ism-mcp
The ism-mcp server provides an agent-friendly query layer over the ASD Information Security Manual (ISM) for lookup, discovery, and compliance tracking — without needing the full ~700-page document in context.
Control Discovery & Lookup
ism_get— Retrieve the full record for a specific control by ID (e.g.ISM-1781)ism_search— Full-text search over control descriptions and topics (FTS5/BM25 ranking)ism_applicable— Rank controls relevant to a plain-language description of planned work, with optional filters for classification, maturity, section tags, or repo file paths (hybrid semantic + lexical retrieval)
Browsing & Enumeration
ism_list_by_classification— List controls applicable at a given classification level (NC, OS, P, S, TS)ism_list_by_topic— List controls under a specific topicism_list_topics/ism_list_sections— Enumerate all distinct topics or section tagsism_list_classifications/ism_list_maturities— Get canonical classification levels and Essential Eight maturity levels (ML1/ML2/ML3)
Version History & Diffing
ism_versions— List loaded ISM releasesism_diff— View the delta between two ISM releasesism_history— Track a single control's evolution across versions
Project Compliance Coverage Tracking
ism_coverage_read— Read the project's.ism-coverage.tomlmanifest (scope, summary counts, control entries)ism_coverage_upsert— Create or update a coverage entry with evidence (files, commits, URLs, review metadata)ism_coverage_gaps— Identify uncurated, partial, or deferred in-scope controls; optionally ranked by relevanceism_coverage_impact— Identify controls to re-review or newly in-scope after an ISM update
Database Metadata
ism_stats— View total control count, ISM revision metadata, and source paths
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ism-mcpwhat controls apply to multi-factor authentication?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ism-mcp
Agent-friendly query layer over the ASD Information Security Manual, served via MCP.
The ISM is ~700 pages and does not fit in a model context window. This MCP server parses the official ASD OSCAL release of the ISM into a local SQLite database and exposes a small set of typed lookup tools so that an agent (Claude Code, Codex, Cursor, etc.) can interrogate the ISM without re-reading the source documents. It holds the full ISM release history, so it can also report what changed between versions and what a newer ISM means for a project's existing compliance work.
Status
Single-tenant and local: SQLite storage, stdio-transport MCP server, no auth, no network listener. Ingest fetches the OSCAL source over git. Suitable for local and per-project use, not multi-tenant or networked deployment.
Related MCP server: fedramp-docs-mcp
Install
Requires uv and Python 3.14+.
git clone https://github.com/samueldudley/ism-mcp.git
cd ism-mcp
uv syncIngest the ISM
The source is the official ASD OSCAL mirror, AustralianCyberSecurityCentre/ism-oscal. ism-mcp clones it into a managed cache (~/.local/share/ism-mcp/oscal) the first time, so a plain ingest needs no manual download:
uv run ism-mcp ingest --fetch # fetch latest, ingest it as the active version
uv run ism-mcp ingest-history --fetch # fetch, then ingest every tagged ISM release (full history)
uv run ism-mcp update # fetch latest and ingest any new releaseThe database lands at ~/.local/share/ism-mcp/ism.db by default. Override with --db PATH. For an offline or air-gapped environment, clone the OSCAL repo yourself and point at it: --oscal PATH (single version) or --oscal-repo PATH (history). Run ism-mcp ingest --help for the full flag list.
The first ingest downloads the embedding model once (see First-run network requirement). Pass --no-embeddings to skip it and fall back to lexical-only ranking. ingest-history embeds only the newest release by default (fast); pass --embed-all to embed every version.
Versions are upserted independently, so re-ingesting a release replaces just that version. There is no whole-database rebuild on each quarterly release. If you are upgrading from an older XLSX-based database, its schema is incompatible: ingest refuses it with a clear error, so pass --fresh once to wipe and rebuild.
Use as a Claude Code MCP server
Add to your Claude Code MCP configuration:
{
"mcpServers": {
"ism": {
"command": "uv",
"args": ["--project", "/path/to/ism-mcp", "run", "ism-mcp", "serve"]
}
}
}Restart Claude Code. The tools listed under MCP tools become available, led by ism_applicable for ranked discovery.
Adopt in a project
ism-mcp install writes everything a teammate needs into a consumer repo. The database is committed into the repo, so a clone has data without a local ingest.
uv run ism-mcp install --project /path/to/consumer-repoThis writes, all idempotent on re-run:
.mcp.jsonwith theismserver entry. Other servers in the file are kept.A managed block in
CLAUDE.mdbetween<!-- ism-mcp:begin -->and<!-- ism-mcp:end -->, telling agents when to consult the server..ism-coverage.tomlscaffolded from the template, only if absent. An existing manifest is never overwritten..ism/ism.db, the database, refreshed on each run.
The default uvx mode launches the server with uvx --from git+<repo>@<rev> ism-mcp serve. --repo defaults to this checkout's origin remote and --rev to its short HEAD, so the entry pins a reproducible build. A teammate needs only uv. The first semantic query downloads the embedding model once, then runs offline.
For air-gapped or locked-down environments, --mode docker --image <ref> emits a docker run entry that mounts the committed database. Building and hosting the image is left to you.
The database path uses Claude Code's ${CLAUDE_PROJECT_DIR:-.} expansion, so it resolves to each teammate's project root. Claude Code prompts once per repo to trust a project-scoped server. claude mcp reset-project-choices clears the approval.
Use --dry-run to see the planned writes without changing anything.
Fetching from the published remote
uvx and docker both fetch a pinned source. Point ism-mcp install at the published repository with --repo https://github.com/samueldudley/ism-mcp.git (if you cloned from there, that is already your origin and the default works). To register the server at user scope against the published source:
claude mcp add ism -s user -- uvx --from git+https://github.com/samueldudley/ism-mcp.git@v1.1 ism-mcp serveThe user-scope server keeps the default database at ~/.local/share/ism-mcp/ism.db, which you ingest locally. It carries no ISM_MCP_DB override, since that path is only for project installs where the database travels with the repo.
Use programmatically
from ism_mcp import store, server
conn = store.open_db(server.DEFAULT_DB)
c = store.get_control(conn, "ism-1781") # also accepts ISM-1781, 1781, or a label
print(c.description)
for r in store.search(conn, "session timeout", limit=5):
print(r.identifier, r.topic)Development
uv sync install all deps including dev
uv run pytest run the test suite
./scripts/ci.sh full CI suite (fmt + lint + type + test)
./scripts/ci.sh test single stageThe CI script is the source of truth for what counts as a passing build. Run it before pushing.
MCP tools
The table lists the bare tool names. Claude Code invokes them under the server key prefix, so ism_applicable is called as mcp__ism__ism_applicable (replace ism if you installed under a different --name).
Tool | Purpose |
| Hybrid retrieval: rank controls relevant to a free-text description of planned or current work. Recommended default for discovery. |
| Full record for one control by ID. Lookup tolerates |
| Deterministic FTS5 search. Use when you know the exact term. |
| Controls applicable at NC / OS / P / S / TS. |
| Distinct topic strings. |
| Controls under a topic. |
| Distinct section strings. The vocabulary for the |
| Canonical classification enum plus friendly aliases. |
| Essential Eight maturity levels. |
| Loaded ISM releases, newest first. The vocabulary for |
| Catalog delta between two releases. Defaults to the latest release versus the one before it. |
| One control's evolution (text, title, applicability, maturity) across every loaded release. |
| Database statistics: active version, total versions, control count. |
| Read the project's |
| Create or update one entry with evidence (files, commits, urls, attachments). Stamps the entry with the active ISM version. |
| Return outstanding in-scope controls. With |
| After an ISM update, flag covered controls to re-review, controls removed upstream, and newly in-scope controls with no entry. |
Lookup and listing tools default to the active ISM version. Pass version (see ism_versions) to target a historical release. Each Control record carries: version, identifier, label, title, control_class, guideline, section, topic, description, control_revision, updated, sort_id, classification applicability (NC/OS/P/S/TS), and maturity applicability (ML1/ML2/ML3).
Every tool publishes a JSON output schema and returns structured content that validates against it. Constrained parameters (classification, maturity, status, change_types, status_filter) are schema enums, so invalid values are rejected before the tool runs. Failures arrive as MCP tool errors (isError with a message), never as {"error": ...} payloads inside a successful result. Keys are never conditionally absent: a key that does not apply to a given call is present with a null value.
Discovery for agents
The headline use case is ism_applicable. The agent describes the work in plain language, optionally narrows by classification, maturity, section tags, or repo paths, and gets back a ranked list of relevant controls.
ism_applicable(
work="adding JWT refresh and idle session timeout to our auth flow",
classification="OFFICIAL",
paths=["src/auth/jwt.py", "src/auth/session.py"],
limit=10,
)Returns a ranked list with identifier, label, title, topic, section, description, applies, maturity, a normalised RRF score in [0.0, 1.0], and a why list naming the signals that surfaced each result (semantic, lexical, path:<token>). verbose=true adds the guideline.
Maturity is Essential Eight only.
ML1/ML2/ML3exist for the ~123 controls mapped to the Essential Eight Maturity Model, not the wider ISM (~1130 controls). Passingmaturity=(here, or in a manifest[scope]) drops every control with no maturity rating, so aPROTECTEDscope collapses to the subset that is also Essential Eight at that level. Leavematurityunset unless you are specifically tracking Essential Eight maturity.
Under the hood: a bge-small-en-v1.5 embedding of the work text is cosine-matched against per-control embeddings, fused with FTS5 BM25 via Reciprocal Rank Fusion, then post-filtered.
First-run network requirement
The first ingest after install downloads the embedding model (~130 MB) to ~/.cache/fastembed/. Subsequent runs are offline. To pre-warm:
uv run python -c "
from fastembed import TextEmbedding
TextEmbedding('BAAI/bge-small-en-v1.5')
"To skip embeddings entirely (offline first run, or for fast iteration during development):
uv run ism-mcp ingest --fetch --no-embeddingsWithout embeddings, ism_applicable falls back to lexical-only ranking. Results are still useful but recall on natural-language queries is lower.
Environment variables
Var | Values | Effect |
| path | Override the database location. Default |
|
| Force a specific embedder at server start. |
Project coverage manifest
For projects pursuing IRAP review (or any internal review against the ISM), .ism-coverage.toml at the project root records how each in-scope control is addressed.
schema_version = 1
[scope]
classification = "P"
sections = ["Authentication hardening", "Cryptographic fundamentals"]
baseline_version = "2026.03.24"
[project]
name = "demo-admin"
[controls."ism-0428"]
status = "covered"
how_met = """
Sessions terminate after 14 min of idle activity, enforced
in the auth middleware. Re-auth requires all original factors.
"""
last_reviewed = 2026-05-28
reviewed_against = "2026.03.24"
files = ["src/auth/session.py:42-87"]
commits = ["abc1234"]
[[controls."ism-0428".attachments]]
path = ".ism-coverage/evidence/ism-0428/lock-prompt.png"
description = "Admin console at 14:01 showing session-expired modal"[scope] defines the in-scope control set that ism_coverage_gaps measures against. Set classification (and optionally narrow by sections). baseline_version records the ISM release the project currently targets; each entry's reviewed_against records the release it was assessed against, and ism_coverage_impact uses the two to flag drift when a newer ISM lands. Do not set maturity unless you are tracking Essential Eight maturity specifically: it filters to the Essential Eight subset and drops every other control from scope (see the maturity note under Discovery for agents).
Recommended layout for binary evidence:
your-repo/
.ism-coverage.toml
.ism-coverage/
evidence/
ISM-0428/
lock-prompt.png
tls-handshake.pcapngA template lives at src/ism_mcp/data/coverage_template.toml if you want to copy and start from a known-good shape. The fields and their allowed values are shown in the example above.
The manifest is machine-managed: ism_coverage_upsert rewrites the whole file, so comments are not preserved. Keep narrative in how_met and evidence in the structured fields rather than in TOML comments.
Architecture
ism-mcp/
src/ism_mcp/
store.py version-keyed SQLite schema + queries, FTS5, version registry
oscal.py parse an OSCAL ISM catalog into version metadata and control rows
fetch.py clone/pull the ACSC ism-oscal mirror, list tags, read files at a tag
ingest.py orchestrate OSCAL ingest over a directory or a git-tag walk
diff.py catalog delta between two versions + per-control history
retrieve.py cosine search + Reciprocal Rank Fusion
embed.py embedder protocol + fastembed and hash backends
classification.py classification + maturity input normalisation
paths.py repo-path token expansion for query enrichment
coverage.py coverage manifest read, validate, serialise, gaps, drift
install.py consumer-repo install writer
server.py FastMCP server: lookup, discovery, version, coverage tools
__main__.py CLI: fetch, ingest, ingest-history, update, serve, install
data/ path keyword map + coverage template
pyproject.toml uv-managed, hatchling buildSingle SQLite file. A versions registry plus controls and embeddings keyed by (version, identifier), with an FTS5 virtual table kept in sync via insert and delete triggers. A meta table records the active version that lookup tools default to.
Known limitations
No auth on the MCP server. Suitable for local use only.
Licence
MIT. See LICENSE.
This licence covers the code in this repository. The ISM itself is Commonwealth of Australia content published by the ACSC under its own terms. You download and ingest the ISM separately; it is not redistributed here.
Available Tools
17 toolsism_applicableARead-only
Rank ISM controls relevant to a free-text description of planned or current work.
The primary discovery tool. Describe the work in a sentence or two and it returns
the most relevant controls. For exact keyword or phrase lookup, use ism_search.
Uses hybrid retrieval (semantic embeddings + FTS5 BM25) fused with Reciprocal
Rank Fusion. Optional filters: classification (NC|OS|P|S|TS or OFFICIAL through
TOP_SECRET), maturity (ML1|ML2|ML3, Essential Eight controls only, so leave it
unset unless scoping to the Essential Eight), tags (validated against
ism_list_sections), paths (repo paths whose tokens expand the lexical query).
Invalid filter values fail. limit defaults to 20 (capped at 200). verbose
populates each control's guideline text, null otherwise. score is a normalised
RRF score in [0.0, 1.0], not a probability.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| work | Yes | ||
| limit | No | ||
| paths | No | ||
| verbose | No | ||
| maturity | No | ||
| classification | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | Yes | |
| count | Yes | |
| query | Yes | |
| filters | Yes | |
| results | Yes | |
| candidates_before_filter | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true, and the description adds behavioral details: hybrid retrieval method, RRF scoring, invalid filter failure, limit cap, verbose field population, and score normalization. No contradictions; adds significant context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is thorough but not excessive; every sentence adds value. It front-loads the purpose and usage, then lists filters and behavior. Slightly long but justified by complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's 7 parameters, many siblings, and existence of an output schema, the description covers purpose, usage, parameter semantics, behavioral traits, and output notes (score and verbose). It references sibling tools for non-applicable cases, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description compensates by explaining all optional parameters: classification values, maturity note, tags validated against ism_list_sections, paths effect, limit default/cap, and verbose behavior. The required 'work' parameter is only described as 'free-text description'; a example would strengthen it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool ranks ISM controls relevant to a free-text description, calling itself the 'primary discovery tool'. It immediately distinguishes from ism_search for exact lookup, providing a specific verb+resource combination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use (for free-text description) and when not (exact keyword lookup, use ism_search). Provides detailed guidance on each optional filter, including maturity scoping and tag validation, making decisions clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_coverage_gapsARead-only
Return outstanding in-scope controls (uncurated, partial, deferred). Never writes.
The complement of ism_coverage_read: read reports what is curated, gaps reports
what is missing. Reads the manifest (.ism-coverage.toml), walking up from cwd
when project_path is omitted. If work is supplied, runs ism_applicable with
the project's scope as filters and intersects with the manifest to return
work-relevant gaps ranked by relevance score. Without work, returns the full
outstanding set ordered uncurated > partial > deferred.
