Skip to main content
Glama
Mipiti
by Mipiti

Auto Map Controls

auto_map_controls

Map existing threat model controls to compliance framework requirements automatically. Runs as a background job and returns the completed mappings.

Instructions

LLM-map a model's existing controls to a framework's requirements. Requires PRO tier. Mutating: writes control-to-requirement mappings. Runs as a background job (typically 20-45s); this tool waits for completion and returns the result.

Sits between the manual map_control_to_requirement (one mapping at a time) and the full auto_remediate_compliance loop (which also excludes non-applicable requirements and proposes new entities for remaining gaps). auto_map_controls only creates mappings from controls that already exist — it never adds or excludes entities.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
model_idYesID of the threat model.
control_idNoOptional single control ID to map; omit to map all of the model's controls.
framework_idYesID of the compliance framework.
server_versionYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv0.66.0
    • changedInput schema / properties / control_id / description
      Previous value: -"Optional specific control to map."New value: +"Optional single control ID to map; omit to map all of the model's controls."
  2. Addedv0.62.2
  3. Removedv0.62.0
  4. First observedv0.57.0

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states the operation is mutating, runs as a background job, waits for completion, returns results, requires PRO tier, and only maps existing controls. This is strong transparency for a complex asynchronous write operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and constraint, followed by concise behavioral details and then sibling differentiation. Every sentence contributes useful information with minimal jargon or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's complexity — async, mutating, tier-gated, with multiple sibling tools — the description covers what it does, how it behaves, its scope limitations, and its relationship to alternatives. The presence of an output schema means return-value detail is not required here. This is a complete and actionable description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema already documents model_id, control_id, and framework_id. The description adds context about 'existing controls' and 'never adds or excludes entities,' which indirectly clarifies scope, but it does not add meaningful per-parameter semantics beyond the schema, especially for server_version.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'LLM-map a model's existing controls to a framework's requirements.' It clearly distinguishes itself from siblings by naming map_control_to_requirement and auto_remediate_compliance and explaining how auto_map_controls differs from both.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage placement is provided: it 'sits between' the manual single-mapping tool and the full auto-remediation loop. It also states exactly what it does not do — it never adds or excludes entities — so an agent can decide when to prefer it over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools