Mipiti MCP Server

Overview Schema Source Related Servers Discussions Admin

Edit Attacker

edit_attacker

Updates an attacker’s attributes, attack factors, and attestations in a threat model, changing only specified fields and returning the revised attacker.

Instructions

Edit an attacker; only the fields given change.

capability names the operations performable from the position ("From [position], the attacker can …"), else it gets a quality_warning. Identity fields are LLM-gated. The composed likelihood comes from the factors. An edit of attack_vector or privileges_required creates a model version (reachability reads both); other factor edits are recorded as rating revisions. Over a pending rating (rating_pending), a factor edit settles the pair, a judgment (rating_reconfirmed). New words are rated for (one call, at your cost); a person's rating is kept, the new one held pending, and attested or holdings-given privileges never move. Adopting advice is your own edit. The answer's model is the model's id, version and title; entities.attackers the attacker as it now stands.

Attesting is a judgment: a person's edit attests what it writes (trust_boundary_ids, privileges_required, surface_extent) and attest_* attests the value as it stands. A program attests only under a workspace rule for that attestation; otherwise its edit lands unattested and the answer's attestation names the parked escalation_id (never a 403). A refused program's extent never lowers an attested one. "point" is REFUSED where an asset of the attacker's objectives sits on several components and is not split-knowledge, and never makes a universal clause existential.

400 when factor fields, surface_extent, attest_surface_extent or attest_privileges come without change_reason; 503/502 on an evaluator outage or malformed answer or a failed rating call. 409 when the model changed since it was read: read it again. 409 privileges_from_holdings for a privileges change on an attacker whose credential classes are stated: its privileges follow from them, so say what it holds instead (answer_attacker_credentials).

Input Schema

Name	Required	Description
`model_id`	Yes
`position`	No
`archetype`	No
`capability`	No
`attacker_id`	Yes
`attack_vector`	No	Network \| Adjacent \| Local \| Physical.
`change_reason`	No	Why; required as above.
`server_version`	Yes
`surface_extent`	No	``whole`` (any entry of the interface reached) or ``point`` (one named entry).
`attest_position`	No	true attests the current position.
`user_interaction`	No	None \| Required.
`attack_complexity`	No	Low \| High.
`attest_privileges`	No	true attests the current ``privileges_required``, whatever its value.
`trust_boundary_ids`	No	Comma-separated ids of the boundaries the attacker has crossed; replaces the set.
`privileges_required`	No	None \| Low \| High.
`likelihood_rationale`	No
`attest_surface_extent`	No	true attests the current extent.
`capability_prevalence`	No	Commodity \| Targeted \| Rare.

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed17 schema fields changedv0.87.0Oct 14, 2026

removedInput schema / properties / archetype / description
```
Removed value: -"New archetype (optional)."
```

changedInput schema / properties / attack_complexity / description

Previous value: -"\"Low\" | \"High\"."New value: +"Low | High."

changedInput schema / properties / attack_vector / description

Previous value: -"\"Network\" | \"Adjacent\" | \"Local\" | \"Physical\"."New value: +"Network | Adjacent | Local | Physical."

removedInput schema / properties / attacker_id / description
```
Removed value: -"ID of the attacker (e.g., \"T1\")."
```

changedInput schema / properties / attest_position / description

Previous value: -"Operator-attest the attacker's current position without\nchanging it — e.g. to confirm a fully external attacker's empty\ncrossed set so an objective blocked on an unpositioned attacker can\nbe resolved. Pass ``true`` to attest."New value: +"true attests the current position."

addedInput schema / properties / attest_privileges

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "true attests the current ``privileges_required``,\nwhatever its value."
+}

changedInput schema / properties / attest_surface_extent / description

Previous value: -"Record the extent already on the attacker as\nattested, without changing its value. Pass ``true`` to attest;\nrequires ``change_reason``."New value: +"true attests the current extent."

removedInput schema / properties / capability / description
```
Removed value: -"New capability (optional)."
```

changedInput schema / properties / capability_prevalence / description

Previous value: -"\"Commodity\" | \"Targeted\" | \"Rare\"."New value: +"Commodity | Targeted | Rare."

changedInput schema / properties / change_reason / description

Previous value: -"Required when any factor field, ``surface_extent``\nor ``attest_surface_extent`` is supplied — documents the\noperator override for the audit trail."New value: +"Why; required as above."

removedInput schema / properties / likelihood_rationale / description
```
Removed value: -"New rationale (optional)."
```
removedInput schema / properties / model_id / description
```
Removed value: -"ID of the threat model."
```
removedInput schema / properties / position / description
```
Removed value: -"New position (optional)."
```

changedInput schema / properties / privileges_required / description

Previous value: -"\"None\" | \"Low\" | \"High\"."New value: +"None | Low | High."

changedInput schema / properties / surface_extent / description

Previous value: -"``\"whole\"`` (operations range over ANY entry of the\ninterface reached) or ``\"point\"`` (one named entry). Supplying\nit attests it; requires ``change_reason``."New value: +"``whole`` (any entry of the interface reached) or\n``point`` (one named entry)."

changedInput schema / properties / trust_boundary_ids / description

Previous value: -"Comma-separated trust boundary IDs — the boundaries\nthis attacker has crossed (its position). Replaces the existing set.\nChanging it operator-attests the position, which lets reachability\ntrust it for a decisive verdict."New value: +"Comma-separated ids of the boundaries the\nattacker has crossed; replaces the set."

changedInput schema / properties / user_interaction / description

Previous value: -"\"None\" | \"Required\"."New value: +"None | Required."

Changed3 schema fields changedv0.77.0Sep 9, 2026

addedInput schema / properties / attest_surface_extent

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Record the extent already on the attacker as\nattested, without changing its value. Pass ``true`` to attest;\nrequires ``change_reason``."
+}

changedInput schema / properties / change_reason / description

Previous value: -"Required when any factor field is supplied —\ndocuments the operator override of LLM-generated factors."New value: +"Required when any factor field, ``surface_extent``\nor ``attest_surface_extent`` is supplied — documents the\noperator override for the audit trail."

addedInput schema / properties / surface_extent

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "``\"whole\"`` (operations range over ANY entry of the\ninterface reached) or ``\"point\"`` (one named entry). Supplying\nit attests it; requires ``change_reason``."
+}

Addedv0.62.2Jul 22, 2026
Removedv0.62.0Jul 17, 2026

Changed2 schema fields changedv0.60.1Jul 17, 2026

addedInput schema / properties / attest_position

Added value: +{
+  "anyOf": [
+    {
+      "type": "boolean"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "Operator-attest the attacker's current position without\nchanging it — e.g. to confirm a fully external attacker's empty\ncrossed set so an objective blocked on an unpositioned attacker can\nbe resolved. Pass ``true`` to attest."
+}

changedInput schema / properties / trust_boundary_ids / description

Previous value: -"Comma-separated trust boundary IDs (replaces existing)."New value: +"Comma-separated trust boundary IDs — the boundaries\nthis attacker has crossed (its position). Replaces the existing set.\nChanging it operator-attests the position, which lets reachability\ntrust it for a decisive verdict."

First observedv0.57.0Jul 8, 2026

TDQS

A4.2/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does: it discloses side effects (attack_vector/privileges_required edits create a model version; other factor edits become rating revisions), pending-rating settlement, that a person's kept rating parks a new one as pending, that a program's unattested edit returns an escalation_id instead of a 403, and explicit 400/409/502/503 conditions with the 409 concurrency remedy.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Length is justifiable for an 18-parameter mutation with versioning and attestation semantics, and the first sentence front-loads the core contract. But the body is an undifferentiated block of jargon and doubled-backtick markup with error codes crammed into the final paragraph, which slows an agent that only needs the happy path.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the mutation's side effects, attestation paths, refusal conditions, error taxonomy and concurrency remedy, and even explains what the answer contains (model id/version/title, entities.attackers, attestation.escalation_id) despite an output schema existing. An agent has enough to call this correctly and interpret failures.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

At 61% schema coverage the schema handles several fields, but the description adds meaning the schema does not: change_reason is mandatory for factor fields, surface_extent and the attest_* flags; 'point' is refused under a stated condition; capability must name operations or earns a quality_warning. Position, archetype, likelihood_rationale and capability_prevalence remain unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource plus the key semantic ('only the fields given change'), which immediately signals partial-update behavior and distinguishes it from add_attacker. It names answer_attacker_credentials as the correct tool for the privileges-from-holdings case, but the differentiation is buried in the error paragraph rather than stated up front.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real conditional routing: use attest_* to attest a value as it stands, use answer_attacker_credentials when privileges follow from stated credential classes, and 'point' extent is refused in a specific configuration. It does not, however, state when to use edit_attacker versus add_attacker or reevaluate_threat_model_factors/settle_entity_rating, both of which touch similar rating semantics.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server