Skip to main content
Glama
Sign In
ai-security-wiki

ai-security-wiki

by MathBorgess
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

search_knowledge

Read-onlyIdempotent

Search DASF risks and controls by keyword, ID, or source framework mapping to get paginated, source-backed results for security analysis.

Instructions

Find DASF risks and controls by literal words, IDs or source framework mapping. Paginated source-backed results; use get_risk/get_control for details. Translate natural-language search terms to source English when needed.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "query": "<query>"
    },
    "name": "search_knowledge"
  }
}

Input Schema

NameRequiredDescriptionDefault
kindNoall
limitNo
queryYes
offsetNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, closed-world, non-destructive, so the safety profile is settled. The description adds genuinely non-structured behavior: results are paginated, source-backed, and matched literally rather than semantically, which warns the agent off natural-language queries. It omits ranking/relevance behavior and what happens when nothing matches.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with capability, then results shape, then the alternative tool, then a caveat. Every clause carries information; nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter search tool with a full annotation set and no output schema, this covers capability, likely result shape (paginated, source-backed), and the escalation path. The remaining gap is per-parameter guidance, especially the kind filter, which leaves a little inference to the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the burden. It explains the query parameter well (literal words, IDs, framework mappings) and hints at pagination, but says nothing about the kind enum (risk/control/all), limit bounds, or offset semantics. Partial compensation only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (find) and resource (DASF risks and controls) plus the matching mode (literal words, IDs, source framework mapping), which sharply distinguishes this from detail-fetching siblings. An agent can tell what this does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes to get_risk/get_control for details, which is the key boundary an agent needs. The note about translating natural-language terms to source English clarifies the search mode. It does not address other siblings (scope_risks, investigate_risk, explain_finding), so the routing picture is only partially covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools