Skip to main content
Glama
Mipiti
by Mipiti

Add Assumption

add_assumption

Create a model assumption to document external security properties or resolve indeterminate CO verdicts by attaching exclusion predicates for deterministic unreachable assessments.

Instructions

Add an assumption. Creates a new model version. Returns {model, entities, ...}: the model's id, version and title, and entities.assumptions the assumption as created.

Assumptions represent security properties outside the system owner's trust boundary. When linked to COs and attested, they mitigate those COs in the assessment.

Optionally attach a structured exclusion predicate (the exclusion_* params). The reachability composer matches active

  • attested assumptions with predicates against COs deterministically — class-3 (deterministic computation) evidence in addition to the operator-attested class-1 evidence. Pass any subset of the fields; unspecified fields default to wildcard ("*"). When exclusion_co_ids is non-empty, it takes precedence over the match fields.

Use this to resolve a CO whose composer verdict is indeterminate because no structural primitive backs an operator non-applicability claim: set exclusion_co_ids=<co_id> (and optionally the attacker/asset/property fields), and the composer will derive unreachable / reason: assumption_excludes on subsequent loads, with the assumption's structured predicate as the audit-trail cause.

Input Schema

NameRequiredDescriptionDefault
model_idYesID of the threat model.
descriptionYesWhat is assumed (e.g., "Customer restricts CI runner egress").
linked_co_idsNoOptional comma-separated CO IDs this assumption covers.
server_versionYes
assumption_typeNo"external" (default, allows manual attestation) or "non_applicability" (requires CI verification, no manual attestation).external
exclusion_co_idsNoComma-separated CO IDs the predicate matches explicitly. When non-empty, overrides the match fields.
exclusion_asset_idNo"*" or concrete asset ID.
exclusion_attacker_idNoPredicate match — "*" wildcard (default when any other exclusion_* param is set) or concrete attacker ID.
exclusion_property_matchNo"C" | "I" | "A" | "U" | "*".
exclusion_attacker_vectorNoOne of "Network" | "Adjacent" | "Local" | "Physical" | "*".
exclusion_asset_component_idNo"*" or concrete component ID.

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.62.2
  2. Removedv0.62.0
  3. First observedv0.57.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the disclosure load, and it does well: it declares the mutation's side effect (a new model version is created), describes the deterministic composer matching behavior and its downstream effect ('unreachable / reason: assumption_excludes'), and notes class-1 vs class-3 evidence. It omits reversibility (undo_model_change exists), permission/attestation requirements for the caller, and validation failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and return shape, then domain meaning, then the exclusion-predicate mechanic, then the specific use case. Every paragraph adds new information; there is no filler or repetition, even at roughly 230 words for an 11-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter mutation with an output schema and no annotations, the description supplies the domain model, the mutation side effect, predicate semantics, and the primary use case. The return-shape sentence is partly redundant with the output schema, and the attestation workflow (submit_attestation, assumption_type differences) is left to sibling schemas, so it is strong but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 91%, so the baseline is 3; the description earns above that by explaining the exclusion_* family as a predicate with wildcard defaults ('unspecified fields default to wildcard'), the precedence of exclusion_co_ids, and the mechanic that makes the params meaningful. It adds little on assumption_type and server_version beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Add an assumption') plus the concrete side effect ('Creates a new model version'), and explains what an assumption means in this domain. It does not explicitly distinguish itself from the sibling edit_assumption or convert_assumption_to_controls, but the add-vs-edit split is inferable from names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete when-to-use recipe: invoke this when a CO's composer verdict is 'indeterminate' because no structural primitive backs an operator non-applicability claim, then set exclusion_co_ids=<co_id>. Also states precedence ('exclusion_co_ids takes precedence over the match fields'). It stops short of explaining when to use linked_co_ids/attestation versus the exclusion predicate path, or when a user should prefer an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools