_set_target_maturity (per-control targets).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The '(write — admin)' tag signals a permission precondition, which is useful for deciding whether the agent can call it at all. However, it gives no when-to-use vs when-not guidance and never names the obvious alternative, scf_set_target_maturity, for per-control targets — that precedence rule lives only in the parameter schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools