Skip to main content
Glama
Mipiti
by Mipiti

Revalidate Entity Quality

revalidate_entity_quality

Re-run quality validation on an existing threat model's assets and attackers without regenerating it. Flags weak entities for deeper review and refreshes stale warnings while leaving controls and components intact.

Instructions

Re-run quality validation on a threat model's existing assets and attackers, as if they were freshly generated. A fast first-pass check judges every entity; only the ones it flags get a deeper review that confirms them, sharpens their wording, or flags them for you.

Use this to apply validation improvements to an already-generated model, or to clear stale quality warnings — without regenerating the whole model (which would destroy controls, assertions, and components). It is non-destructive: an entity that should be removed is left in place with a quality warning rather than deleted, so no control objective loses its asset or attacker anchor. It creates no new model version: the re-validation is queued and runs in the background, and the refreshed warnings appear on the next read of the model.

May consume credits for the entities that need the deeper review; a model already in good shape costs nothing. Returns at once with {"accepted": true, "queued": <entities queued>, "model": {...}}, where model is the id, version and title of the model as it stands before the re-validation lands.

Input Schema

NameRequiredDescriptionDefault
model_idYesID of the threat model whose assets and attackers to re-validate.
server_versionYes

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.68.2

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so exceptionally: it discloses non-destructiveness (flagged entities left in place, not deleted), that no new version is created, that it runs asynchronously in the background with results on next read, and credit-consumption behavior. It even returns the immediate response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action, then layers the non-regeneration rationale, non-destructive guarantee, async behavior, and cost model. Each paragraph adds distinct value, though it runs slightly long; nothing is truly wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists, the description still usefully previews the return shape, and it fully covers async timing, credit cost, and non-destructiveness. An agent has everything needed to invoke correctly and set expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% (server_version undocumented) and the description adds little parameter-level meaning beyond the schema's own model_id text. It restates 'whose assets and attackers to re-validate' but provides no guidance on server_version or format expectations, so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('re-run quality validation on a threat model's existing assets and attackers') and clarifies the scope contrast with full regeneration. An agent can distinguish this from regenerate_threat_model or reevaluate_threat_model_factors by the explicit 'as if freshly generated, without regenerating' framing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear when-to-use context: apply validation improvements to an already-generated model, or clear stale quality warnings. The exclusion ('without regenerating the whole model, which would destroy controls') is implied through consequence rather than naming a specific alternative tool, keeping it just shy of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools