mcp-server-scf
mcp-server-scf
Controles de cumplimiento de seguridad, marcos de trabajo y gestión de riesgos para agentes de IA.
Dale a tu asistente de IA acceso a 1,451 controles de seguridad SCF, más de 354 mapeos de marcos de trabajo (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR), seguimiento de evidencias, registros de riesgos y gestión de riesgos de proveedores, todo a través del Model Context Protocol.
Construido para la SCF Controls Platform. Mantenido por ComplianceGenie.io.
🆕 La plataforma ahora es software de código abierto y autohospedado. La SCF Controls Platform — herramientas GRC nativas de SCF para el contenido gratuito de Secure Controls Framework — se publica bajo AGPL-3.0 en scf-controls-platform-oss. Las empresas la descargan y la alojan ellas mismas mediante Docker Compose.
¿Tienes problemas? → docs/troubleshooting.md · Configuración de la clave API → docs/authentication.md · Cómo funciona → docs/architecture.md
Descripción general
mcp-server-scf conecta asistentes de IA con la SCF Controls Platform a través de MCP, lo que permite la interacción en lenguaje natural con tu programa de cumplimiento. Tu IA puede explorar el catálogo completo de controles SCF, realizar un seguimiento del progreso de implementación, gestionar la recopilación de evidencias, evaluar riesgos y supervisar proveedores externos, todo sin salir de tu editor o chat.
135 herramientas en 12 dominios: haz clic para ver las tablas de parámetros completas y los ejemplos de prompts:
Dominio | Herramientas | Descripción |
6 | Explora 1,451 controles, más de 354 marcos de trabajo y 5,736 objetivos de evaluación | |
6 | Realiza un seguimiento del estado de implementación en un flujo de trabajo de 8 estados | |
26 | Gestiona la recopilación de evidencias, la validación, la puntuación de madurez, las evaluaciones de IA por ventanas de tiempo y los resúmenes compuestos de controles | |
12 | Matriz de riesgos 5x5, registro de riesgos, riesgos personalizados y mapeo de controles | |
11 | Registro de proveedores, investigación de seguridad con IA, evaluaciones de IA asíncronas (sustituye a DPSIA) | |
7 | Usuarios, organizaciones, pista de auditoría, cola de trabajo, notificaciones | |
14 | Temas KSI, cuadros de mando, postura de evidencias, inventario de sistemas, catálogo de sistemas y recetas de IA | |
6 | Endpoints de webhook, registros de entrega, rotación de secretos | |
15 | Generación de documentos ISMS, edición de secciones, resolución de fusiones, transiciones del ciclo de vida, exportación | |
16 | Espacios de trabajo de compromisos, alcance congelado, presentación nativa de marcos, acceso para auditores, consultas estructuradas | |
9 | Previsualiza, decide, aplica y revierte una actualización de versión del catálogo SCF para tu organización | |
7 | Mapeo de documentos de cumplimiento: mapa de cobertura del corpus, cola de revisión de propuestas, búsqueda de pasajes |
Related MCP server: Fianu Compliance Intelligence MCP Server
Pruébalo con MCP Inspector
Ponlo a prueba sin añadir el servidor a un cliente: MCP Inspector lanza una interfaz local que inspecciona cada herramienta, su esquema y su descripción:
npx @modelcontextprotocol/inspector npx -y mcp-server-scfInspector se abre en http://localhost:6274 y se conecta a mcp-server-scf a través de stdio. Verás las 135 herramientas, agrupadas por dominio, con sus esquemas Zod representados como un formulario en vivo.
Las llamadas en vivo a las herramientas necesitan la URL de tu instancia y una clave API: exporta SCF_API_URL y SCF_API_KEY en la misma terminal antes de lanzar Inspector, o configúralas en la pestaña "Environment Variables" dentro de la interfaz de Inspector. Sin ellas, aún puedes explorar esquemas y descripciones; las llamadas a herramientas devuelven un error de configuración.
Inicio rápido
1. Autohospeda la plataforma y obtén una clave API
La SCF Controls Platform es un software de código abierto que tú mismo alojas; no requiere registro. Despliégalo desde scf-controls-platform-oss (una pila de Docker Compose con PostgreSQL, Redis y MinIO incluidos) y luego:
Establece una
API_KEYen el.envde la plataforma (genera una conopenssl rand -hex 32), o crea una clave en Settings → API Keys una vez que la aplicación esté en ejecución.Anota la URL de API de tu instancia:
http://localhost:8000por defecto, o tu host desplegado.
Usa esa clave como SCF_API_KEY y la URL de la instancia como SCF_API_URL (consulta Configuración).
2. Instalación — con un clic
Elige la vía para tu cliente.
Claude Desktop — la vía de un clic es la extensión de escritorio .mcpb firmada que aparece a continuación. Claude Desktop no registra un esquema de URL personalizado, por lo que no hay un enlace profundo en el que se pueda hacer clic; en su lugar, arrastra el .mcpb a Settings → Extensions y pega tu clave API una vez. Consulta el problema de seguimiento en anthropics/claude-code#26952.
Cursor — haz clic en la insignia de abajo. Cursor registra el esquema cursor://, por lo que el enlace profundo abre el IDE con la configuración del servidor ya rellenada:
Tras la instalación, edita el SCF_API_URL pre-rellenado para que apunte a tu instancia; no hay un valor predeterminado alojado.
Smithery — despliegue alojado y gestionado:
¿Prefieres editar la configuración a mano, o estás en un cliente sin enlace profundo (Windsurf, Docker)? Consulta 3. Configuración manual a continuación.
Extensión de Claude Desktop (.mcpb)
Para Claude Desktop ≥ 0.11.0, la instalación más sencilla es un paquete .mcpb firmado: sin edición de JSON, sin tiempo de ejecución de npx, sin necesidad de Node en el host:
Descarga
mcp-server-scf-<version>.mcpbdesde la última versión de GitHub.Haz doble clic en el archivo (o arrástralo a Claude Desktop → Settings → Extensions).
Cuando se te solicite, pega tu clave API
scf_…. Se almacena en el llavero de tu sistema operativo, no en un archivo de configuración.Claude Desktop reinicia el servidor y las 135 herramientas están disponibles.
Para desinstalar o actualizar la clave API más tarde: Settings → Extensions → SCF Controls Platform → Configure.
3. Configuración manual
Claude Desktop — edita ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) o %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"scf": {
"command": "npx",
"args": ["-y", "mcp-server-scf"],
"env": {
"SCF_API_KEY": "your_api_key_here",
"SCF_API_URL": "http://localhost:8000"
}
}
}
}Claude Code:
claude mcp add scf -- npx -y mcp-server-scf
export SCF_API_KEY="your_api_key_here"
export SCF_API_URL="http://localhost:8000"Cursor / Windsurf — la misma estructura JSON que Claude Desktop en .cursor/mcp.json (o la ruta equivalente de Windsurf).
Docker:
{
"mcpServers": {
"scf": {
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "SCF_API_KEY", "-e", "SCF_API_URL", "markac007/mcp-server-scf"],
"env": {
"SCF_API_KEY": "scf_your_api_key_here",
"SCF_API_URL": "https://scf.your-domain.example"
}
}
}
}Configuración
Variable | Obligatoria | Valor por defecto | Descripción |
| Sí | — | Clave API de tu instancia de plataforma autohospedada |
| Sí | — | URL base de tu plataforma autohospedada (p. ej. |
Ejemplos de prompts
Una vez conectado, prueba a pedirle a tu asistente de IA:
"¿Qué controles NIST 800-53 se aplican al control de acceso?"
"Muéstrame el progreso de implementación de controles de mi organización."
"Enumera todos los proveedores críticos y sus puntuaciones de riesgo."
"Crea una evaluación de riesgos para nuestra migración a la nube."
"¿Qué evidencias necesito recopilar para la auditoría SOC 2?"
"Muestra la matriz de riesgos 5x5 de mi organización."
"Ejecuta un DPSIA sobre nuestro proveedor de servicios en la nube."
Hay más ejemplos en cada documento por dominio en docs/tools/.
Documentación
docs/authentication.md — configuración de la clave API, rotación, configuración de URL autohospedada, ámbitos.
docs/architecture.md — flujo de solicitudes, modelo de errores, límite de velocidad, qué hace y qué no hace el servidor.
docs/troubleshooting.md — síntoma/causa/solución para los modos de fallo más comunes.
docs/tools/ — referencia por dominio con tablas de parámetros completas.
Seguridad
Las claves de API nunca se registran ni se incluyen en los mensajes de error.
Las claves se someten a un hash SHA-256 en el servidor. Usa HTTPS para cualquier instancia accesible más allá de localhost.
Límite de peticiones: 100 req/min de lectura, 20 req/min de escritura.
Multiinquilino — todas las operaciones se limitan a tu organización.
Paquete npm publicado con atestación de procedencia mediante publicación de confianza OIDC.
La CI incluye detección de secretos con Gitleaks, análisis con CodeQL y SAST con Semgrep.
Consulta SECURITY.md para notificar una vulnerabilidad.
Desarrollo
git clone https://github.com/MarkAC007/mcp-server-scf.git
cd mcp-server-scf
npm install
npm run build
npm run dev # Watch mode
npm run lint # ESLint
npm test # VitestPruebas con MCP Inspector
SCF_API_KEY=scf_your_key npx @modelcontextprotocol/inspector node build/index.jsContribuciones
¡Las contribuciones son bienvenidas! Lee CONTRIBUTING.md antes de enviar PRs.
Este proyecto sigue el Contributor Covenant — consulta CODE_OF_CONDUCT.md. Al participar, se espera que cumplas este código.
Haz un fork del repositorio
Crea tu rama de funcionalidad (
git checkout -b feature/amazing-feature)Haz commit de tus cambios (
git commit -m 'Add amazing feature')Sube los cambios a la rama (
git push origin feature/amazing-feature)Abre un Pull Request
Licencia
MIT — consulta LICENSE.
Enlaces
scf-controls-platform-oss — la plataforma autohospedada de código abierto (AGPL-3.0)
ComplianceGenie.io — mantenedor
Model Context Protocol — especificación de MCP
SCF Framework — Secure Controls Framework
npm Package — registro npm
Changelog — historial de versiones
Available Tools
26 toolsscf_assessment_readBRead-only
Read AI evidence assessments: a file's verdict, the file summary, review queues, window assessments (list, one, versions, summary), and control composites. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | No | file (default): entries carry file_id, act with scf_review_evidence_assessment. window: entries carry window_assessment_id, act with scf_review_window_assessment_verdict Used by: review_queue. | |
| limit | No | Page size (1–200, default 50) [review_queue] | Page size (1–100, default 10) [list_windows] | Page size (1–500, default 100) [list_control_composites] Used by: review_queue, list_windows, list_control_composites. | |
| cursor | No | Opaque pagination cursor — pass next_cursor from a prior response Used by: list_control_composites. | |
| domain | No | Filter by SCF domain code (e.g., 'BCD', 'GOV', 'AST') Used by: list_control_composites. | |
| method | Yes | file_assessment: Get the AI assessment for an evidence file: status, relevance score (0–100), findings, summary, audit metadata (model, tokens, cost). Findings name catalogue-mapped controls, not only in-scope ones. file_summary: Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents. review_queue: List AI verdicts awaiting a human decision, worst first (read — viewer role). tier=file (default) lists per-file verdicts; tier=window is the web app's Awaiting-confirmation queue. list_windows: List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost. window: Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost. window_versions: List every AI verdict a window assessment has received, newest first (read — viewer role). Each version is frozen as reached (model, prompt version, designations) plus any human decision on it. window_summary: Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including `insufficient_sample`), average relevance score, and total cost in cents. control_composite: Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async). list_control_composites: List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward. | |
| offset | No | Pagination offset (default 0) [review_queue] | Pagination offset — number of results to skip (default 0) [list_windows] Used by: review_queue, list_windows. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') Used by: control_composite. | |
| status | No | Queue filter (default awaiting) [review_queue] | Comma-separated composite_status values to include (e.g., 'insufficient,partial'). Valid values: insufficient, insufficient_sample, partial, pending, no_evidence, sufficient [list_control_composites] Used by: review_queue, list_control_composites. | |
| file_id | No | Evidence file UUID — obtain from scf_list_evidence_files Used by: file_assessment. | |
| evidence_id | No | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence [file_assessment] | Evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence [list_windows] Used by: file_assessment, list_windows. | |
| assessment_id | No | Windowed assessment UUID — obtain from scf_list_window_assessments [window] | Window assessment UUID — obtain from scf_list_window_assessments [window_versions] Used by: window, window_versions. | |
| computation_version | No | Restrict to composites computed at this algorithm version Used by: list_control_composites. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with readOnlyHint=true and adds scope by listing the assessment types covered. However, it does not add behavioral context such as role requirements, async composite availability, or pagination behavior beyond what annotations and schema already provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted wording, and it efficiently lists the supported assessment categories. The ending "Pick with method" is terse but functional, though the sentence could better structure the method-selection instruction.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-method, 13-parameter polymorphic read tool, the description is minimal and relies heavily on the detailed method enum in the schema. It gives enough orientation to select the tool, but it does not explain return shapes or method-specific behavior at the top level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameter meanings are already fully documented in the input schema. The description adds only the high-level instruction to select behavior with method, which is useful but already reflected in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific read operation for AI evidence assessments and enumerates the main assessment categories: file verdict, file summary, review queues, window assessments, and control composites. It is clearly distinct from a write tool, though it does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "Pick with method" gives essential dispatch guidance for a polymorphic tool, but it does not explain when to use this tool versus related read tools or when each method is appropriate. The detailed method guidance lives in the schema rather than in the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_assessment_writeA
Run and review AI evidence assessments (editor+, async): assess a file or many, assess a window or many, refresh stale windows, confirm or override verdicts, set window acceptance.
| Name | Required | Description | Default |
|---|---|---|---|
| ewa_id | No | Window assessment UUID — obtain from scf_list_window_assessments Used by: review_window. | |
| method | Yes | assess_file: Queue an AI assessment of one evidence file (write — editor+, async); poll scf_get_evidence_assessment. Judged against the catalogue's mapped controls, which may include controls not in scope. assess_files_bulk: Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued. review_file_verdict: Record a human decision on a file's current AI assessment (write — editor role). confirmed keeps the verdict; overridden needs a reason and at least one objective re-designation. assess_window: Queue a windowed AI assessment of every file in the item's frequency window as one portfolio (write — editor+, async). 422 without tracking/frequency. Judged against catalogue-mapped controls. assess_windows_bulk: Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under `skipped_detail` in the response. refresh_stale_windows: Queue a fresh windowed AI assessment for every evidence item whose newest file postdates its last assessment (write — editor role). Capped per run; returns how many were queued. review_window: Set a windowed assessment's acceptance review (write — editor): approved, rejected (raises a deficiency per in-scope control), needs_revision, or not_reviewed to revoke. review_window_verdict: Confirm or override a window's current AI verdict (write — editor role). overridden needs a reason and ≥1 objective re-designation. One decision per version; 422 without objectives: confirm. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| reason | No | Why the verdict is overridden — required when decision is overridden Used by: review_file_verdict, review_window_verdict. | |
| file_id | No | Evidence file UUID — obtain from scf_list_evidence_files Used by: assess_file, review_file_verdict. | |
| decision | No | confirmed = AI verdict stands; overridden = you are changing it Used by: review_file_verdict, review_window_verdict. | |
| file_ids | No | Specific evidence file UUIDs to assess Used by: assess_files_bulk. | |
| evidence_id | No | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence [assess_file] | Evidence ID — assesses every file under this evidence item [assess_files_bulk] | Catalog evidence ID the file belongs to, e.g. E-IAM-01 [review_file_verdict] | Evidence ID (e.g., 'E-IAM-01'). Tracking row with a frequency must exist — set via scf_update_evidence first [assess_window] Used by: assess_file, assess_files_bulk, review_file_verdict, assess_window. | |
| ao_overrides | No | Objectives to re-designate — required (≥1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation. 422 if the version has no per-objective answers: confirm instead Used by: review_file_verdict, review_window_verdict. | |
| evidence_ids | No | Evidence IDs to assess (e.g., ['E-IAM-01','E-BCM-11']); 1–25 per request Used by: assess_windows_bulk. | |
| review_notes | No | Reviewer notes Used by: review_window. | |
| assessment_id | No | Window assessment UUID — obtain from scf_get_assessment_review_queue (window_assessment_id) or scf_list_window_assessments Used by: review_window_verdict. | |
| review_status | No | Review state to set; not_reviewed revokes Used by: review_window. | |
| assess_unassessed | No | Also assess every file that has no existing assessment (default false) Used by: assess_files_bulk. | |
| assessment_source | No | Origin tag for the request (default on_demand) Used by: assess_file, assess_window. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=false; the description adds the editor+ role requirement and the async/queued nature, which the annotations do not cover. It omits the more consequential behaviors — that rejecting a window raises deficiencies, that verdict decisions are version-bound, that bulk calls cap at 50/25 — leaving those to the schema. Notably, 'rejected raises a deficiency per in-scope control' is a side effect sitting under destructiveHint=false, but that disclosure exists in the schema rather than contradicting the description text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that compresses eight dispatch methods into parallel clauses ('assess a file or many, assess a window or many'), with no wasted words and the permission/async qualifier placed high.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 15-parameter polymorphic dispatcher with no output schema, the description is thin: it never states that exactly one method must be chosen and that required parameters vary by method, nor what each method returns (counts, skipped_detail, poll targets). The schema carries most of that load, so the definition is workable, but the top-level description does not fully prepare an agent for method dispatch.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the enum descriptions already tag each parameter with its applicable method ('Used by: ...'), including prerequisites and 422 conditions. The description contributes no parameter semantics beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Run and review AI evidence assessments') and enumerates the eight concrete operations (assess file/window, bulk, refresh stale, confirm/override verdicts, set acceptance). The '(write)' title and the tool name separate it from scf_assessment_read, though the description never names that read sibling as the alternative, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'(editor+, async)' tells the agent the required role and that operations are queued rather than synchronous, which is real selection context. However, no when-to-use guidance appears in the description itself — the per-method routing (which method to pick, what to poll afterward, when to skip) lives entirely in the schema's enum descriptions, so the description alone only implies usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_capability_theme_readBRead-only
Read capability themes (KSIs): list themes, one theme, the multi-axis scorecard, per-theme evidence posture, or the controls mapped to a theme. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results per page (1–200, default 50) Used by: controls. | |
| method | Yes | list: List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view. get: Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage. scorecard: Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands. evidence_posture: Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards. controls: List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down. | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: controls. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| theme_code | No | Capability theme code (e.g., 'ACCESS_CONTROL', 'INCIDENT_RESPONSE') — obtain from scf_list_capability_themes [get] | Capability theme code (e.g., 'ACCESS_CONTROL') — obtain from scf_list_capability_themes [controls] Used by: get, controls. | |
| scope_status | No | Filter by scoping status (default: in_scope) Used by: controls. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already establishes the safety profile, so the description only needs to add depth. It hints at return content for each mode (multi-axis scorecard, per-theme evidence posture) but says nothing about pagination behavior, cost of the scorecard mode, or how bands/confidence values are derived. Adequate but thin given annotations already cover safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence lists the five modes, followed by a short imperative on how to choose among them. Nearly every clause earns its place, though 'Pick with method' is terse to the point of being cryptic for a first-time reader.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, a five-mode read tool needs to convey what comes back per mode; the description does so only at a high level and omits band semantics, evidence confidence meaning, and the fact that org_id originates from scf_list_organizations. It is passable because the method enum compensates, but the description alone is not self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the method enum already spells out each mode's output in detail, so the schema does the heavy lifting. The description only reinforces that method drives behavior; it adds no meaning about limit, offset, scope_status, or theme_code beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb (Read) plus resource (capability themes/KSIs) and enumerates the five result shapes: theme list, single theme, scorecard, evidence posture, and mapped controls. That distinguishes it well from sibling read tools such as scf_control_read, though it does not name any sibling outright and leaves the 'KSI' acronym unexplained.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' is the only routing guidance, telling the agent that mode selection is done via the method parameter. It does not say when to prefer this tool over scf_control_read or scf_assessment_read, nor does it warn which modes require theme_code, leaving that to the schema's per-value 'Used by' notes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_catalog_readBRead-only
Read the SCF reference catalog (no org): controls, one control with its objectives and evidence, domains, frameworks, assessment objectives, evidence definitions. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Page size (1–100, default 25) Used by: list_controls, list_assessment_objectives, list_evidence. | |
| domain | No | SCF domain code (e.g., 'GOV', 'AST', 'IAC') — obtain from scf_list_domains Used by: list_controls. | |
| method | Yes | list_controls: List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search. get_control: Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog. list_domains: List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control). get_domain: Get one SCF domain with its controls (read, no org). Deprecated controls are excluded unless include_deprecated is set; a deprecated domain still resolves, badged. list_frameworks: List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names. list_assessment_objectives: List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination. list_evidence: List the SCF reference catalog's 272 evidence types (read, no org). control_mappings is the catalogue-wide mapping, not scope — see scf_get_evidence_requiring_controls. Free-text search, pagination. get_evidence: Get one catalog evidence entry (read, no org): title, description, area of focus, control_mappings — the catalogue-wide mapping, not scope. In-scope requirers: scf_get_evidence_requiring_controls. | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: list_controls, list_assessment_objectives, list_evidence. | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'IAC-15', 'GOV-02') Used by: get_control. | |
| search | No | Free-text filter applied to control title and description [list_controls] | Free-text filter applied to objective text [list_assessment_objectives] | Free-text filter applied to evidence title and description [list_evidence] Used by: list_controls, list_assessment_objectives, list_evidence. | |
| framework | No | Framework slug (e.g., 'nist-800-53', 'iso-27001') — obtain from scf_list_frameworks Used by: list_controls. | |
| control_id | No | Limit to one SCF control in DOMAIN-NN format (e.g., 'GOV-01', 'AST-02') Used by: list_assessment_objectives. | |
| identifier | No | Domain code or slug, e.g. 'IAC' — obtain from scf_list_domains Used by: get_domain. | |
| evidence_id | No | Catalog evidence ID, e.g. E-IAM-01 — obtain from scf_list_evidence_catalog Used by: get_evidence. | |
| include_deprecated | No | Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included. [list_controls, list_domains, list_assessment_objectives, list_evidence] | Include deprecated controls (default false) [get_domain] Used by: list_controls, list_domains, get_domain, list_assessment_objectives, list_evidence. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already declares the safety profile, so the description's main contribution is the catalog-versus-org scoping note and the hint that a single-control read returns objectives and evidence. It does not disclose pagination behavior, result caps, or deprecated-row handling beyond what the schema enumerates. Useful but not rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the resource and scope front-loaded and the operation list following. Every clause maps to real functionality. It is dense list-style prose but has no filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter, eight-method multiplexed tool with no output schema, the description is thin; most of the actionable detail lives in the method enum descriptions rather than the top-level description. It is adequate because the schema compensates, but the description alone would not tell an agent enough about method-specific behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, including per-method descriptions and per-parameter 'Used by' mappings, so the schema carries parameter semantics. The description adds the dispatch pattern ('Pick with method') but no parameter format or constraint detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Read the SCF reference catalog') and enumerates the object types available (controls, single control with objectives/evidence, domains, frameworks, assessment objectives, evidence definitions). The '(no org)' qualifier is a meaningful scope distinction against the org-scoped sibling tools, though no sibling is named explicitly and the agent must infer that scf_control_read / scf_evidence_read are the org-scoped counterparts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' tells the agent how the operation is selected but gives no when-to-use versus when-not guidance, and no explicit routing to the sibling read tools for org-scoped data. The '(no org)' hint implies the alternative exists without stating it, leaving usage selection to inference from the name and the method enum.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_control_readARead-only
Read the organization's control scope: list scoped controls with filters, one control in full, scoping stats, framework scope summary, or preview a framework scope change. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Order: 'scf_id' (default), or 'weighting' — material controls first, then catalogue weighting highest first, then scf_id. Rows also carry target_maturity, target_source (control | domain), target_maturity_reason, procedure_document_id, procedure_document_status, last_validated_at, last_validated_by and last_validation_note Used by: list. | |
| basis | No | Filter by obligation basis: 'mcr', 'dsr', or 'unclassified' (no classified framework and no override). Each row carries obligation_basis, basis_source (override | framework) and basis_override_reason Used by: list. | |
| limit | No | Page size (1–200, default 50) Used by: list. | |
| domain | No | SCF domain code (e.g., 'GOV', 'AST', 'IAC') Used by: list. | |
| method | Yes | list: List controls scoped to the organization with status, basis, target maturity, materiality, procedure and last validation. Filter by scope, domain, framework, team, basis, material. Paginated. get: Get one scoped control: owner, notes, scope/basis/target/material overrides with reason, set_at and set_by, procedure_document_id, last validation. Identify by scf_id, not UUID. stats: Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown. framework_scope: Get framework coverage and selection state (read — viewer): each framework's coverage, basis, obligation_type and obligation_source, and basis_counts (in-scope controls by mcr/dsr/unclassified). preview_framework_change: Preview adding or removing frameworks WITHOUT applying it (read — viewer): controls entering or leaving scope, orphaned evidence, and on remove basis_downgrades (controls whose basis weakens). | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: list. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID Used by: get. | |
| search | No | Free-text filter applied to control ID, name, or description Used by: list. | |
| team_id | No | Filter to controls this team is assigned to, accountable or consulted — obtain from scf_list_teams Used by: list. | |
| material | No | Filter by materiality: true for material controls (catalogue weighting 10, or an admin override), false for the rest. Rows carry material, material_source (control | weighting) and material_reason Used by: list. | |
| my_teams | No | Filter to controls assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead. Used by: list. | |
| framework | No | Framework slug (e.g., 'nist-800-53') to filter mapped controls Used by: list. | |
| operation | No | 'add' to preview scoping these frameworks in, 'remove' to preview taking them out Used by: preview_framework_change. | |
| frameworks | No | Framework slugs to model — obtain from scf_list_frameworks Used by: preview_framework_change. | |
| function_id | No | Filter to controls assigned to any team aligned to this function — obtain from scf_list_functions Used by: list. | |
| csf_function | No | NIST CSF function: 'GOVERN', 'IDENTIFY', 'PROTECT', 'DETECT', 'RESPOND', or 'RECOVER' Used by: list. | |
| scope_status | No | Scope filter: 'in_scope' (selected), 'out_of_scope' (deselected), or 'all' (default — everything) Used by: list. | |
| control_weighting | No | Weighting threshold on a 0–10 scale Used by: list. | |
| accountable_owner_type | No | Filter by the accountable team's primary owner: 'internal' or 'external_contractor' Used by: list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and 'Read' is consistent with that. The description flags that preview_framework_change is non-mutating by calling it a preview, but omits the important caveats (permission level for the preview/framework_scope modes, pagination semantics for list) that live only in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the resource first and the modes enumerated in the same order as the method enum, followed by the routing hint. Nothing is redundant or buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 20-parameter, five-mode multiplexed tool with no output schema, the description gives enough to understand the surface and select a mode, and the method enum carries the detailed per-mode behavior. It stops short of describing what list/stats return in any useful shape, but the schema shoulder most of that burden.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema is unusually explicit, including per-parameter 'Used by:' tags, so the baseline would be 3. The description adds a small amount by pairing each mode name with the data it returns, but contributes no syntax or constraints beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource ('Read the organization's control scope') and enumerates all five modes the method parameter selects (list, get, stats, framework_scope, preview). An agent can tell this is the read-side counterpart to scf_control_write, though it never names that sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' is the only routing instruction, and it defers entirely to the method enum's schema text for when to choose each mode. There is no when-not guidance and no mention of alternatives outside the tool; usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_control_writeBDestructive
Change the organization's control scope (editor+; some methods admin): update or batch-update controls, scope or unscope a framework, set scope, basis, maturity, materiality or procedure overrides.
| Name | Required | Description | Default |
|---|---|---|---|
| basis | No | 'mcr' or 'dsr' to override; null clears the override (and its reason) so the basis is derived from the org's classified frameworks again [set_basis_override] | 'mcr' (mandatory compliance requirement) or 'dsr' (discretionary security requirement); null leaves it unclassified. Reclassifying MCR to DSR changes which exclusions need an approver, hence admin-only [set_framework_basis] Used by: set_basis_override, set_framework_basis. | |
| level | No | Target CMM level L0–L5 for this control; null clears the override (and its reason) and the control inherits its domain target Used by: set_target_maturity. | |
| owner | No | Accountable owner of the control Used by: update. | |
| action | No | 'include' pins the control in scope, 'exclude' pins it out, 'inherit' clears the override AND discards the recorded rationale (it stays in the audit trail) Used by: set_scope_override. | |
| method | Yes | update: Update a scoped control's implementation fields (write — editor+). Identify by scf_id. Only provided fields apply. Material controls: admin for not_applicable. at_risk raises a deficiency. batch_update: Batch-update up to 500 scoped controls in one transaction (write — editor+). Each operation targets an scf_id. Material/MCR controls: no deselect (409); at_risk raises a deficiency. scope_framework: Bulk-scope every control mapped to a framework into the organization (write — editor+ role). Creates a scoped-control entry for each control in the framework. unscope_framework: Unscope every control mapped only to these frameworks (destructive write — editor). Shared controls are kept. An MCR framework, or one taking out a material control, needs an admin and a reason. set_scope_override: Force one control in or out of scope (write — editor+). 'include'/'exclude' pin it; 'inherit' clears it. Excluding an MCR or material control needs an admin key and a reason (editors 403). set_basis_override: Override one control's derived obligation basis (write — ADMIN role): mcr or dsr with a reason, or null to clear and derive it from its frameworks again. 404 if the control has no scope record. set_framework_basis: Record why a scoped framework is in scope (write — ADMIN role): basis mcr|dsr, obligation_type and obligation_source. Replaces all three; null clears. Only an active (scoped) framework, else 404. set_target_maturity: Override one control's target maturity (write — ADMIN role): a level L0–L5 with a reason, or null to inherit its domain's target again (domain targets: scf_update_org_settings). set_materiality: Set whether one control is material (write — ADMIN's own key; a platform key gets 403): true/false with a reason, or null for the catalogue default (material at weighting 10). set_procedure: Link one control to its signed-off procedure document, or null to unlink (write — editor+). The document must be this org's procedure, approved or published when linked (400 otherwise). | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| reason | No | Why this control is being overridden — recorded in the audit trail (max 2000 characters). Required for 'exclude'. The admin making an MCR or material exclusion is recorded as its approver; there is no approver parameter [set_scope_override] | Why the derived basis is wrong for this control (max 2000 characters) — required when basis is set [set_basis_override] | Why this control departs from its domain target (max 2000 characters) — required when level is set [set_target_maturity] | Why (max 2000 characters). Required when material is true or false, and when a null clear makes a control weighted below 10 not material (400 otherwise) [set_materiality] Used by: set_scope_override, set_basis_override, set_target_maturity, set_materiality. | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID [update] | SCF control identifier in DOMAIN-NN format — obtain from scf_list_scoped_controls [set_scope_override, set_basis_override, set_target_maturity, set_materiality, set_procedure] Used by: update, set_scope_override, set_basis_override, set_target_maturity, set_materiality, set_procedure. | |
| material | No | true or false overrides the catalogue default; null clears the override. The admin is recorded as the approver: deciding a control is not material lets it be excluded or marked not_applicable without one Used by: set_materiality. | |
| priority | No | Implementation priority: 'high', 'medium', or 'low' Used by: update. | |
| frameworks | No | Framework slugs to remove, e.g. ['iso_27017_2015'] — obtain from scf_list_frameworks Used by: unscope_framework. | |
| operations | No | Update operations to apply (1–500 per call) Used by: batch_update. | |
| assigned_to | No | Assignee responsible for implementation Used by: update. | |
| document_id | No | Procedure document UUID — obtain from scf_list_documents; null unlinks. A later edit sends the document back to review; the link stays and scf_list_scoped_controls shows procedure_document_status Used by: set_procedure. | |
| target_date | No | Target completion date in ISO-8601 (YYYY-MM-DD) Used by: update. | |
| framework_id | No | Framework slug to scope (e.g., 'nist-800-53-r5') — obtain from scf_list_frameworks [scope_framework] | Framework slug of a framework the org has scoped — obtain from scf_get_framework_scope_summary [set_framework_basis] Used by: scope_framework, set_framework_basis. | |
| maturity_level | No | Maturity level with L prefix: L0 Not Performed, L1 Performed, L2 Planned, L3 Well Defined, L4 Quantitatively Controlled, L5 Continuously Improving Used by: update. | |
| removal_reason | No | Why these controls leave scope — recorded in the audit trail. Required (400 without it), with an admin key (403 otherwise), when a framework carries an MCR obligation or its removal would take a material control out of scope Used by: unscope_framework. | |
| completion_date | No | Actual completion date in ISO-8601 (YYYY-MM-DD) Used by: update. | |
| obligation_type | No | Where the obligation comes from: statutory, regulatory, contractual or discretionary; omitted or null clears it Used by: set_framework_basis. | |
| selection_reason | No | Justification for scoping decision — required for not_applicable or deferred Used by: update. | |
| obligation_source | No | The law, regulation or contract behind it (max 2000 characters); omitted, null or blank clears it Used by: set_framework_basis. | |
| implementation_notes | No | Free-text implementation notes and context Used by: update. | |
| implementation_status | No | New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred. Moving to at_risk raises a deficiency (see scf_list_deficiencies). A material control (catalogue weighting 10, or set material by an admin) can only leave scope through scf_set_scope_override by an admin (other paths 409), and only an admin may mark it not_applicable (403 otherwise). Used by: update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so the write/destructive profile is covered. The description adds the authorization dimension (editor+ baseline, admin for some methods) which annotations do not carry. It does not itself disclose irreversibility, the audit-trail recording, or the 403/404/409 failure semantics — those live only in the schema text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the resource and permission level up front and the operation list after. It is dense but every clause maps to real capability; the only weakness is that the long comma-run of overrides is slightly harder to scan than a short bulleted mapping would be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a ten-method polymorphic mutation tool, the description covers purpose and role requirements but omits the single most important structural fact — that the tool is dispatched by a required `method` parameter. Given the very rich schema and the destructive annotation, the remaining gaps are tolerable, but an agent must open the schema to call it at all.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across 24 parameters, with per-parameter "Used by: <method>" tags that fully document the polymorphism, so the baseline of 3 applies. The description only restates the operation families and the role floor; it adds no meaning beyond the schema's own method/parameter mapping.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Change the organization's control scope") and then enumerates the concrete operations: update/batch-update controls, scope/unscope a framework, and the scope, basis, maturity, materiality and procedure overrides. An agent can map the ten schema methods onto these phrases. It stops short of naming when this is preferred over the sibling read tools, but the write/read naming pair makes that largely self-evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Adds permission gating ("editor+; some methods admin"), which is real usage context, but gives no criterion for choosing among the ten methods or for preferring this over scf_update_org_settings / scf_list_scoped_controls. The description never mentions the required `method` discriminator, so an agent reading only prose would not know operations are selected by a parameter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_custom_risk_readARead-only
Read organization-defined custom risks: list them, or list the controls linked to one. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | list: List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes. controls: List controls linked to a custom risk: catalog_control_ids, links (scf_id + document_id of the standard it is an exception against) and scoped_controls with implementation status. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| risk_code | No | Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks Used by: controls. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes the safety profile, so the description only needs to add scoping context. It confirms this read covers org-defined risks and their linked controls, but adds nothing about permissions, whether custom risks are mutable through this path, or output shape beyond what the schema's enum text already supplies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, with the resource and both modes front-loaded before the method hint. Nothing is repeated or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity read tool with a fully documented three-parameter schema and no output schema, the definition covers what is needed to call it. The one soft spot is that the conditional dependency of risk_code on the controls method is only implied by 'linked to one' and carried by the schema, not stated in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the method enum text is unusually rich (R-ORG-N codes, catalog_control_ids, links, scoped_controls with implementation status), so the baseline is 3. The description contributes 'list them, or list the controls linked to one', which paraphrases the enum semantics in task-oriented language and slightly clarifies intent beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (read) and resource (organization-defined custom risks) and enumerates both modes: listing risks or listing controls linked to one. It does not differentiate itself from scf_risk_read (static catalog risks) or scf_custom_risk_write, so an agent must infer that boundary from the name prefix alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' tells the agent that the method parameter selects the operation, and the two modes are named. However, there is no explicit when-to-use guidance against alternatives such as scf_risk_read or scf_custom_risk_write, nor a statement that the controls mode requires an existing risk_code.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_custom_risk_writeADestructive
Manage custom risks (editor+): create, update or delete a risk (destructive); add, update or remove a linked control. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Risk title (required, max 100 chars) [create] | New risk title (max 100 chars) [update] Used by: create, update. | |
| method | Yes | create: Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record. update: Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied. delete: Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible. add_control: Link a control to a custom risk (write — editor+), optionally with the document whose standard it is an exception against. Changing an accepted exception's links clears its approval. update_control: Set or clear the standard's document on a custom risk's control link (write — editor). A changed document clears an accepted exception's approval. remove_control: Unlink a control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed. Unlinking clears an accepted exception's approval. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control ID to link (e.g., 'AST-01') — obtain from scf_list_scoped_controls [add_control] | SCF control ID of an existing link — obtain from scf_list_custom_risk_controls [update_control] | SCF control ID to unlink (e.g., 'AST-01') — obtain from scf_list_custom_risk_controls [remove_control] Used by: add_control, update_control, remove_control. | |
| risk_code | No | Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks [update, delete, add_control, remove_control] | Custom risk code in R-ORG-N format — obtain from scf_list_custom_risks [update_control] Used by: update, delete, add_control, update_control, remove_control. | |
| description | No | Risk description (required) [create] | New risk description [update] Used by: create, update. | |
| document_id | No | Organisation document that sets the standard this risk is an exception against — obtain from scf_list_documents (404 if not this org's). A link with a document makes the custom risk a standards exception [add_control] | Organisation document whose standard this risk is an exception against (404 if not this org's), or null to clear. Required: the platform refuses a call without it (422) [update_control] Used by: add_control, update_control. | |
| category_name | No | Category label shown in UI (default 'Custom') [create] | New category label [update] Used by: create, update. | |
| category_color | No | Hex color for the category badge, e.g., '#6b7280' (default '#6b7280') [create] | New hex color for the category badge [update] Used by: create, update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so the description's "destructive" adds little; the real added value is the editor+ role gate. The deeper consequences (delete removes the assessment record and all control mappings; link changes clear an accepted exception's approval) live only in the method's schema entry, not the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the resource, the role requirement, and the operation groupings before the routing hint. Minor density cost from the parenthetical "(destructive)" sitting mid-clause, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter, six-method polymorphic write tool it correctly signals the method-dispatch pattern and the role gate, and the per-method parameter mapping is fully covered by the schema, so no output schema is needed. The only shortfall is the absence of any guidance on precedence between scf_custom_risk_write and scf_custom_risk_read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is documented per-method with format hints and provenance (e.g., obtain from scf_list_custom_risks), so the schema does the heavy lifting. The description only says to choose via method and contributes no additional field semantics, which is the baseline 3 case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific resource (custom risks) and enumerates the six concrete operations grouped into risk-level (create/update/delete) and control-link-level (add/update/remove) actions, which is well beyond restating the name. It stops short of naming the sibling read tool (scf_custom_risk_read) as the non-destructive alternative, so the write/read split is only inferable from the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Pick with method" gives a minimal dispatch cue and the "(editor+)" tag flags a permission prerequisite, but there is no explicit when-to-use vs. when-not guidance and no pointer to the read counterpart for fetching risks. An agent must open the schema to learn which method suits its intent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_evidence_file_readARead-only
Read an evidence item's files: list them, one file with its download URL, one file's validation result, or the organization's validation summary. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | list: List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry). get: Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact. validation: Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp. validation_summary: Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| file_id | No | Evidence file UUID — obtain from scf_list_evidence_files Used by: get, validation. | |
| evidence_id | No | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence Used by: list, get, validation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already establishes the safe-read profile, and the description is consistent with it, adding that results include download URLs and validation outcomes. It does not mention the 15-minute URL expiry, scope breadth, or any rate/consumption caveats, all of which sit only in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that enumerates the four modes and closes with the selection instruction — no filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only dispatcher with a fully documented schema and no output schema, the description is nearly complete for selection purposes. The only gap is that the mapping between modes and the optional file_id/evidence_id arguments is left entirely to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline of 3 applies. The description names the method as the discriminator but adds no format, dependency, or required-parameter-pairing detail beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (read) and resource (an evidence item's files) and enumerates the four concrete result shapes the caller can obtain. It is clearly distinguishable from scf_evidence_file_write by naming the read modes, though it does not explicitly contrast itself with scf_evidence_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Pick with method" signals that the enum is the selector, but the description itself gives no when-to-use criteria across the four modes or against the sibling evidence tools. The real guidance lives in the method enum's schema descriptions rather than in the description text.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_evidence_file_writeADestructive
Act on an uploaded evidence file (editor+): approve, reject or request revision; re-run validation; or soft-delete it (destructive). Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | review: Approve, reject or request revision on one uploaded file (write — editor). Rejecting raises a deficiency on each in-scope control it supports. 410 where per-window review is on. revalidate: Re-run the validation engine against an evidence file (write — editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result. delete: Soft-delete an evidence file (destructive write — editor role). The record is marked deleted and drops out of listings; the stored object is retained for audit and retention. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| file_id | Yes | Evidence file UUID — obtain from scf_list_evidence_files | |
| evidence_id | Yes | Catalog evidence ID the file belongs to, e.g. E-IAM-01 [review, delete] | Evidence ID (e.g., 'ERL-IAM-001') — obtain from scf_list_evidence [revalidate] | |
| review_notes | No | Reviewer notes Used by: review. | |
| review_status | No | Review decision Used by: review. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so the description's '(destructive)' label mostly restates structured data. It does add the editor+ authorization requirement, which is genuine added context, but it says nothing about what review/revalidate return or about side effects like deficiencies being raised (that detail lives only in the schema).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that lists the operations and ends with the dispatch instruction. No filler, no restatement of the title, and the destructive element is called out inline.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter, 3-mode write tool with no output schema, the description covers all modes and the required role. It does not explain return values or the mode-specific edge cases (e.g. the 410 per-window review case), but those are documented in the schema, so nothing critical is missing at the description layer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including the method enum is already fully documented in structured data. The description's only contribution is signaling that 'method' is the discriminator, which is minimal added meaning over the enum descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete verb and resource ('Act on an uploaded evidence file') and enumerates the three actions it covers: approve/reject/request revision, re-run validation, and soft-delete. That is enough to separate it from the read sibling scf_evidence_file_read, though it never names that sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent is told to 'Pick with method' and given the list of operations, but there is no explicit when-to-use/when-not guidance or any routing statement versus scf_evidence_task_write or scf_evidence_write. The role hint '(editor+)' gives a precondition but not a selection rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_evidence_readBRead-only
Read evidence tracking: list records, one record with its in-scope requiring controls, requiring controls alone, gaps, health, upcoming, frequency health, maturity and upgrade guidance, suggestions.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Look-ahead window in days (1–90, default 14) Used by: upcoming. | |
| method | Yes | list: List the organization's evidence tracking records: tracking status, maturity, owner, system, file count, required_by_scope. Names no controls — use scf_get_evidence_requiring_controls for those. get: Get one evidence tracking record (read) plus required_by_in_scope_controls (the org's in-scope controls that require it) and, as labelled context, catalog_control_mappings. 404 if untracked. requiring_controls: Which in-scope controls require one evidence item (read; works untracked). Primary: required_by_in_scope_controls with status and maturity. Context: catalog_control_mappings and what is not in scope. gaps: List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage. health: Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary. upcoming: List evidence whose next collection falls due within N days (read — viewer role), computed from each item's frequency and last upload. The daily 'what is due' view. frequency_health: Report evidence whose declared frequency disagrees with the observed upload cadence over the last 90 days (read — viewer role). Only misaligned items are returned. maturity_summary: Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities. item_maturity: Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state. upgrade_recommendations: Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI. suggestions: Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| team_id | No | Filter to evidence this team is assigned to, accountable or consulted — obtain from scf_list_teams Used by: list. | |
| my_teams | No | Filter to evidence assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead. Used by: list. | |
| system_id | No | System UUID to filter by — obtain from scf_list_systems Used by: list. | |
| evidence_id | No | Catalog evidence ID, e.g. E-IAM-01 — obtain from scf_list_evidence_catalog [get] | Catalog evidence ID, e.g. E-AST-09 — obtain from scf_list_evidence or scf_list_evidence_catalog [requiring_controls] | Evidence ID (e.g., 'E-RSK-02') — obtain from scf_list_evidence [item_maturity, upgrade_recommendations, suggestions] Used by: get, requiring_controls, item_maturity, upgrade_recommendations, suggestions. | |
| function_id | No | Filter to evidence assigned to any team aligned to this function — obtain from scf_list_functions Used by: list. | |
| accountable_owner_type | No | Filter by the accountable team's primary owner: 'internal' or 'external_contractor' Used by: list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered and the description's 'Read' prefix is consistent with it. But beyond that the description adds no behavioral context of its own: no mention of the viewer-role requirement on `upcoming`/`frequency_health`, the 90-day observation window, the 404 for untracked evidence, or the 90-day cap on `days` — all of which live only in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no filler, which is structurally sound. However, most of its content is a compressed restatement of the method enum names already fully documented in the schema, and the telegraphic list style ('gaps, health, upcoming, frequency health, maturity and upgrade guidance, suggestions') sacrifices parseability without adding new information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nine-parameter, eleven-mode endpoint with no output schema, the description gives only mode labels and never characterizes what any mode returns (record fields, coverage percentage, green/amber/red statuses, maturity levels). The rich schema compensates for parameter completeness, but the absence of return-shape signal leaves a real gap for a multi-mode read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters, including per-method applicability ('Used by: list'), enum meanings, and where to obtain IDs. The description adds no parameter meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ('Read evidence tracking') and enumerates the operation families the single multiplexed endpoint covers (list, get, requiring controls, gaps, health, upcoming, frequency health, maturity, upgrade guidance, suggestions). It is distinguishable from the write sibling and from scf_evidence_file_read by naming the tracking records themselves, though the compressed phrasing ('one record with its in-scope requiring controls, requiring controls alone') makes several modes hard to separate at a glance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Listing the modes implies which value to pass to `method`, but the description never says when to prefer one mode over another, nor when to use a sibling such as scf_get_evidence_requiring_controls instead of the `requiring_controls` method. That routing guidance exists only in the schema's method descriptions, so usage selection is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_evidence_task_writeA
Manage evidence collection tasks (editor+): create one against a tracking record, update its fields, or mark it completed with notes. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Task title Used by: create, update. | |
| method | Yes | create: Create a manual evidence collection task against a tracking record (write — editor role). Due date and evidence_tracking_id are required; status defaults to not_started, priority to medium. update: Update an evidence collection task (write — editor role). Only passed fields change: due date, status, type, priority, title, description, notes, assignee, owning team. complete: Mark an evidence collection task completed (write — editor role). Sets status to completed and stamps the completion date; optional completion notes are stored with it. | |
| status | No | Initial status (default not_started) [create] | Status [update] Used by: create, update. | |
| task_id | No | Evidence task UUID — obtain from scf_list_evidence_tasks Used by: update, complete. | |
| due_date | No | Due date, YYYY-MM-DD Used by: create, update. | |
| priority | No | Priority (default medium) [create] | Priority [update] Used by: create, update. | |
| task_type | No | Task type (default collection) [create] | Task type [update] Used by: create, update. | |
| description | No | What has to be collected and how Used by: create, update. | |
| owning_team_id | No | Team that owns the task — obtain from scf_list_teams Used by: create, update. | |
| assigned_user_id | No | Assignee user UUID — obtain from scf_list_members Used by: create, update. | |
| completion_notes | No | Notes recorded on completion Used by: update, complete. | |
| evidence_tracking_id | No | Evidence tracking record UUID (the id field from scf_list_evidence, not the E-xxx catalog id) Used by: create. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this is a non-read-only, non-destructive write tool, and the description corroborates that with the editor+ requirement. Beyond that it adds little: it doesn't say whether updates are partial, whether completion is reversible, or what happens on invalid state transitions – most of that lives only in the method enum's schema text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the resource and the three operations front-loaded, followed by the dispatch instruction. No filler, though it is arguably too terse given 12 parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a polymorphic 12-parameter write tool, the schema carries the heavy lifting: per-method required fields, defaults, and UUID sourcing hints are all documented, and there is no output schema to explain. The description covers the operation set and the role gate adequately, leaving only cross-tool routing implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the method enum text already spells out per-method requirements, defaults, and field applicability. The description's only added signal is that create targets a tracking record and complete accepts notes, which is redundant with the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ("Manage evidence collection tasks") and enumerates the three concrete operations: create against a tracking record, update fields, and mark completed with notes. It distinguishes itself from evidence-record siblings (scf_evidence_write, scf_evidence_file_write) by naming tasks explicitly, though it never names those siblings directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent to select an operation via the method parameter, which is genuine dispatch guidance, and notes the editor+ role prerequisite. However, it gives no when-not guidance and no routing to related tools such as scf_list_evidence_tasks for obtaining IDs or scf_evidence_write for the underlying tracking records.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_evidence_writeA
Create or update evidence tracking records (editor+): create one from a catalog id, upsert one record's tracking fields, or batch-upsert up to 500 in one transaction. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | No | Person accountable for this evidence item Used by: create, update. | |
| method | Yes | create: Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization. update: Upsert an evidence item's tracking fields (write — editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied. batch_update: Create or update up to 500 evidence tracking records in one transaction (write — editor role). Each upserts by evidence_id; only fields given change. Use instead of 500 scf_update_evidence calls. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| comments | No | Free-text notes or context Used by: create, update. | |
| frequency | No | Collection cadence: 'daily', 'weekly', 'monthly', 'quarterly', or 'annually' Used by: create, update. | |
| system_id | No | System UUID to link this evidence to — obtain from scf_list_systems Used by: create, update. | |
| is_tracked | No | Start actively tracking this item (default false) [create] | Toggle active tracking for this item [update] Used by: create, update. | |
| operations | No | Upsert operations, max 500 — each keyed by evidence_id Used by: batch_update. | |
| evidence_id | No | Catalog evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence_catalog [create] | Catalog evidence ID (e.g., 'E-IAM-01') — obtain from scf_list_evidence or scf_list_evidence_catalog [update] Used by: create, update. | |
| maturity_level | No | Evidence maturity level L0–L5 (e.g., 'L3'); omit to leave unset [create] | Evidence maturity level L0–L5 (e.g., 'L3'); omitting never clears the stored value [update] Used by: create, update. | |
| collecting_system | No | Name of the tool or system that collects the evidence Used by: create, update. | |
| method_of_collection | No | Collection approach: 'automated', 'manual', or 'hybrid' Used by: create, update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover readOnlyHint=false and destructiveHint=false; the description adds real context beyond them — the editor+ permission floor, the 500-record batch ceiling, the transactional nature of batch_update, and the fact that update upserts a row if missing. It omits what a failed batch does (partial vs full rollback) and what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that leads with the verb and resource, then enumerates the modes in the order an agent needs them, ending with the discriminator. No filler or redundant restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter mutation tool whose schema is fully documented and whose annotations declare the safety profile, the description supplies the essential framing: role gate, batch limit, and mode selection. The only gap is response behavior, which matters somewhat given no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so per-parameter meaning (including the detailed method enum semantics and the 'Use instead of 500 scf_update_evidence calls' note) is already documented in structured data. The description only restates the method names and the catalog-id concept, adding no syntax or edge-case detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create or update evidence tracking records') and enumerates the three modes it supports: single create from a catalog id, single-record upsert, and batch upsert of up to 500. It is clearly a write counterpart to scf_evidence_read, though it never names that sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear selection rule — 'Pick with method' — plus an upfront role requirement ('editor+') that gates who may call it. It does not state when to prefer this over scf_evidence_task_write or other write siblings, leaving that routing to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_list_evidence_tasksARead-only
List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.
| Name | Required | Description | Default |
|---|---|---|---|
| org_id | No | Organization UUID — obtain from scf_list_organizations | |
| status | No | Filter by task status: not_started, in_progress or completed | |
| assignee | No | Filter by assigned user UUID | |
| overdue_only | No | Only tasks past their due date | |
| assigned_to_me | No | Only tasks assigned to the caller | |
| evidence_tracking_id | No | Only tasks for one evidence tracking record |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations declare readOnlyHint=true, so safety is already covered. The description adds useful behavioral context by framing the result as a work queue and mentioning optional filters, but it does not disclose pagination, ordering, or whether some parameters are mutually exclusive. This is acceptable for a read-only list tool but does not go beyond the baseline.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the verb and resource, and contains no filler or redundant restatement of the tool name. The second sentence efficiently summarizes the optional filtering capability. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with a fully documented schema and readOnlyHint annotation, the description provides sufficient conceptual framing: it identifies the resource, the queue semantics, and the key filters. It does not describe the exact return fields or pagination, but the description's 'what needs to be collected, by whom, and by when' partially conveys return content, and no output schema was provided. The missing pieces are relatively minor for this tool type.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters clearly, including enums and filter semantics. The description re-states only 'filter by assignee or status' and does not add meaning beyond the schema. The baseline of 3 is appropriate because the schema carries the parameter-documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List evidence collection tasks. It further clarifies what this means by describing the tool as 'the work queue showing what needs to be collected, by whom, and by when', which distinguishes it from other list tools like scf_list_assignments or scf_get_work_queue. The verb-resource pair directly matches the tool name and clearly signals a read-only listing operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what the tool does and that filtering is optional, but it gives no guidance on when to choose this tool over closely related siblings such as scf_get_org_work_queue, scf_get_work_queue, or scf_list_assignments. There are no explicit exclusions, preconditions, or alternative-routing clues, so an agent must infer usage from the resource name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_load_toolsARead-only
Load more SCF tool groups into this session (teams, collaboration, documents, engagements, assurance, catalog-reconciliation, webhooks, journey, or all). Returns the tools now available.
| Name | Required | Description | Default |
|---|---|---|---|
| groups | Yes | teams — Business functions, teams, rosters and team accountability for controls and evidence (scf_team_read, scf_team_write) collaboration — User assignments and comment threads on controls, evidence and tasks (scf_collaboration_read, scf_collaboration_write) documents — ISMS document generation, sections, lifecycle transitions and export (scf_document_read, scf_document_write) engagements — Audit engagements: scope, auditors, queries and responses (scf_engagement_read, scf_engagement_write) assurance — Deficiencies, organization compensating controls, control validations, posture snapshots, capability tests (scf_assurance_read, scf_assurance_write) catalog-reconciliation — Per-organization SCF catalog upgrade reconciliation runs (scf_catalog_reconciliation_read, scf_catalog_reconciliation_write) webhooks — Webhook endpoints, secrets and delivery logs (scf_webhook_read, scf_webhook_write) journey — The guided implementation journey: stages, templates, attestation (scf_journey_read, scf_journey_write) all — every group above Already loaded at startup: catalog, controls, evidence, assessments, risk, vendors, systems, organization. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true is consistent with this being a session-capability operation rather than a data mutation, so there is no contradiction; the description usefully adds that the response surfaces the newly available tools and that loading is incremental. It does not disclose whether repeated loads are idempotent, whether previously loaded groups persist, or any cost/limit on session size — context an agent would want before calling with "all".
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and scope, with the return behavior appended last. Nothing is redundant and no sentence could be dropped without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with full schema documentation and no output schema, the description covers what it does and what it yields. The only gap is the absence of an explicit precondition statement telling the agent when a group must be loaded before its tools can be invoked.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the enum description already spells out each group and the sibling read/write tools it unlocks, so the schema does the heavy lifting. The description's parenthetical list of group names only echoes the enum values and adds no new semantics (e.g. no note on ordering, minItems handling, or "all" equivalence).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("Load") and resource ("SCF tool groups") plus an explicit enumeration of the loadable groups, and the closing sentence clarifies the effect ("Returns the tools now available"). This is clearly distinguishable from every sibling, all of which are per-resource read/write tools rather than a capability loader.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "Load more ... into this session" implies the trigger is needing a group that isn't yet available, and the description hints that new tools appear afterward. However, it never states the condition explicitly (e.g. "call this when a required scf_*_read/write tool is missing") and gives no guidance on batching groups versus calling "all".
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_mark_notifications_readA
Mark notifications read for the current user (write — self only): one by notification_id, or every notification when all=true. Acknowledge after processing scf_get_notifications.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Mark every notification read — explicit opt-in, ignored when notification_id is given | |
| notification_id | No | Notification UUID to mark read |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=false and destructiveHint=false. The description adds useful context beyond annotations: the operation is self-only, supports bulk marking, and is meant as an acknowledgment step. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence that front-loads the action and scope, then efficiently covers both parameter modes and the intended workflow. There is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple self-scoped write operation with two optional parameters and no output schema, the description is complete enough: it names the parameters' roles and the correct sequencing relative to scf_get_notifications. It does not describe return values or error behavior, but these are low-risk omissions for an acknowledgment operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already explains both parameters, including the precedence rule ('ignored when notification_id is given'). The description restates this behavior but adds no new semantic detail beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Mark notifications read'), the scope ('for the current user (write — self only)'), and the two invocation modes (by notification_id or all=true). It also distinguishes itself from the sibling scf_get_notifications by framing this as the write/acknowledgment counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs when to use the tool: 'Acknowledge after processing scf_get_notifications.' This gives the agent a clear workflow context. It does not list exclusions, but there is no competing sibling for marking notifications read, so the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_org_readCRead-only
Read organization data: list organizations, one organization, its settings, members, audit log, change cursor, or the organization work queue. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Page size (1–200, default 50) Used by: audit_log. | |
| action | No | Filter by action: create, update or delete Used by: audit_log. | |
| method | Yes | list: List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need. get: Get one organization's detail: subscription tier, member count, usage limits, and settings. settings: Get an organization's settings (read — viewer): profile (business_size, mission_statement), per-domain maturity_targets, name, industry, owner teams and feature switches. members: List members of one organization with their role (admin, editor, or viewer). audit_log: Query one organization's append-only audit trail (read — viewer role): field-level changes with actor, source and before/after values. Filter by entity, control, action, actor, source, date or text. change_cursor: Cheap has-anything-changed probe (read — viewer role): newest audit timestamp and row count for one organization. Compare with the pair you last saw; poll this before re-pulling the audit log. work_queue: Get one org's GRC work queue (read — viewer): overdue evidence tasks, blocking controls (material first, then catalogue weighting), stale schedules. assigned_to_me narrows to the caller. | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: audit_log. | |
| org_id | No | Organization UUID — obtain from scf_list_organizations Used by: get, settings, members, audit_log, change_cursor, work_queue. | |
| scf_id | No | Filter by SCF control ID in DOMAIN-NN format Used by: audit_log. | |
| date_to | No | Include changes at or before this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log. | |
| actor_id | No | Filter by actor user UUID — platform alias of changed_by_user_id Used by: audit_log. | |
| date_from | No | Include changes at or after this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ) Used by: audit_log. | |
| entity_id | No | Filter by the changed entity's UUID Used by: audit_log. | |
| request_id | No | Filter by request correlation ID — groups every change one API call made Used by: audit_log. | |
| entity_type | No | Filter by exact entity type as written in the log, e.g. scoped_control, evidence_file, audit_engagement, vendor — unsure of the spelling? use search_text Used by: audit_log. | |
| search_text | No | Case-insensitive search across entity_type, field_name, old_value and new_value Used by: audit_log. | |
| action_source | No | Filter by origin of the change: ui, api_key, mcp or system Used by: audit_log. | |
| assigned_to_me | No | Only items owned by or assigned to the caller (default false) Used by: work_queue. | |
| changed_by_user_id | No | Filter by the user who made the change — obtain from scf_list_members Used by: audit_log. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered and the description carries a lower burden. What remains undisclosed is genuinely useful context the description could have supplied: that most methods require an org_id obtained elsewhere, that audit_log is append-only and filter-heavy, that change_cursor is a cheap polling probe to run before re-pulling the log, and the viewer-role requirements — all of which appear only in the schema's method enum, not the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the verb and resource, and the enumeration of methods is the right way to signal scope in minimal space. It is not padded, though 'Pick with method' is filler that could have been spent on real selection guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter, seven-method multiplexer with no output schema, the definition is only adequate: the schema does the heavy lifting on parameter applicability and per-method return content, and readOnlyHint covers safety. An agent can invoke it correctly, but the description itself gives no picture of what to expect back from each method or how to sequence calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is annotated with its purpose and which method consumes it ('Used by: audit_log', etc.), so the baseline of 3 applies. The description contributes essentially nothing beyond naming 'method' as the selector, adding no format, default, or interaction detail over what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Read organization data') and then enumerates the seven resource views covered (list, one org, settings, members, audit log, change cursor, work queue), which lets an agent tell this apart from read siblings like scf_user_read or scf_evidence_read. It stops short of naming any sibling or stating the boundary against scf_update_org_settings, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' only tells the agent that the method enum is the selector; it gives no guidance on which method to choose for a given intent, no ordering advice (the 'list first to get org_id' pattern lives only in the schema), and no when-not or alternative-sibling routing. The agent must open the schema to learn anything actionable about selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_risk_readARead-only
Read the risk register: list risks, one risk, the 5x5 matrix, summary, profile, risks for a control, or controls for a risk. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | list: List the whole risk register (ordered by risk code): scores, treatment status and any acceptance (accepted_by, accepted_at, rationale, expiry, acceptance_state). Filter by status, level, category. get: Get one risk assessment: inherent and residual scores, treatment plan, owner, review date, and any acceptance (accepted_by, accepted_at, rationale, expires_on, acceptance_state). matrix: Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization. summary: Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data. profile: Get the organization's risk profile (read — viewer role): the severity thresholds that band the 5×5 matrix into low, medium, high and critical. Auto-created with defaults if unset. for_control: List the risk codes a control addresses and this organization's assessments of them (read — viewer role). Control-to-risk traceability from the SCF catalog mapping. controls_for_risk: List the controls that address a risk code (read — viewer role). Works for catalog risks (R-XX-N via the SCF mapping) and custom risks (R-ORG-N via the org's control mappings). | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control ID in DOMAIN-NN format, e.g. IAC-01 Used by: for_control. | |
| status | No | Filter by treatment status: identified, analysed, treating, treated, accepted or monitoring (sent as the platform's treatment_status) Used by: list. | |
| risk_id | No | Risk assessment ID — obtain from scf_list_risks Used by: get. | |
| category | No | Filter by catalog risk category code, e.g. 'AC' matches R-AC-N Used by: list. | |
| risk_code | No | Risk code — catalog R-XX-N or custom R-ORG-N Used by: controls_for_risk. | |
| risk_level | No | Filter by inherent risk level, banded by the org's risk profile Used by: list. | |
| acceptance_state | No | Accepted risks only, by their approval: 'approved' (in force), 'expired' (past acceptance_expires_on) or 'unapproved' (accepted with no approval recorded) Used by: list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation establishes non-mutating behavior, and the description consistently presents read operations without contradicting it. Beyond listing the available views, it adds little operational context; authorization requirements and the schema's caveat that an unset profile is auto-created with defaults are not surfaced in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences front-load the purpose and then provide the dispatch instruction. The operation list is dense but efficient, with each item identifying a distinct capability and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a seven-method, nine-parameter read dispatcher, the description supplies an adequate top-level map while the rich schema covers per-method results, identifiers, and filters. Explicit sibling routing and important read-side caveats would improve it, but the supplied definition generally enables correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema already documents the method values, method-specific parameters, filters, formats, and sources for identifiers. "Pick with method" and the plain-English operation list provide a useful overview but little parameter meaning beyond the schema, so the baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb "Read" and resource "risk register" are explicit, and the enumerated views clarify the tool's scope. It does not explicitly distinguish itself from siblings such as scf_custom_risk_read or scf_risk_write, leaving that differentiation to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Read the risk register" establishes the usage context, while "Pick with method" explains how to select an operation. There are no when-not conditions or named alternatives for writes, custom-risk reads, or other related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_risk_writeADestructive
Change the risk register (editor+; accept is admin): create a risk assessment, update one, delete one (destructive), or record or renew a risk acceptance. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| notes | No | Free-text notes on this risk assessment Used by: update. | |
| owner | No | Name or identifier of the risk owner Used by: create. | |
| title | No | Risk title (required, max ~100 chars) Used by: create. | |
| impact | No | Inherent impact on a 1–5 scale Used by: create, update. | |
| method | Yes | create: Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix. update: Update a scored risk by code (write — editor). Only passed fields change. Setting accepted records no approval (use scf_accept_risk); re-scoring an accepted risk clears its approval. delete: Delete an organization's scoring of a risk code (destructive write — editor role). The catalog or custom risk definition itself remains; only this org's assessment row is removed. accept: Accept a risk (write — admin): records you as approver, now, the rationale and expiry. Renews an accepted risk. Also accepts a standards exception. A platform key without a user gets 403. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| rationale | No | Why the risk is accepted (required, non-blank; stored trimmed). Blank is refused Used by: accept. | |
| risk_code | No | Risk code — catalog R-XX-N or custom R-ORG-N [update, delete] | Risk code — catalog R-XX-N or custom R-ORG-N — obtain from scf_list_risks or scf_list_custom_risks [accept] Used by: update, delete, accept. | |
| control_id | No | SCF control ID to link (e.g., 'AST-01') — obtain from scf_list_controls Used by: create. | |
| expires_on | No | Date the acceptance lapses (YYYY-MM-DD); must be after today (400 otherwise) Used by: accept. | |
| likelihood | No | Inherent likelihood on a 1–5 scale Used by: create, update. | |
| description | No | Risk description (required) Used by: create. | |
| owner_user_id | No | Risk owner — obtain from scf_list_members Used by: update. | |
| treatment_plan | No | How the risk is being treated Used by: update. | |
| residual_impact | No | Residual impact after treatment, 1–5 scale Used by: update. | |
| next_review_date | No | YYYY-MM-DD Used by: update. | |
| treatment_status | No | Treatment workflow status (default identified) [create] | Treatment lifecycle state. 'accepted' set here records no approval — scf_accept_risk does. Below admin, moving an accepted risk with an approval in force off accepted is ignored (it stays accepted); an admin's move clears the acceptance [update] Used by: create, update. | |
| treatment_due_date | No | YYYY-MM-DD Used by: update. | |
| residual_likelihood | No | Residual likelihood after treatment, 1–5 scale Used by: update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, and the description reinforces this by labeling delete as destructive and noting only this org's assessment row is removed while the catalog definition persists. It further adds non-obvious constraints – accept requires admin, a platform key without a user gets 403, expiry must be in the future – that go beyond the annotations, though it does not describe the response shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence plus a routing instruction, with the resource, the role gate, and the destructive warning all front-loaded. No filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 19-parameter multiplexed mutation tool with no output schema, the description plus the fully documented method enum give an agent enough to pick the right method and understand the permission and destructive implications. Residual gap is that nothing describes the return payload, but that is minor given the schema's richness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already carries per-method 'Used by' annotations, so the description adds essentially nothing per-parameter beyond restating which method is chosen. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ("Change the risk register") and then enumerates the four operations the single tool multiplexes (create, update, delete, record/renew acceptance), which clearly separates it from the read-side sibling scf_risk_read and from scf_custom_risk_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states that method selects the operation and flags role gates (editor+ for changes, admin for accept), plus the schema's method enum explicitly routes approval recording to scf_accept_risk instead of setting treatment_status to accepted. There is no explicit statement of when to prefer this over scf_custom_risk_write, which keeps it below a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_system_readBRead-only
Read the systems inventory: list systems, one system, catalog templates, a system's capabilities and recipes, recipe status, org evidence capabilities, systems for an evidence type.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Template slug — obtain from scf_list_system_catalog Used by: catalog_template. | |
| method | Yes | list: List the organization's systems with boundary and recovery record (in_scope, criticality, RTO/RPO hours, data classification, hosting). Filter by linked vendor or boundary decision. get: Get one system from the organization's inventory (read — viewer role): name, type, vendor, description, catalog template link and the evidence it is configured to provide. catalog_templates: List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name. catalog_template: Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time). capabilities: List the evidence types a system can provide and how (read — viewer role): capability status potential/configured/active, collection method, confidence and data format. recipes: Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps. recipe_status: Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes. evidence_capabilities: List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports. systems_for_evidence: Find every system that can provide a given evidence type (read — viewer role) — the inverse of the per-system capability list. Filter by capability status. | |
| org_id | No | Organization UUID — obtain from scf_list_organizations Used by: list, get, capabilities, recipes, recipe_status, evidence_capabilities, systems_for_evidence. | |
| search | No | Free-text search across template names, vendors, and aliases Used by: catalog_templates. | |
| in_scope | No | Filter by assessment boundary: 'true' (inside), 'false' (outside) or 'undecided' (not recorded) Used by: list. | |
| system_id | No | System UUID — obtain from scf_list_systems Used by: get, capabilities, recipes, recipe_status. | |
| vendor_id | No | Filter to systems structurally linked to this vendor UUID — obtain from scf_list_vendors Used by: list. | |
| evidence_id | No | Catalog evidence ID, e.g. E-IAM-01 Used by: systems_for_evidence. | |
| capability_status | No | Filter by capability status Used by: capabilities, systems_for_evidence. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
readOnlyHint=true already tells the agent this is a safe read, so the description only needs to add context. It does add that recipe_status is a queued AI job (inferable polling semantics) but omits permission requirements, pagination, and result limits; the 'viewer role' and return-shape notes appear only in the schema, not the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the verb and resource come first and the method list follows. It is dense but compact, though the listed phrases are not verbatim method names, forcing a small mental mapping to the enum.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter multiplexed tool with no output schema, the description is thin: it never says what a call returns or that behavior varies sharply by method, leaving that entirely to the schema's enum text. It is adequate to identify the tool but not to predict responses.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter is documented with its applicable methods, so the schema does the heavy lifting. The description adds only a high-level mapping of names to operations ('one system', 'recipe status') and no format, ID-source, or enum semantics beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read the systems inventory') and then enumerates the nine sub-operations the tool covers, so an agent can see the full scope without opening the schema. It does not name siblings such as scf_system_write or scf_evidence_read to sharpen the boundary, which keeps it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The enumeration implies which method to pick for a given information need, but there is no explicit when-to-use / when-not-to-use guidance and no routing to alternative tools for overlapping needs (e.g., evidence lookups via scf_evidence_read). The real routing hints ('Poll this after scf_generate_system_recipes', 'obtain from scf_list_system_catalog') live in the schema's enum description, not the tool description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_system_writeA
Manage the systems inventory (editor+): create or update a system, declare or update an evidence capability, or generate collection recipes (async). Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Human-readable system name (required) [create] | New system name [update] Used by: create, update. | |
| notes | No | Free-text notes about the capability Used by: create_capability, update_capability. | |
| method | Yes | create: Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence. update: Update a system record (write — editor+ role), including its boundary and recovery record. All fields are optional; only provided fields are applied. create_capability: Declare that a system can provide one evidence type (write — editor role). One entry per evidence_id per system; status defaults to potential, confidence to medium. update_capability: Update a system's evidence capability (write — editor role). Only passed fields change; move status potential → configured → active as the collector is wired up. generate_recipes: Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| status | No | Lifecycle status (default: active) [create] | New lifecycle status [update] Used by: create, update. | |
| vendor | No | Legacy free-text vendor name (prefer vendor_id for a structural link) [create] | New legacy free-text vendor name (prefer vendor_id) [update] Used by: create, update. | |
| category | No | Free-text category (e.g., 'SIEM', 'Endpoint', 'Identity') [create] | New free-text category [update] Used by: create, update. | |
| in_scope | No | Inside the assessment boundary (true) or outside (false); omit when not decided [create] | Assessment boundary: true (inside), false (outside), or null to mark it undecided [update] Used by: create, update. | |
| rpo_hours | No | Recovery point objective, in hours (≥ 0) [create] | Recovery point objective in hours (≥ 0); null clears [update] Used by: create, update. | |
| rto_hours | No | Recovery time objective, in hours (≥ 0) [create] | Recovery time objective in hours (≥ 0); null clears [update] Used by: create, update. | |
| system_id | No | System UUID to update — obtain from scf_list_systems [update] | System UUID — obtain from scf_list_systems [create_capability, update_capability, generate_recipes] Used by: update, create_capability, update_capability, generate_recipes. | |
| vendor_id | No | Vendor UUID to structurally link this system to — obtain from scf_list_vendors (same org) [create] | New structural vendor link (UUID, same org) — obtain from scf_list_vendors [update] Used by: create, update. | |
| criticality | No | Business criticality — one of: low, medium, high, critical [create] | Business criticality — one of: low, medium, high, critical; null clears [update] Used by: create, update. | |
| data_format | No | Format of the collected data, e.g. 'csv', 'json', 'pdf' Used by: create_capability, update_capability. | |
| description | No | Free-text description of the system [create] | New system description [update] Used by: create, update. | |
| evidence_id | No | Catalog evidence ID, e.g. E-IAM-01 Used by: create_capability. | |
| system_type | No | System classification — one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom [create] | New system classification — one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom [update] Used by: create, update. | |
| capability_id | No | Capability UUID — obtain from scf_list_system_capabilities Used by: update_capability. | |
| confidence_level | No | Confidence in evidence quality (default medium) [create_capability] | Confidence in evidence quality [update_capability] Used by: create_capability, update_capability. | |
| hosting_location | No | Where the system runs, e.g. a cloud region or data centre [create] | Where the system runs; null clears [update] Used by: create, update. | |
| capability_status | No | Capability status (default potential) [create_capability] | Capability status [update_capability] Used by: create_capability, update_capability. | |
| collection_method | No | How the evidence is collected Used by: create_capability, update_capability. | |
| catalog_template_id | No | System-catalog template ID to link — obtain from scf_list_system_catalog [create] | New system-catalog template ID link — obtain from scf_list_system_catalog [update] Used by: create, update. | |
| data_classification | No | Highest classification of data held — one of: public, internal, confidential, restricted [create] | Highest classification of data held — one of: public, internal, confidential, restricted; null clears [update] Used by: create, update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false and destructiveHint=false; the description adds genuinely non-structured context: the editor+/editor role requirement per operation, and that generate_recipes is asynchronous returning HTTP 202 with progress tracked via a separate status tool. It still does not mention reversibility, what a null field does on update (that detail is in the schema), or rate limits, but for a write tool it goes well beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The role scope is front-loaded in a parenthetical and the three capability families follow in one compact sentence, so it reads quickly with little waste. The single dense sentence forces the reader to parse a comma-heavy list, and "(async)" is tacked on without saying what is returned.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 24-parameter, five-mode multiplexed write tool with no output schema, the description covers the mode inventory, role gates, and the async follow-up, which is the core framing. It stops short of summarizing the mode-to-parameter contract (e.g. that system_id is required for four of the five methods, or that update treats all fields as optional/partial) or what the non-async methods return, leaving the agent to reconstruct that from the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already carries per-method "Used by:" annotations plus enum value explanations, so the schema does all the parameter work. The description adds only the generic instruction "Pick with method" and no per-mode parameter guidance or conditional-requirement summary beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ("Manage the systems inventory") and then enumerates all five things the tool can do: create/update a system, declare/update an evidence capability, and generate collection recipes. The name is scf_system_write and the sibling scf_system_read exists, so the write-vs-read split is inferable, but the description never names that sibling or otherwise explicitly differentiate itself from the read tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a meaningful selector ("Pick with method") and flags that generate_recipes is async, plus a follow-up pointer to scf_get_recipe_generation_status. However, it does not say when to use scf_system_write versus scf_system_read (or scf_capability_theme_read / scf_catalog_read) for related lookups, and the when-to-use detail lives almost entirely in the per-method enum descriptions inside the schema rather than in the description itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_update_org_settingsA
Update the organization profile and maturity targets (write — admin): business_size, mission_statement, maturity_targets. Partial: only passed fields change.
| Name | Required | Description | Default |
|---|---|---|---|
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| business_size | No | Business size, which picks the matching row of each control's right-sizing guidance: micro_small, small, medium, large, enterprise; null clears | |
| maturity_targets | No | Target maturity per SCF domain code (domain code → L0–L5), e.g. {"GOV": "L3"}. Replaces the whole map; {} clears every target. Unknown domain codes, or one code given twice in different case, are refused (422). A control's own target (scf_set_target_maturity) overrides its domain's | |
| mission_statement | No | Mission statement (up to 4000 chars); blank or null clears |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=false and destructiveHint=false. The description adds two things annotations cannot: it is an admin-gated write, and it is a partial update where only passed fields change — important behavior for a PATCH-style call. It stops short of describing the clear/replace semantics of null and {} values, which the schema carries instead.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, zero filler. The operation, the scope of writable fields, the admin gate, and the partial-update contract are all front-loaded before any detail is deferred to the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should ideally say something about what a successful update returns or whether it echoes the new settings. It covers fields, partial semantics, and the admin gate, and safety is handled by annotations, so the gap is small but present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter in depth (enum values, 4000-char limit, whole-map replacement rules, 422 on unknown domain codes). The description only echoes the three field names, adding little beyond that. With coverage this high, it does what is expected and no more.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (update) and resource (organization profile and maturity targets) and enumerates the exact writable fields: business_size, mission_statement, maturity_targets. An agent can immediately distinguish this from the read-side sibling scf_get_org_settings and from scf_set_target_maturity (per-control targets).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The '(write — admin)' tag signals a permission precondition, which is useful for deciding whether the agent can call it at all. However, it gives no when-to-use vs when-not guidance and never names the obvious alternative, scf_set_target_maturity, for per-control targets — that precedence rule lives only in the parameter schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_user_readARead-only
Read the caller's own view: the current user (the API key's identity), their work queue, or their notifications. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Page size (1–100, default 25) Used by: notifications. | |
| method | Yes | me: Get the authenticated caller's profile: name, email, organization memberships, and per-org role. work_queue: Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to. notifications: Get the caller's notifications: assignments, comments, status changes and alerts, including risk_acceptance_expired (a risk) and control_validation_due (a control). | |
| unread_only | No | Return only unread notifications (default false) Used by: notifications. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds a genuinely useful behavioral fact beyond them: the identity returned is the API key's identity, meaning there is no parameter to target another user — an agent could otherwise waste calls trying to pass a user id. It does not mention pagination behavior beyond the limit param or response size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the scope constraint before the method list, with no filler. 'Pick with method' is mildly instructional and repeats what the required enum already makes obvious, which keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a small, read-only, three-parameter tool with no output schema, the description covers scope, identity semantics, and the mode selector adequately. Minor gaps remain around result ordering/pagination across the modes, but nothing essential to invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the method enum descriptions are far richer than the tool description (work queue contents, notification types such as risk_acceptance_expired). The description adds no syntax, format, or default details beyond what the schema already states, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and a clearly bounded resource ('the caller's own view'), then names the three variants: current user, work queue, notifications. This implicitly separates it from org- or entity-scoped siblings like scf_org_read, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' tells the agent how to choose among the three modes, but that routing is already fully enumerated in the method schema description. There is no guidance on when to use this instead of sibling reads (e.g., scf_org_read for organization data) or instead of scf_mark_notifications_read when handling notifications.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_vendor_readBRead-only
Read third-party risk data: list vendors, one vendor, its research, assessments (list, one, latest, status), certifications, compensating controls, action items. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | 1-indexed page number (default 1) Used by: list. | |
| method | Yes | list: List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated. get: Get one vendor's detail: certifications, assessments, computed risk score, and latest research results. research: Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research. list_assessments: List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record. assessment: Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources. latest_assessment: Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet. assessment_status: Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment. certifications: List a vendor's certifications (read — viewer role): name, issuing body, certificate number, status, issue and expiry dates, scope and verification URL. compensating_controls: List compensating controls recorded against a vendor's gaps (read — viewer): gap, offsetting control, effectiveness, notes. For the org's own controls use scf_list_org_compensating_controls. action_items: List remediation action items for one vendor, or across every vendor when vendor_id is omitted (read — viewer role). Filter by status or priority. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| status | No | Lifecycle status filter — one of: prospect, active, under_review, approved, suspended, offboarded [list] | Filter by status [action_items] Used by: list, action_items. | |
| per_page | No | Page size (1–100, default 25) Used by: list. | |
| priority | No | Filter by priority Used by: action_items. | |
| vendor_id | No | Vendor UUID — obtain from scf_list_vendors [get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls] | Vendor UUID — omit to list action items across all vendors [action_items] Used by: get, research, list_assessments, assessment, latest_assessment, assessment_status, certifications, compensating_controls, action_items. | |
| criticality | No | Criticality tier filter Used by: list. | |
| assessment_id | No | Assessment UUID — obtain from scf_list_vendor_assessments or the trigger response [assessment] | Assessment UUID — returned by scf_trigger_vendor_assessment [assessment_status] Used by: assessment, assessment_status. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true already supplied, the description adds essentially no behavioral context beyond what annotations and schema cover — no mention of pagination behavior, 404 conditions, permission requirements, or freshness of research results. Its only contribution is a resource inventory that duplicates the method enum descriptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two terse sentences, front-loaded with purpose and then the resource list; nothing is padded or redundant. The dense parenthetical list is compact at the modest cost of readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a ten-method multiplexed read tool with no output schema, the description at least enumerates the full method surface, and the schema fills in per-method semantics. However it does not describe return shapes, pagination handling, or the polling relationship to the trigger tools, leaving gaps for an agent that never reads the full enum text.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the method enum documents each of the ten options in detail, so the baseline of 3 applies. The description's only parameter-related content is "Pick with method," which restates the schema rather than adding syntax, defaults, or cross-parameter constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ("Read third-party risk data") and enumerates the sub-resources covered (vendors, research, assessments, certifications, compensating controls, action items), so an agent can tell this is the TPRM read surface rather than a write tool. It stops short of naming scf_vendor_write or other siblings as alternatives, so it falls just below 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Pick with method" points the agent at the required method parameter as the routing mechanism, which is implied usage guidance. There is no explicit when-to-use/when-not, no pointer to scf_vendor_write for mutations, and no note on sequencing (e.g. poll after triggers) despite such ordering existing in the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_vendor_record_writeBDestructive
Manage a vendor's sub-records (editor+): create, update or delete a certification, a compensating control, or an action item. Deletes are destructive. Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| cc_id | No | Compensating control UUID — obtain from scf_list_compensating_controls Used by: update_compensating_control, delete_compensating_control. | |
| scope | No | Certification scope statement Used by: create_certification, update_certification. | |
| title | No | Action item title Used by: create_action_item, update_action_item. | |
| method | Yes | create_certification: Record a certification a vendor holds (write — editor role), e.g. ISO 27001 or SOC 2 Type II. Status defaults to valid; track expiry_date so renewals surface. update_certification: Update a vendor certification (write — editor role). Only passed fields change; use it to mark a certificate expired or revoked, or to record the renewed expiry date. delete_certification: Delete a vendor certification record (destructive write — editor role). Prefer status=expired or revoked when the history matters. create_compensating_control: Record a compensating control for a vendor gap (write — editor role): what the gap is, what offsets it, and how effective that is (full, partial or minimal — default partial). update_compensating_control: Update a vendor compensating control (write — editor role). Only passed fields change: gap description, control text, effectiveness rating, risk-reduction notes. delete_compensating_control: Delete a vendor compensating control record (destructive write — editor role). create_action_item: Create a remediation action item against a vendor (write — editor role), typically from an assessment finding. Priority defaults to medium, status to open. update_action_item: Update a vendor action item (write — editor role). Only passed fields change; set status=completed with completed_date to close it. delete_action_item: Delete a vendor action item (destructive write — editor role). Prefer status=cancelled when the record should stay visible. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| status | No | Status (default valid) [create_certification] | Status [update_certification, update_action_item] | Status (default open) [create_action_item] Used by: create_certification, update_certification, create_action_item, update_action_item. | |
| cert_id | No | Certification UUID — obtain from scf_list_vendor_certifications Used by: update_certification, delete_certification. | |
| item_id | No | Action item UUID — obtain from scf_list_vendor_action_items Used by: update_action_item, delete_action_item. | |
| category | No | Free-text category, e.g. 'contractual', 'technical' Used by: create_action_item, update_action_item. | |
| due_date | No | YYYY-MM-DD Used by: create_action_item, update_action_item. | |
| priority | No | Priority (default medium) [create_action_item] | Priority [update_action_item] Used by: create_action_item, update_action_item. | |
| vendor_id | Yes | Vendor UUID — obtain from scf_list_vendors | |
| issue_date | No | YYYY-MM-DD Used by: create_certification, update_certification. | |
| owner_name | No | Owner name Used by: create_action_item, update_action_item. | |
| description | No | Action item detail Used by: create_action_item, update_action_item. | |
| expiry_date | No | YYYY-MM-DD Used by: create_certification, update_certification. | |
| owner_user_id | No | Owner — obtain from scf_list_members Used by: create_action_item, update_action_item. | |
| completed_date | No | YYYY-MM-DD Used by: create_action_item, update_action_item. | |
| gap_description | No | The gap the control offsets Used by: create_compensating_control, update_compensating_control. | |
| verification_url | No | Public verification URL Used by: create_certification, update_certification. | |
| certificate_number | No | Certificate number Used by: create_certification, update_certification. | |
| certification_body | No | Issuing body Used by: create_certification, update_certification. | |
| certification_name | No | Certification name, e.g. 'ISO 27001:2022' Used by: create_certification, update_certification. | |
| compensating_control | No | The control that offsets the gap Used by: create_compensating_control, update_compensating_control. | |
| effectiveness_rating | No | Effectiveness (default partial) Used by: create_compensating_control, update_compensating_control. | |
| risk_reduction_notes | No | How much residual risk this removes Used by: create_compensating_control, update_compensating_control. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so 'Deletes are destructive' largely restates structured data. The description does add one thing not in annotations: the editor+ role requirement, which tells the agent an authorization bar exists. It does not disclose what a delete removes, whether deletes cascade, or any confirmation/irreversibility detail for a mutation tool with a destructive flag.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the resource and access level, followed by the destructive warning and the dispatch hint. Nothing is padded, though 'Pick with method' is slightly cryptic phrasing that assumes the reader will inspect the enum.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nine-method, 26-parameter multiplexed mutation tool with no output schema, the description is a thin wrapper that delegates almost everything to the schema. It conveys resource scope, role requirement, and destructiveness, but says nothing about what the create/update calls return or what happens to linked records on delete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; each of the 26 parameters is already documented with a 'Used by' mapping to specific methods. The description adds only the framing that 'method' selects among nine operations. It does not restate required field combinations per method, but it does not need to given the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (vendor sub-records), enumerates the three record types (certification, compensating control, action item) and the operations (create/update/delete), and says the dispatch key is 'method'. That is far more specific than the tool name alone. It stops short of the top mark because it never names the sibling it is not, e.g. scf_vendor_write for the vendor record itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives the access precondition '(editor+)' and warns that deletes are destructive, which is real usage context. 'Pick with method' only points at the dispatch mechanism rather than explaining when to choose each method or when to use this tool instead of its siblings. The substantive when-to-use detail (e.g. prefer status=expired over deleting, set status=completed with completed_date) lives in the schema enum descriptions, not here.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scf_vendor_writeA
Manage vendors (editor+): create or update a vendor, trigger AI research, or trigger a DPSIA assessment (async). Pick with method.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Vendor legal or trading name (required) [create] | New vendor name [update] Used by: create, update. | |
| method | Yes | create: Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling. update: Update an existing vendor record (write — editor+ role). Only provided fields are applied. research: Queue AI security research for a vendor (write — editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research. assess: Queue an AI vendor security assessment (write — editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| status | No | Lifecycle status (default prospect) — one of: prospect, active, under_review, approved, suspended, offboarded [create] | New lifecycle status — one of: prospect, active, under_review, approved, suspended, offboarded [update] Used by: create, update. | |
| website | No | Vendor website URL [create] | New website URL [update] Used by: create, update. | |
| category | No | Category label (e.g., 'SaaS', 'Infrastructure', 'Consulting') [create] | New category label [update] Used by: create, update. | |
| data_role | No | GDPR data role (default 'Processor') Used by: assess. | |
| vendor_id | No | Vendor UUID — obtain from scf_list_vendors Used by: update, research, assess. | |
| criticality | No | Business criticality tier (default 'medium') [create] | New criticality tier [update] Used by: create, update. | |
| description | No | Short free-text description of the vendor [create] | New free-text description [update] Used by: create, update. | |
| contact_email | No | Primary contact email address [create] | New primary contact email [update] Used by: create, update. | |
| data_location | No | Where the vendor stores or processes our data [create] | Where the vendor stores or processes our data; null clears [update] Used by: create, update. | |
| services_used | No | Description of services the vendor provides, 1–2000 chars (auto-derived from the vendor record if omitted) Used by: assess. | |
| assessment_type | No | Assessment type: 'initial', 'annual', or 'adhoc' (default 'initial') Used by: assess. | |
| domain_override | No | Override the vendor's website domain used for research lookup (e.g., 'example.com') Used by: research. | |
| additional_context | No | Free-text context, scope notes, or specific concerns to feed the assessor (max 5000 chars) Used by: assess. | |
| flow_down_requirements | No | Requirements passed down to the vendor by contract [create] | Requirements passed down to the vendor by contract; null clears [update] Used by: create, update. | |
| shared_responsibility_note | No | Who is responsible for what between us and the vendor [create] | Who is responsible for what between us and the vendor; null clears [update] Used by: create, update. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description adds real behavioral context: an editor+ role gate on all operations, that research and assess are async, and that assess supersedes the deprecated DPSIA trigger. It stops short of noting that update is a partial/patch-style mutation or what the queued jobs entail, which the schema covers instead.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words, listing operations before mechanics. It is arguably over-compressed for a four-in-one tool with 18 parameters, but nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 18-parameter, four-method multiplexed write tool with no output schema, the description is thin — it omits how method-specific requirements interact (vendor_id for update/research/assess, name for create) and relies entirely on schema text. The key facts an agent needs (role requirement, async behavior, polling siblings) are present, so it is minimally sufficient rather than complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter including per-method applicability via 'Used by:' tags, which sets the baseline at 3. The description adds only 'Pick with method' and the async hint; it contributes no additional meaning about the 18 parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource (vendors) and enumerates the four concrete operations — create, update, AI research, DPSIA assessment — so an agent immediately knows what the tool does. It falls short of a 5 because it gives no differentiation from the closely-named sibling scf_vendor_record_write, leaving overlap ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Pick with method' identifies the discriminator but gives no when-to-use guidance between the four operations, and no exclusions relative to scf_vendor_read or scf_vendor_record_write. The per-method context (async, polling targets) lives in the method enum's schema description rather than in the tool description, so usage is only implied here.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
244 tool updates
v4.1.0- Removed
scf_accept_risk - Removed
scf_add_capability_test_finding - Removed
scf_add_custom_risk_control - Removed
scf_add_engagement_auditor - Removed
scf_add_team_member - Removed
scf_apply_catalog_reconciliation - Added
scf_assessment_read - Added
scf_assessment_write - Removed
scf_attest_journey_stage - Removed
scf_batch_create_team_assignments - Removed
scf_batch_update_controls - Removed
scf_batch_update_evidence - Removed
scf_bulk_assess_evidence - Removed
scf_bulk_assess_windows - Removed
scf_bulk_unscope_framework - Removed
scf_cancel_catalog_reconciliation - Added
scf_capability_theme_read - Added
scf_catalog_read - Removed
scf_complete_evidence_task - Added
scf_control_read - Added
scf_control_write - Removed
scf_create_assignment - Removed
scf_create_capability_test - Removed
scf_create_comment - Removed
scf_create_compensating_control - Removed
scf_create_custom_risk - Removed
scf_create_deficiency - Removed
scf_create_engagement - Removed
scf_create_engagement_query - Removed
scf_create_evidence - Removed
scf_create_evidence_task - Removed
scf_create_org_compensating_control - Removed
scf_create_risk - Removed
scf_create_system - Removed
scf_create_system_capability - Removed
scf_create_team - Removed
scf_create_team_assignment - Removed
scf_create_vendor - Removed
scf_create_vendor_action_item - Removed
scf_create_vendor_certification - Removed
scf_create_webhook - Added
scf_custom_risk_read - Added
scf_custom_risk_write - Removed
scf_delete_assignment - Removed
scf_delete_comment - Removed
scf_delete_compensating_control - Removed
scf_delete_custom_risk - Removed
scf_delete_engagement - Removed
scf_delete_evidence_file - Removed
scf_delete_risk_assessment - Removed
scf_delete_team_assignment - Removed
scf_delete_vendor_action_item - Removed
scf_delete_vendor_certification - Removed
scf_delete_webhook - Added
scf_evidence_file_read - Added
scf_evidence_file_write - Added
scf_evidence_read - Added
scf_evidence_task_write - Added
scf_evidence_write - Removed
scf_export_document - Removed
scf_generate_documents - Removed
scf_generate_system_recipes - Removed
scf_get_assessment_review_queue - Removed
scf_get_audit_log - Removed
scf_get_capability_test - Removed
scf_get_capability_theme - Removed
scf_get_capability_theme_evidence_posture - Removed
scf_get_capability_theme_scorecard - Removed
scf_get_catalog_changelog - Removed
scf_get_catalog_evidence - Removed
scf_get_catalog_reconciliation_status - Removed
scf_get_change_cursor - Removed
scf_get_control - Removed
scf_get_control_assessment_composite - Removed
scf_get_controls_for_risk - Removed
scf_get_current_user - Removed
scf_get_deficiency - Removed
scf_get_deficiency_summary - Removed
scf_get_document - Removed
scf_get_document_generation_status - Removed
scf_get_document_history - Removed
scf_get_document_section_generated - Removed
scf_get_document_settings - Removed
scf_get_domain - Removed
scf_get_engagement - Removed
scf_get_engagement_presentation - Removed
scf_get_engagement_query - Removed
scf_get_engagement_scope - Removed
scf_get_evidence - Removed
scf_get_evidence_assessment - Removed
scf_get_evidence_assessment_summary - Removed
scf_get_evidence_file - Removed
scf_get_evidence_health - Removed
scf_get_evidence_item_maturity - Removed
scf_get_evidence_maturity - Removed
scf_get_evidence_suggestions - Removed
scf_get_evidence_upgrade_recommendations - Removed
scf_get_evidence_validation - Removed
scf_get_evidence_validation_summary - Removed
scf_get_framework_scope_summary - Removed
scf_get_frequency_health - Removed
scf_get_journey - Removed
scf_get_latest_vendor_assessment - Removed
scf_get_notifications - Removed
scf_get_org_compensating_control - Removed
scf_get_org_settings - Removed
scf_get_org_work_queue - Removed
scf_get_organization - Removed
scf_get_posture_snapshot - Removed
scf_get_recipe_generation_status - Removed
scf_get_reconciliation_run - Removed
scf_get_risk - Removed
scf_get_risk_matrix - Removed
scf_get_risk_profile - Removed
scf_get_risk_summary - Removed
scf_get_risks_for_control - Removed
scf_get_scoped_control - Removed
scf_get_scoping_stats - Removed
scf_get_system - Removed
scf_get_system_catalog_template - Removed
scf_get_system_recipes - Removed
scf_get_systems_for_evidence - Removed
scf_get_team - Removed
scf_get_upcoming_evidence - Removed
scf_get_vendor - Removed
scf_get_vendor_assessment - Removed
scf_get_vendor_assessment_status - Removed
scf_get_vendor_research - Removed
scf_get_webhook - Removed
scf_get_window_assessment - Removed
scf_get_window_assessment_summary - Removed
scf_get_window_assessment_versions - Removed
scf_get_work_queue - Removed
scf_import_journey - Removed
scf_list_assessment_objectives - Removed
scf_list_assignments - Removed
scf_list_capabilities - Removed
scf_list_capability_tests - Removed
scf_list_capability_theme_controls - Removed
scf_list_capability_themes - Removed
scf_list_comments - Removed
scf_list_compensating_controls - Removed
scf_list_control_assessment_composites - Removed
scf_list_control_validations - Removed
scf_list_controls - Removed
scf_list_custom_risk_controls - Removed
scf_list_custom_risks - Removed
scf_list_deficiencies - Removed
scf_list_document_domains - Removed
scf_list_document_generators - Removed
scf_list_documents - Removed
scf_list_domains - Removed
scf_list_engagement_auditors - Removed
scf_list_engagement_queries - Removed
scf_list_engagements - Removed
scf_list_evidence - Removed
scf_list_evidence_catalog - Removed
scf_list_evidence_files - Removed
scf_list_evidence_gaps - Removed
scf_list_frameworks - Removed
scf_list_functions - Removed
scf_list_journey_templates - Removed
scf_list_members - Removed
scf_list_my_engagements - Removed
scf_list_org_compensating_controls - Removed
scf_list_organizations - Removed
scf_list_posture_snapshots - Removed
scf_list_reconciliation_runs - Removed
scf_list_risks - Removed
scf_list_scoped_controls - Removed
scf_list_system_capabilities - Removed
scf_list_system_catalog - Removed
scf_list_systems - Removed
scf_list_team_assignments - Removed
scf_list_teams - Removed
scf_list_vendor_action_items - Removed
scf_list_vendor_assessments - Removed
scf_list_vendor_certifications - Removed
scf_list_vendors - Removed
scf_list_webhook_deliveries - Removed
scf_list_webhooks - Removed
scf_list_window_assessments - Added
scf_load_tools - Added
scf_org_read - Removed
scf_preview_catalog_reconciliation - Removed
scf_preview_document - Removed
scf_preview_framework_scope_change - Removed
scf_record_control_validation - Removed
scf_refresh_stale_window_assessments - Removed
scf_remove_custom_risk_control - Removed
scf_remove_engagement_auditor - Removed
scf_remove_team_member - Removed
scf_resolve_document_section - Removed
scf_respond_to_engagement_query - Removed
scf_revalidate_evidence_file - Removed
scf_review_evidence_assessment - Removed
scf_review_evidence_file - Removed
scf_review_window_assessment - Removed
scf_review_window_assessment_verdict - Added
scf_risk_read - Added
scf_risk_write - Removed
scf_rollback_catalog_reconciliation - Removed
scf_rotate_webhook_secret - Removed
scf_scope_framework - Removed
scf_set_control_basis_override - Removed
scf_set_control_materiality - Removed
scf_set_control_procedure - Removed
scf_set_framework_basis - Removed
scf_set_reconciliation_actions - Removed
scf_set_scope_override - Removed
scf_set_target_maturity - Added
scf_system_read - Added
scf_system_write - Removed
scf_take_posture_snapshot - Removed
scf_transition_document - Removed
scf_trigger_evidence_assessment - Removed
scf_trigger_vendor_assessment - Removed
scf_trigger_vendor_research - Removed
scf_trigger_window_assessment - Removed
scf_update_capability_test - Removed
scf_update_comment - Removed
scf_update_compensating_control - Removed
scf_update_custom_risk - Removed
scf_update_custom_risk_control - Removed
scf_update_deficiency - Removed
scf_update_document_section - Removed
scf_update_document_settings - Removed
scf_update_engagement - Removed
scf_update_engagement_query_status - Removed
scf_update_evidence - Removed
scf_update_evidence_task - Removed
scf_update_org_compensating_control - Removed
scf_update_risk_assessment - Removed
scf_update_scoped_control - Removed
scf_update_system - Removed
scf_update_system_capability - Removed
scf_update_team - Removed
scf_update_vendor - Removed
scf_update_vendor_action_item - Removed
scf_update_vendor_certification - Added
scf_user_read - Added
scf_vendor_read - Added
scf_vendor_record_write - Added
scf_vendor_write
43 tool updates
v3.7.2- Added
scf_accept_risk - Added
scf_add_capability_test_finding - Changed
scf_add_custom_risk_control1 field changed- added
Input schema / properties / document_idAdded value: +{ + "description": "Organisation document that sets the standard this risk is an exception against — obtain from scf_list_documents (404 if not this org's). A link with a document makes the custom risk a standards exception", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +}
- Changed
scf_batch_update_controls2 fields changed- changed
Input schema / properties / operations / items / properties / implementation_status / descriptionPrevious value: -"Implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, deferred"New value: +"Implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, deferred. at_risk raises a deficiency; not_applicable on a material control needs an admin (403)" - changed
Input schema / properties / operations / items / properties / selected / descriptionPrevious value: -"Toggle in-scope membership"New value: +"Toggle in-scope membership. Deselecting an MCR-basis or material control is refused (409) — use scf_set_scope_override"
- Changed
scf_bulk_unscope_framework1 field changed- changed
Input schema / properties / removal_reason / descriptionPrevious value: -"Why these controls leave scope — recorded in the audit trail"New value: +"Why these controls leave scope — recorded in the audit trail. Required (400 without it), with an admin key (403 otherwise), when a framework carries an MCR obligation or its removal would take a material control out of scope"
- Added
scf_create_capability_test - Added
scf_create_deficiency - Added
scf_create_org_compensating_control - Changed
scf_create_system6 fields changed- added
Input schema / properties / criticalityAdded value: +{ + "description": "Business criticality — one of: low, medium, high, critical", + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "type": "string" +} - added
Input schema / properties / data_classificationAdded value: +{ + "description": "Highest classification of data held — one of: public, internal, confidential, restricted", + "enum": [ + "public", + "internal", + "confidential", + "restricted" + ], + "type": "string" +} - added
Input schema / properties / hosting_locationAdded value: +{ + "description": "Where the system runs, e.g. a cloud region or data centre", + "maxLength": 255, + "type": "string" +} - added
Input schema / properties / in_scopeAdded value: +{ + "description": "Inside the assessment boundary (true) or outside (false); omit when not decided", + "type": "boolean" +} - added
Input schema / properties / rpo_hoursAdded value: +{ + "description": "Recovery point objective, in hours (≥ 0)", + "minimum": 0, + "type": "number" +} - added
Input schema / properties / rto_hoursAdded value: +{ + "description": "Recovery time objective, in hours (≥ 0)", + "minimum": 0, + "type": "number" +}
- Changed
scf_create_vendor3 fields changed- added
Input schema / properties / data_locationAdded value: +{ + "description": "Where the vendor stores or processes our data", + "maxLength": 255, + "type": "string" +} - added
Input schema / properties / flow_down_requirementsAdded value: +{ + "description": "Requirements passed down to the vendor by contract", + "type": "string" +} - added
Input schema / properties / shared_responsibility_noteAdded value: +{ + "description": "Who is responsible for what between us and the vendor", + "type": "string" +}
- Changed
scf_generate_documents1 field changed- changed
Input schema / properties / requests / items / properties / generator / descriptionPrevious value: -"Generator name from scf_list_document_generators"New value: +"Generator name from scf_list_document_generators, e.g. 'soa' or 'governance-report' (the Governance Oversight Report for board due-care review; not domain-scoped)"
- Added
scf_get_capability_test - Added
scf_get_deficiency - Added
scf_get_deficiency_summary - Added
scf_get_org_compensating_control - Added
scf_get_org_settings - Added
scf_get_posture_snapshot - Changed
scf_import_journey1 field changed- changed
Input schema / properties / template / properties / stages / items / properties / precondition_spec / descriptionPrevious value: -"Machine-checked preconditions evaluated for display only — they never advance a stage on their own"New value: +"Machine-checked preconditions evaluated for display only — they never advance a stage on their own. Each entry is {type, label?, ...params}; an unknown type or a parameter the type does not take reads as 'cannot evaluate', never as met. Types: frameworks_scoped(min_count); controls_with_decision, controls_with_owner(min_fraction, domains, scf_ids); controls_at_status(statuses, min_fraction, domains, scf_ids); controls_at_risk_max(max_count, domains, scf_ids); documents_approved(min_count, generator e.g. 'soa' or '<generator>:<domain>' such as 'policy:GOV', within_days 1–3660 = approved in the last N days); evidence_items_tracked(min_count); evidence_files_uploaded(min_count); evidence_upload_spread_days(min_days, default 30); engagement_exists; frameworks_with_basis(basis mcr|dsr required, min_count); controls_with_basis(basis?, min_fraction, domains, scf_ids); systems_with_criticality(min_fraction); controls_with_target, controls_at_target(min_fraction, domains, scf_ids); material_controls_at_status(statuses required, min_fraction, domains, scf_ids); risks_accepted_without_approver_max(max_count, default 0); open_deficiencies_max, material_deficiencies_max(max_count default 0, domains); controls_validated_within_cadence(min_fraction, domains, scf_ids); capability_tests_within_days(days 1–3660 required, min_count default 1, test_types: incident_response|continuity|other). scf_ids and domains apply only where listed; an unknown control ID or domain code is refused at upload (422). Example: {\"type\": \"documents_approved\", \"generator\": \"soa\"}. Full table: docs/tools/journey.md"
- Added
scf_list_capability_tests - Added
scf_list_control_validations - Added
scf_list_deficiencies - Added
scf_list_org_compensating_controls - Added
scf_list_posture_snapshots - Changed
scf_list_risks7 fields changed- added
Input schema / properties / acceptance_stateAdded value: +{ + "description": "Accepted risks only, by their approval: 'approved' (in force), 'expired' (past acceptance_expires_on) or 'unapproved' (accepted with no approval recorded)", + "enum": [ + "approved", + "expired", + "unapproved" + ], + "type": "string" +} - added
Input schema / properties / categoryAdded value: +{ + "description": "Filter by catalog risk category code, e.g. 'AC' matches R-AC-N", + "type": "string" +} - removed
Input schema / properties / pageRemoved value: -{ - "default": 1, - "description": "1-indexed page number (default 1)", - "maximum": 9007199254740991, - "minimum": 1, - "type": "integer" -} - removed
Input schema / properties / per_pageRemoved value: -{ - "default": 25, - "description": "Page size (1–100, default 25)", - "maximum": 100, - "minimum": 1, - "type": "integer" -} - added
Input schema / properties / risk_levelAdded value: +{ + "description": "Filter by inherent risk level, banded by the org's risk profile", + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "type": "string" +} - changed
Input schema / properties / status / descriptionPrevious value: -"Filter by treatment status (e.g., 'mitigate', 'accept', 'transfer', 'avoid')"New value: +"Filter by treatment status: identified, analysed, treating, treated, accepted or monitoring (sent as the platform's treatment_status)" - added
Input schema / properties / status / enumAdded value: +[ + "identified", + "analysed", + "treating", + "treated", + "accepted", + "monitoring" +]
- Changed
scf_list_scoped_controls3 fields changed- added
Input schema / properties / basisAdded value: +{ + "description": "Filter by obligation basis: 'mcr', 'dsr', or 'unclassified' (no classified framework and no override). Each row carries obligation_basis, basis_source (override | framework) and basis_override_reason", + "enum": [ + "mcr", + "dsr", + "unclassified" + ], + "type": "string" +} - added
Input schema / properties / materialAdded value: +{ + "description": "Filter by materiality: true for material controls (catalogue weighting 10, or an admin override), false for the rest. Rows carry material, material_source (control | weighting) and material_reason", + "type": "boolean" +} - added
Input schema / properties / sortAdded value: +{ + "default": "scf_id", + "description": "Order: 'scf_id' (default), or 'weighting' — material controls first, then catalogue weighting highest first, then scf_id. Rows also carry target_maturity, target_source (control | domain), target_maturity_reason, procedure_document_id, procedure_document_status, last_validated_at, last_validated_by and last_validation_note", + "enum": [ + "scf_id", + "weighting" + ], + "type": "string" +}
- Changed
scf_list_systems1 field changed- added
Input schema / properties / in_scopeAdded value: +{ + "description": "Filter by assessment boundary: 'true' (inside), 'false' (outside) or 'undecided' (not recorded)", + "enum": [ + "true", + "false", + "undecided" + ], + "type": "string" +}
- Added
scf_record_control_validation - Added
scf_set_control_basis_override - Added
scf_set_control_materiality - Added
scf_set_control_procedure - Added
scf_set_framework_basis - Changed
scf_set_scope_override1 field changed- changed
Input schema / properties / reason / descriptionPrevious value: -"Why this control is being overridden — recorded in the audit trail (max 2000 characters)"New value: +"Why this control is being overridden — recorded in the audit trail (max 2000 characters). Required for 'exclude'. The admin making an MCR or material exclusion is recorded as its approver; there is no approver parameter"
- Added
scf_set_target_maturity - Added
scf_take_posture_snapshot - Added
scf_update_capability_test - Added
scf_update_custom_risk_control - Added
scf_update_deficiency - Added
scf_update_org_compensating_control - Added
scf_update_org_settings - Changed
scf_update_risk_assessment1 field changed- changed
Input schema / properties / treatment_status / descriptionPrevious value: -"Treatment lifecycle state"New value: +"Treatment lifecycle state. 'accepted' set here records no approval — scf_accept_risk does. Below admin, moving an accepted risk with an approval in force off accepted is ignored (it stays accepted); an admin's move clears the acceptance"
- Changed
scf_update_scoped_control1 field changed- changed
Input schema / properties / implementation_status / descriptionPrevious value: -"New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred"New value: +"New implementation status (lowercase): not_started, in_progress, implemented, ready_for_review, monitored, not_applicable, at_risk, or deferred. Moving to at_risk raises a deficiency (see scf_list_deficiencies). A material control (catalogue weighting 10, or set material by an admin) can only leave scope through scf_set_scope_override by an admin (other paths 409), and only an admin may mark it not_applicable (403 otherwise)."
- Changed
scf_update_system6 fields changed- added
Input schema / properties / criticalityAdded value: +{ + "anyOf": [ + { + "enum": [ + "low", + "medium", + "high", + "critical" + ], + "type": "string" + }, + { + "type": "null" + } + ], + "description": "Business criticality — one of: low, medium, high, critical; null clears" +} - added
Input schema / properties / data_classificationAdded value: +{ + "anyOf": [ + { + "enum": [ + "public", + "internal", + "confidential", + "restricted" + ], + "type": "string" + }, + { + "type": "null" + } + ], + "description": "Highest classification of data held — one of: public, internal, confidential, restricted; null clears" +} - added
Input schema / properties / hosting_locationAdded value: +{ + "anyOf": [ + { + "maxLength": 255, + "type": "string" + }, + { + "type": "null" + } + ], + "description": "Where the system runs; null clears" +} - added
Input schema / properties / in_scopeAdded value: +{ + "description": "Assessment boundary: true (inside), false (outside), or null to mark it undecided", + "type": [ + "boolean", + "null" + ] +} - added
Input schema / properties / rpo_hoursAdded value: +{ + "anyOf": [ + { + "minimum": 0, + "type": "number" + }, + { + "type": "null" + } + ], + "description": "Recovery point objective in hours (≥ 0); null clears" +} - added
Input schema / properties / rto_hoursAdded value: +{ + "anyOf": [ + { + "minimum": 0, + "type": "number" + }, + { + "type": "null" + } + ], + "description": "Recovery time objective in hours (≥ 0); null clears" +}
- Changed
scf_update_vendor3 fields changed- added
Input schema / properties / data_locationAdded value: +{ + "anyOf": [ + { + "maxLength": 255, + "type": "string" + }, + { + "type": "null" + } + ], + "description": "Where the vendor stores or processes our data; null clears" +} - added
Input schema / properties / flow_down_requirementsAdded value: +{ + "description": "Requirements passed down to the vendor by contract; null clears", + "type": [ + "string", + "null" + ] +} - added
Input schema / properties / shared_responsibility_noteAdded value: +{ + "description": "Who is responsible for what between us and the vendor; null clears", + "type": [ + "string", + "null" + ] +}
10 tool updates
v3.6.0- Added
scf_attest_journey_stage - Added
scf_get_framework_scope_summary - Added
scf_get_journey - Added
scf_import_journey - Changed
scf_list_evidence4 fields changed- added
Input schema / properties / accountable_owner_typeAdded value: +{ + "description": "Filter by the accountable team's primary owner: 'internal' or 'external_contractor'", + "enum": [ + "internal", + "external_contractor" + ], + "type": "string" +} - added
Input schema / properties / function_idAdded value: +{ + "description": "Filter to evidence assigned to any team aligned to this function — obtain from scf_list_functions", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / my_teamsAdded value: +{ + "default": false, + "description": "Filter to evidence assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead.", + "type": "boolean" +} - added
Input schema / properties / team_idAdded value: +{ + "description": "Filter to evidence this team is assigned to, accountable or consulted — obtain from scf_list_teams", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +}
- Added
scf_list_journey_templates - Changed
scf_list_scoped_controls4 fields changed- added
Input schema / properties / accountable_owner_typeAdded value: +{ + "description": "Filter by the accountable team's primary owner: 'internal' or 'external_contractor'", + "enum": [ + "internal", + "external_contractor" + ], + "type": "string" +} - added
Input schema / properties / function_idAdded value: +{ + "description": "Filter to controls assigned to any team aligned to this function — obtain from scf_list_functions", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / my_teamsAdded value: +{ + "default": false, + "description": "Filter to controls assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead.", + "type": "boolean" +} - added
Input schema / properties / team_idAdded value: +{ + "description": "Filter to controls this team is assigned to, accountable or consulted — obtain from scf_list_teams", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +}
- Changed
scf_list_teams1 field changed- added
Input schema / properties / mineAdded value: +{ + "default": false, + "description": "Only teams the caller is a member of (default false); each team then also carries membership_role. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead.", + "type": "boolean" +}
- Added
scf_preview_framework_scope_change - Added
scf_set_scope_override
9 tool updates
v3.5.0- Changed
scf_create_system2 fields changed- changed
Input schema / properties / system_type / descriptionPrevious value: -"System classification: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, or custom"New value: +"System classification — one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom" - changed
Input schema / properties / system_type / enumPrevious value: -[ - "cloud_provider", - "identity_provider", - "ticketing", - "logging", - "security_tool", - "code_repository", - "document_management", - "custom" -]New value: +[ + "cloud_provider", + "identity_provider", + "ticketing", + "logging", + "security_tool", + "code_repository", + "document_management", + "endpoint_management", + "vulnerability_management", + "email_security", + "security_awareness", + "password_manager", + "communication", + "hr_system", + "custom" +]
- Changed
scf_create_vendor2 fields changed- changed
Input schema / properties / status / descriptionPrevious value: -"Lifecycle status (default 'prospect')"New value: +"Lifecycle status (default prospect) — one of: prospect, active, under_review, approved, suspended, offboarded" - changed
Input schema / properties / status / enumPrevious value: -[ - "prospect", - "active", - "inactive", - "under_review" -]New value: +[ + "prospect", + "active", + "under_review", + "approved", + "suspended", + "offboarded" +]
- Changed
scf_get_assessment_review_queue1 field changed- added
Input schema / properties / tierAdded value: +{ + "default": "file", + "description": "file (default): entries carry file_id, act with scf_review_evidence_assessment. window: entries carry window_assessment_id, act with scf_review_window_assessment_verdict", + "enum": [ + "file", + "window" + ], + "type": "string" +}
- Added
scf_get_window_assessment_versions - Changed
scf_list_vendors2 fields changed- changed
Input schema / properties / status / descriptionPrevious value: -"Lifecycle status filter"New value: +"Lifecycle status filter — one of: prospect, active, under_review, approved, suspended, offboarded" - changed
Input schema / properties / status / enumPrevious value: -[ - "prospect", - "active", - "inactive", - "under_review" -]New value: +[ + "prospect", + "active", + "under_review", + "approved", + "suspended", + "offboarded" +]
- Changed
scf_review_evidence_assessment2 fields changed- changed
Input schema / properties / ao_overrides / descriptionPrevious value: -"Objectives to re-designate — required (≥1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation"New value: +"Objectives to re-designate — required (≥1) when overriding, forbidden when confirming; unlisted objectives keep the AI's designation. 422 if the version has no per-objective answers: confirm instead" - added
Input schema / properties / ao_overrides / items / properties / ao_id / minLengthAdded value: +1
- Added
scf_review_window_assessment_verdict - Changed
scf_update_system2 fields changed- changed
Input schema / properties / system_type / descriptionPrevious value: -"New system classification"New value: +"New system classification — one of: cloud_provider, identity_provider, ticketing, logging, security_tool, code_repository, document_management, endpoint_management, vulnerability_management, email_security, security_awareness, password_manager, communication, hr_system, custom" - changed
Input schema / properties / system_type / enumPrevious value: -[ - "cloud_provider", - "identity_provider", - "ticketing", - "logging", - "security_tool", - "code_repository", - "document_management", - "custom" -]New value: +[ + "cloud_provider", + "identity_provider", + "ticketing", + "logging", + "security_tool", + "code_repository", + "document_management", + "endpoint_management", + "vulnerability_management", + "email_security", + "security_awareness", + "password_manager", + "communication", + "hr_system", + "custom" +]
- Changed
scf_update_vendor2 fields changed- changed
Input schema / properties / status / descriptionPrevious value: -"New lifecycle status"New value: +"New lifecycle status — one of: prospect, active, under_review, approved, suspended, offboarded" - changed
Input schema / properties / status / enumPrevious value: -[ - "prospect", - "active", - "inactive", - "under_review" -]New value: +[ + "prospect", + "active", + "under_review", + "approved", + "suspended", + "offboarded" +]
65 tool updates
v3.4.2- Added
scf_add_team_member - Added
scf_batch_create_team_assignments - Added
scf_batch_update_evidence - Added
scf_bulk_unscope_framework - Added
scf_complete_evidence_task - Added
scf_create_assignment - Added
scf_create_comment - Added
scf_create_compensating_control - Added
scf_create_evidence_task - Changed
scf_create_risk2 fields changed- changed
Input schema / properties / treatment_status / descriptionPrevious value: -"Treatment status: 'mitigate', 'accept', 'transfer', or 'avoid'"New value: +"Treatment workflow status (default identified)" - added
Input schema / properties / treatment_status / enumAdded value: +[ + "identified", + "analysed", + "treating", + "treated", + "accepted", + "monitoring" +]
- Added
scf_create_system_capability - Added
scf_create_team - Added
scf_create_team_assignment - Added
scf_create_vendor_action_item - Added
scf_create_vendor_certification - Added
scf_delete_assignment - Added
scf_delete_comment - Added
scf_delete_compensating_control - Added
scf_delete_evidence_file - Added
scf_delete_risk_assessment - Added
scf_delete_team_assignment - Added
scf_delete_vendor_action_item - Added
scf_delete_vendor_certification - Added
scf_get_assessment_review_queue - Changed
scf_get_audit_log13 fields changed- added
Input schema / properties / actionAdded value: +{ + "description": "Filter by action: create, update or delete", + "enum": [ + "create", + "update", + "delete" + ], + "type": "string" +} - added
Input schema / properties / action_sourceAdded value: +{ + "description": "Filter by origin of the change: ui, api_key, mcp or system", + "enum": [ + "ui", + "api_key", + "mcp", + "system" + ], + "type": "string" +} - added
Input schema / properties / actor_idAdded value: +{ + "description": "Filter by actor user UUID — platform alias of changed_by_user_id", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / changed_by_user_idAdded value: +{ + "description": "Filter by the user who made the change — obtain from scf_list_members", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / date_fromAdded value: +{ + "description": "Include changes at or after this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ)", + "type": "string" +} - added
Input schema / properties / date_toAdded value: +{ + "description": "Include changes at or before this ISO-8601 timestamp (YYYY-MM-DDTHH:MM:SSZ)", + "type": "string" +} - added
Input schema / properties / entity_idAdded value: +{ + "description": "Filter by the changed entity's UUID", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / entity_typeAdded value: +{ + "description": "Filter by exact entity type as written in the log, e.g. scoped_control, evidence_file, audit_engagement, vendor — unsure of the spelling? use search_text", + "type": "string" +} - changed
Input schema / properties / limit / descriptionPrevious value: -"Page size (1–100, default 50)"New value: +"Page size (1–200, default 50)" - changed
Input schema / properties / limit / maximumPrevious value: -100New value: +200 - added
Input schema / properties / request_idAdded value: +{ + "description": "Filter by request correlation ID — groups every change one API call made", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / scf_idAdded value: +{ + "description": "Filter by SCF control ID in DOMAIN-NN format", + "type": "string" +} - added
Input schema / properties / search_textAdded value: +{ + "description": "Case-insensitive search across entity_type, field_name, old_value and new_value", + "type": "string" +}
- Added
scf_get_catalog_evidence - Added
scf_get_change_cursor - Added
scf_get_controls_for_risk - Added
scf_get_domain - Added
scf_get_evidence - Added
scf_get_frequency_health - Added
scf_get_org_work_queue - Added
scf_get_risk_profile - Added
scf_get_risks_for_control - Added
scf_get_system - Added
scf_get_systems_for_evidence - Added
scf_get_team - Added
scf_get_upcoming_evidence - Added
scf_list_assignments - Added
scf_list_comments - Added
scf_list_compensating_controls - Changed
scf_list_engagement_queries1 field changed- added
Input schema / properties / status / enumAdded value: +[ + "open", + "answered", + "closed" +]
- Changed
scf_list_engagements2 fields changed- changed
Input schema / properties / status / descriptionPrevious value: -"Filter by engagement status (e.g. 'planning', 'fieldwork', 'closed')"New value: +"Filter by engagement status: draft, active, under_review or closed" - added
Input schema / properties / status / enumAdded value: +[ + "draft", + "active", + "under_review", + "closed" +]
- Changed
scf_list_evidence_tasks8 fields changed- added
Input schema / properties / assigned_to_meAdded value: +{ + "description": "Only tasks assigned to the caller", + "type": "boolean" +} - changed
Input schema / properties / assignee / descriptionPrevious value: -"Filter by assigned user ID"New value: +"Filter by assigned user UUID" - added
Input schema / properties / assignee / formatAdded value: +"uuid" - added
Input schema / properties / assignee / patternAdded value: +"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$" - added
Input schema / properties / evidence_tracking_idAdded value: +{ + "description": "Only tasks for one evidence tracking record", + "format": "uuid", + "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", + "type": "string" +} - added
Input schema / properties / overdue_onlyAdded value: +{ + "description": "Only tasks past their due date", + "type": "boolean" +} - changed
Input schema / properties / status / descriptionPrevious value: -"Filter by task status (e.g., 'open', 'in_progress', 'done')"New value: +"Filter by task status: not_started, in_progress or completed" - added
Input schema / properties / status / enumAdded value: +[ + "not_started", + "in_progress", + "completed" +]
- Added
scf_list_functions - Added
scf_list_system_capabilities - Added
scf_list_team_assignments - Added
scf_list_teams - Added
scf_list_vendor_action_items - Added
scf_list_vendor_certifications - Added
scf_mark_notifications_read - Added
scf_refresh_stale_window_assessments - Added
scf_remove_team_member - Added
scf_review_evidence_assessment - Added
scf_review_evidence_file - Added
scf_review_window_assessment - Added
scf_update_comment - Added
scf_update_compensating_control - Changed
scf_update_engagement2 fields changed- changed
Input schema / properties / status / descriptionPrevious value: -"New engagement status (e.g. 'fieldwork', 'closed')"New value: +"New engagement status: draft, active, under_review or closed" - added
Input schema / properties / status / enumAdded value: +[ + "draft", + "active", + "under_review", + "closed" +]
- Added
scf_update_evidence_task - Added
scf_update_risk_assessment - Added
scf_update_system_capability - Added
scf_update_team - Added
scf_update_vendor_action_item - Added
scf_update_vendor_certification
7 tool updates
v3.0.0- Removed
scf_accept_cdm_proposal - Removed
scf_dismiss_cdm_proposal - Removed
scf_get_cdm_document_map - Removed
scf_list_cdm_documents - Removed
scf_list_cdm_mappings - Removed
scf_list_cdm_proposals - Removed
scf_query_cdm_corpus
51 tool updates
v2.1.0- Added
scf_accept_cdm_proposal - Added
scf_add_engagement_auditor - Added
scf_apply_catalog_reconciliation - Added
scf_cancel_catalog_reconciliation - Added
scf_create_engagement - Added
scf_create_engagement_query - Added
scf_delete_engagement - Added
scf_dismiss_cdm_proposal - Added
scf_export_document - Added
scf_generate_documents - Added
scf_get_catalog_changelog - Added
scf_get_catalog_reconciliation_status - Added
scf_get_cdm_document_map - Added
scf_get_document - Added
scf_get_document_generation_status - Added
scf_get_document_history - Added
scf_get_document_section_generated - Added
scf_get_document_settings - Added
scf_get_engagement - Added
scf_get_engagement_presentation - Added
scf_get_engagement_query - Added
scf_get_engagement_scope - Added
scf_get_reconciliation_run - Changed
scf_list_assessment_objectives1 field changed- added
Input schema / properties / include_deprecatedAdded value: +{ + "description": "Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.", + "type": "boolean" +}
- Added
scf_list_cdm_documents - Added
scf_list_cdm_mappings - Added
scf_list_cdm_proposals - Changed
scf_list_controls1 field changed- added
Input schema / properties / include_deprecatedAdded value: +{ + "description": "Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.", + "type": "boolean" +}
- Added
scf_list_document_domains - Added
scf_list_document_generators - Added
scf_list_documents - Changed
scf_list_domains1 field changed- added
Input schema / properties / include_deprecatedAdded value: +{ + "description": "Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.", + "type": "boolean" +}
- Added
scf_list_engagement_auditors - Added
scf_list_engagement_queries - Added
scf_list_engagements - Changed
scf_list_evidence_catalog1 field changed- added
Input schema / properties / include_deprecatedAdded value: +{ + "description": "Include catalog rows deprecated by a later SCF version. Default false — the catalog answers with active rows only, and deprecated rows carry a lifecycle badge when included.", + "type": "boolean" +}
- Added
scf_list_my_engagements - Added
scf_list_reconciliation_runs - Added
scf_preview_catalog_reconciliation - Added
scf_preview_document - Added
scf_query_cdm_corpus - Added
scf_remove_engagement_auditor - Added
scf_resolve_document_section - Added
scf_respond_to_engagement_query - Added
scf_rollback_catalog_reconciliation - Added
scf_set_reconciliation_actions - Added
scf_transition_document - Added
scf_update_document_section - Added
scf_update_document_settings - Added
scf_update_engagement - Added
scf_update_engagement_query_status
88 tool updates
v1.7.0- First observed
scf_add_custom_risk_control - First observed
scf_batch_update_controls - First observed
scf_bulk_assess_evidence - First observed
scf_bulk_assess_windows - First observed
scf_create_custom_risk - First observed
scf_create_evidence - First observed
scf_create_risk - First observed
scf_create_system - First observed
scf_create_vendor - First observed
scf_create_webhook - First observed
scf_delete_custom_risk - First observed
scf_delete_webhook - First observed
scf_generate_system_recipes - First observed
scf_get_audit_log - First observed
scf_get_capability_theme - First observed
scf_get_capability_theme_evidence_posture - First observed
scf_get_capability_theme_scorecard - First observed
scf_get_control - First observed
scf_get_control_assessment_composite - First observed
scf_get_current_user - First observed
scf_get_evidence_assessment - First observed
scf_get_evidence_assessment_summary - First observed
scf_get_evidence_file - First observed
scf_get_evidence_health - First observed
scf_get_evidence_item_maturity - First observed
scf_get_evidence_maturity - First observed
scf_get_evidence_suggestions - First observed
scf_get_evidence_upgrade_recommendations - First observed
scf_get_evidence_validation - First observed
scf_get_evidence_validation_summary - First observed
scf_get_latest_vendor_assessment - First observed
scf_get_notifications - First observed
scf_get_organization - First observed
scf_get_recipe_generation_status - First observed
scf_get_risk - First observed
scf_get_risk_matrix - First observed
scf_get_risk_summary - First observed
scf_get_scoped_control - First observed
scf_get_scoping_stats - First observed
scf_get_system_catalog_template - First observed
scf_get_system_recipes - First observed
scf_get_vendor - First observed
scf_get_vendor_assessment - First observed
scf_get_vendor_assessment_status - First observed
scf_get_vendor_research - First observed
scf_get_webhook - First observed
scf_get_window_assessment - First observed
scf_get_window_assessment_summary - First observed
scf_get_work_queue - First observed
scf_list_assessment_objectives - First observed
scf_list_capabilities - First observed
scf_list_capability_theme_controls - First observed
scf_list_capability_themes - First observed
scf_list_control_assessment_composites - First observed
scf_list_controls - First observed
scf_list_custom_risk_controls - First observed
scf_list_custom_risks - First observed
scf_list_domains - First observed
scf_list_evidence - First observed
scf_list_evidence_catalog - First observed
scf_list_evidence_files - First observed
scf_list_evidence_gaps - First observed
scf_list_evidence_tasks - First observed
scf_list_frameworks - First observed
scf_list_members - First observed
scf_list_organizations - First observed
scf_list_risks - First observed
scf_list_scoped_controls - First observed
scf_list_system_catalog - First observed
scf_list_systems - First observed
scf_list_vendor_assessments - First observed
scf_list_vendors - First observed
scf_list_webhook_deliveries - First observed
scf_list_webhooks - First observed
scf_list_window_assessments - First observed
scf_remove_custom_risk_control - First observed
scf_revalidate_evidence_file - First observed
scf_rotate_webhook_secret - First observed
scf_scope_framework - First observed
scf_trigger_evidence_assessment - First observed
scf_trigger_vendor_assessment - First observed
scf_trigger_vendor_research - First observed
scf_trigger_window_assessment - First observed
scf_update_custom_risk - First observed
scf_update_evidence - First observed
scf_update_scoped_control - First observed
scf_update_system - First observed
scf_update_vendor
TDQS
Scored across 26 tools
Most tools are cleanly partitioned by domain (evidence, risks, vendors, controls, systems) and by read vs write, so tool selection is usually straightforward. However, the evidence area has several adjacent tools (tracking, files, tasks, and AI assessments), and work-queue/notification operations appear across org/user reads and standalone notification tools, creating some boundary ambiguity.
The dominant pattern is scf_<domain>_<read|write>, used consistently across most paired domains. A few standalone names switch to verb_noun form (scf_load_tools, scf_list_evidence_tasks, scf_mark_notifications_read, scf_update_org_settings), and there are asymmetric pairs such as evidence_task_write with no matching read, so it is not fully uniform.
26 tools is heavy for a single server and sits above the typical 3–15 range. The breadth of the SCF domain and the read/write pairing across many entities make it less excessive than the raw count suggests, but it is still borderline crowded and some standalone tools could be consolidated.
Core SCF operations are well covered: catalog/reference reads, control scoping, evidence tracking/files/tasks, assessments, risks, vendors, systems, org settings, and user notifications mostly have read and write paths. Gaps remain: evidence-task reading is only exposed via a list tool, notification reading is implied but not present as its own tool, and org/member administration is limited; load_tools mitigates missing groups but the current surface is not fully complete.
Maintenance
Related MCP Connectors
Compliance frameworks (SOC 2, ISO 27001, CMMC, NIST, more) delivered to AI agents as MCP tools.
AI-native GRC: compliance scores, security findings, tickets and agent trust tiers.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Related MCP Servers
- FlicenseCqualityBmaintenanceEnables AI agents to interact with the ComplianceCow platform to retrieve compliance insights, dashboard data, and auditable evidence through a Compliance Graph. It also supports automated remediation actions such as fixing policies and creating tickets in external tools.10013-
- FlicenseNot gradedqualityCmaintenanceEnables AI assistants to query software supply chain compliance data, including asset status, security vulnerabilities, and evidence lineage. It allows for natural language analysis of compliance posture, policy violations, and deployment blockers across an organization.-
- AlicenseNot gradedqualityDmaintenanceProvides comprehensive access to NIST cybersecurity frameworks and controls, enabling AI assistants and applications to query, analyze, and manage NIST security controls through a standardized interface.10MIT
- AlicenseAqualityCmaintenanceEnables searching and bidirectional mapping of 1,451 security controls across 262 SCF-mapped frameworks, including ISO 27001, NIST CSF, DORA, and many others, through natural language queries.14701 PyPI9Apache 2.0