Skip to main content
Glama
Mipiti
by Mipiti

Get Composition

get_composition

Retrieve a model's composed view, including its own and inherited entities, objectives, coverage, and attack paths from ancestor models for read-only analysis.

Instructions

A model's composed view: its own entities with everything inherited from its ancestors on the recursive tree. Read-only.

view selects what is returned:

  • overview (default, ~1-2KB, read it first): {model_id, model_version, flag_enabled, tree: {parent_id, ancestor_chain, depth, child_ids}, counts: {entities, control_objectives, reconciliation_candidates}, warnings}.

  • entities: the effective entity set keyed by kind (trust boundaries, components, assets, attackers, attack paths), each entry {kind, qualified_id, owner_model_id, owner_title, origin, entity}. Paginated (page, page_size); kind (e.g. "attackers") keeps one kind.

  • objectives: effective COs {co_qid, asset_qid, attacker_qid, security_properties, origin}, where origin is own, cross (inherited, with a local asset or attacker) or inherited.

  • coverage: per effective CO {co_qid, is_covered, own_credit, inherited_credit, contributing_controls} — the composed figures, not the per-model get_verification_report. Paginated; origin filters by contributing-control origin.

  • attack_paths: {effective_paths, lattice_positions, authored_paths, suggestions: {missing_path, dangling_path}} against the composed topology.

Where composition is not available, every view returns its shape empty with flag_enabled: false rather than an error. Composed reachability is get_reachability_verdicts(composed=True).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
kindNo
pageNo
viewNooverview
originNo
model_idYes
page_sizeNo
server_versionYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.84.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it declares 'Read-only', specifies that unavailable composition returns an empty shape with flag_enabled=false rather than an error, notes pagination on the entities and coverage views, and gives an overview size hint (~1-2KB). It omits permission/auth prerequisites and error behavior for invalid model_id, so not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and read-only status are front-loaded, then the bulk is a per-view bullet list where every entry earns its place by telling the agent which view to pick. Given five distinct return modes, the length is proportionate and no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with an output schema (so return values need not be described), the definition covers behavior, view selection, edge cases, and pagination well enough to call correctly. The only omissions are the undocumented server_version and model_id semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it largely does: it fully documents the view enum with the return shape of each mode, explains kind as a single-kind filter, origin as a contributing-control-origin filter, and notes page/page_size as pagination. model_id is only implied and server_version is never mentioned, leaving a small gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and scope: the model's composed view combining its own entities with everything inherited from ancestors on the recursive tree. This distinguishes it from per-model read tools like get_verification_report and get_control_objectives, which it explicitly contrasts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear sequencing guidance ('overview ... read it first') and routes the agent away from misuse by naming alternatives: coverage is the composed counterpart to per-model get_verification_report, and composed reachability belongs to get_reachability_verdicts(composed=True). It stops short of an explicit 'use this when / do not use this when' statement, but the routing is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools