Skip to main content
Glama
Sign In
mcp-server-scf

mcp-server-scf

by MarkAC007
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

scf_vendor_read

Read-only

Read third-party vendor risk data—vendor lists, details, research, AI assessments, certifications, compensating controls, and action items—by selecting the needed method and organization.

Instructions

Read third-party risk data: list vendors, one vendor, its research, assessments (list, one, latest, status), certifications, compensating controls, action items. Pick with method.

Input Schema

NameRequiredDescriptionDefault
pageNo1-indexed page number (default 1) Used by: list.
methodYeslist: List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated. get: Get one vendor's detail: certifications, assessments, computed risk score, and latest research results. research: Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research. list_assessments: List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record. assessment: Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources. latest_assessment: Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet. assessment_status: Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment. certifications: List a vendor's certifications (read — viewer role): name, issuing body, certificate number, status, issue and expiry dates, scope and verification URL. compensating_controls: List compensating controls recorded against a vendor's gaps (read — viewer): gap, offsetting control, effectiveness, notes. For the org's own controls use scf_list_org_compensating_controls. action_items: List remediation action items for one vendor, or across every vendor when vendor_id is omitted (read — viewer role). Filter by status or priority.
org_idYesOrganization UUID — obtain from scf_list_organizations
statusNoLifecycle status filter — one of: prospect, active, under_review, approved, suspended, offboarded [list] | Filter by status [action_items] Used by: list, action_items.
per_pageNoPage size (1–100, default 25) Used by: list.
priorityNoFilter by priority Used by: action_items.
vendor_idNoVendor UUID — obtain from scf_list_vendors [get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls] | Vendor UUID — omit to list action items across all vendors [action_items] Used by: get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls, action_items.
criticalityNoCriticality tier filter Used by: list.
assessment_idNoAssessment UUID — obtain from scf_list_vendor_assessments or the trigger response [assessment] | Assessment UUID — returned by scf_trigger_vendor_assessment [assessment_status] Used by: assessment, assessment_status.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv4.1.0

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true already supplied, the description adds essentially no behavioral context beyond what annotations and schema cover — no mention of pagination behavior, 404 conditions, permission requirements, or freshness of research results. Its only contribution is a resource inventory that duplicates the method enum descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two terse sentences, front-loaded with purpose and then the resource list; nothing is padded or redundant. The dense parenthetical list is compact at the modest cost of readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a ten-method multiplexed read tool with no output schema, the description at least enumerates the full method surface, and the schema fills in per-method semantics. However it does not describe return shapes, pagination handling, or the polling relationship to the trigger tools, leaving gaps for an agent that never reads the full enum text.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the method enum documents each of the ten options in detail, so the baseline of 3 applies. The description's only parameter-related content is "Pick with method," which restates the schema rather than adding syntax, defaults, or cross-parameter constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("Read third-party risk data") and enumerates the sub-resources covered (vendors, research, assessments, certifications, compensating controls, action items), so an agent can tell this is the TPRM read surface rather than a write tool. It stops short of naming scf_vendor_write or other siblings as alternatives, so it falls just below 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Pick with method" points the agent at the required method parameter as the routing mechanism, which is implied usage guidance. There is no explicit when-to-use/when-not, no pointer to scf_vendor_write for mutations, and no note on sequencing (e.g. poll after triggers) despite such ordering existing in the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools