Mipiti MCP Server

Overview Schema Source Related Servers Discussions Admin

Add Proposed Attacker

add_proposed_attacker

Add a proposed attacker to a threat model by specifying credential classes and a zone. This action registers the attacker within tenant-isolation boundaries, creating a new version of the security model.

Instructions

Add the attacker the attacker closure proposes for a credential set. Mutating; creates a model version.

Name the proposal by its credential_classes as get_behavioural_attackers lists it (a dismissed one may be added), and a part of the zones nobody stands at by one of its zones where another proposal holds the same classes. The attacker holds them, with the privileges they give and no position but the tenant-isolation boundaries a per-tenant holder is placed at. It is rated as add_attacker rates: one call before the write, charged to the caller, its privileges the ones it holds gives. Where no rating answers, or when a person accepts a parked addition, it is added unrated (rating_source: "unrated"), and reevaluate_threat_model_factors with unrated_only rates it. Refused with 409 not_proposed when no attacker is proposed for exactly that set now (read the attackers again), 409 ambiguous_proposal when several are and no zone names one (its zones lists each), 409 closure_not_offered, 422 unknown_class.

A program's addition is a judgment. Unless the workspace's delegation policy admits it, it is refused with 403 and an escalation_id and parked for a person. Do not retry: report the escalation_id and poll list_proposals.

Returns {model_id, model_version, applies, credential_classes, counts, added, rating_source}: how many proposals, dismissals and questions the closure now holds, added, the new attacker's id, and whether a rating answered (unrated when none did).

Input Schema

Name	Required	Description
`zone`	No	A zone of the part to add, where two proposals hold the same classes; empty otherwise.
`model_id`	Yes	ID of the threat model.
`server_version`	Yes
`credential_classes`	No	Comma-separated class ids of the proposal; empty for the one holding none.

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.94.0Oct 25, 2026

addedInput schema / properties / zone

Added value: +{
+  "default": "",
+  "description": "A zone of the part to add, where two proposals hold the same\nclasses; empty otherwise.",
+  "type": "string"
+}

Addedv0.90.0Oct 22, 2026

TDQS

A4.1/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does: it declares the mutation and model-version creation, the rating side effect ('one call before the write, charged to the caller'), the unrated fallback with rating_source, and permission behavior (403 plus escalation_id, parked for a person). It enumerates the failure taxonomy (409 not_proposed / ambiguous_proposal / closure_not_offered, 422 unknown_class), which is exactly the context an agent cannot get from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and mutation flag are correctly front-loaded, but the prose is dense and occasionally unparseable ('no position but the tenant-isolation boundaries a per-tenant holder is placed at'). The closing 'Returns {model_id, ...}' sentence partly duplicates the existing output schema, spending length on data the agent already receives.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating, escalation-prone tool this is well covered: proposal selection, zone disambiguation, rating/unrated state, error codes, and escalation polling are all present, and the output schema handles return shape. The gap is minor — server_version is unexplained and the relationship to add_attacker is unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema already defines credential_classes and zone. The description still adds real sourcing semantics — credential_classes 'as get_behavioural_attackers lists it' and zone only needed 'where another proposal holds the same classes' — which tells the agent how to derive values, not just their type. server_version gets no explanation, keeping it short of a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: 'Add the attacker the attacker closure proposes for a credential set,' plus 'Mutating; creates a model version.' It implicitly separates itself from the sibling add_attacker (proposal-driven) and from dismiss_proposed_attacker, but never names add_attacker as the alternative for manual attackers, leaving one plausible confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete preconditions (name the proposal as get_behavioural_attackers lists it; a dismissed one may be added; use zone where another proposal holds the same classes) and prescriptive recovery on 403 ('Do not retry: report the escalation_id and poll list_proposals'). Missing an explicit 'use add_attacker instead when...' exclusion, so not a full when-not/alternatives treatment.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server