| Name | Required | Description | Default |
|---|---|---|---|
| work | No | ||
| limit | No | ||
| project_path | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| gaps | Yes | |
| work | Yes | |
| scope | Yes | |
| shown | Yes | |
| total_outstanding | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true. The description adds: never writes, reads `.ism-coverage.toml`, walks up from cwd, can run `ism_applicable` if `work` supplied, intersects results, and ranks by relevance score. It also describes ordering: uncurated > partial > deferred. This exceeds annotation-provided info and does not contradict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence gives the core purpose and a safety note ('Never writes'). The second paragraph adds necessary detail without redundancy. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and good annotations, the description covers the tool's purpose, behavior, two modes, and ordering. It does not mention error cases or prerequisites (e.g., existence of manifest), but for a tool with this complexity, it is quite complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%. The description explains `work` (triggers intersection with `ism_applicable` results for relevance) and `project_path` (defaults to cwd walk-up). `limit` is not described, only its default (50). Two out of three parameters get meaningful explanation, compensating for lack of schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns outstanding in-scope controls (uncurated, partial, deferred). It distinguishes itself from the sibling `ism_coverage_read` by explaining the complementarity: 'read reports what is curated, gaps reports what is missing.' The verb 'return' and resource 'in-scope controls' are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use it (to get gaps) and what it does (reads manifest, never writes). It contrasts with `ism_coverage_read` but does not explicitly compare with other siblings like `ism_coverage_impact` or `ism_get`. However, it provides clear context on two modes (with and without `work`) and mentions walking up from cwd.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_coverage_impactARead-only
Report what a newer ISM version means for the project's coverage. Never writes.
Buckets covered/partial entries into re_review (control changed since it was
assessed), removed_upstream (control gone at target), and new_uncovered (now in
scope, no entry). target_version defaults to scope.baseline_version or the
active version. Reads the manifest like ism_coverage_read, walking up from cwd
when project_path is omitted. Run this after ingesting a new ISM release, then
curate the buckets with ism_coverage_upsert.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| project_path | No | ||
| target_version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| summary | Yes | |
| re_review | Yes | |
| manifest_path | Yes | |
| new_uncovered | Yes | |
| target_version | Yes | |
| baseline_version | Yes | |
| removed_upstream | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description provides rich behavioral details beyond the readOnlyHint annotation: it explains the three output buckets (re_review, removed_upstream, new_uncovered), default behaviors for target_version and project_path, and that it reads the manifest like ism_coverage_read. The annotation is consistent (readOnlyHint=true, 'Never writes').
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: it starts with the core purpose and read-only nature, then details the output buckets, defaults, and contextual usage. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists (so return values are not needed in description), the description adequately covers the tool's behavior, usage context, and parameter defaults. The only minor gap is no mention of the limit parameter, but since it defaults to 50 and has an output schema, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It adds meaning for target_version (defaults to scope.baseline_version or active version) and project_path (walks up from cwd when omitted), but does not describe the limit parameter. Coverage is partial, warranting a score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it reports impact of a newer ISM version on coverage, and explicitly says 'Never writes.' It distinguishes itself from sibling tools like ism_coverage_upsert (writes) and ism_coverage_read (reads current state).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use it: 'Run this after ingesting a new ISM release' and what to do next: 'curate the buckets with ism_coverage_upsert.' It also mentions default behavior for target_version and project_path, but does not explicitly state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_coverage_readARead-only
Read the project's coverage manifest (.ism-coverage.toml). Never writes.
Returns scope, summary counts, and curated entries. Walks up from cwd to find the
manifest if project_path is omitted and fails when none is found.
status_filter narrows the controls map to a single status
(covered|partial|not-applicable|deferred) while summary stays unfiltered. To
see what is missing rather than what is curated, use ism_coverage_gaps.
| Name | Required | Description | Default |
|---|---|---|---|
| project_path | No | ||
| status_filter | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| scope | Yes | |
| project | Yes | |
| summary | Yes | |
| controls | Yes | |
| warnings | Yes | |
| manifest_path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states 'Never writes', which aligns with the `readOnlyHint` annotation. It further details that `status_filter` narrows the controls map but leaves the summary unfiltered, adding behavioral insight beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured. The core function is stated upfront, followed by succinct parameter explanations and a clear sibling alternative reference. No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only two parameters, an output schema, and clear annotations, the description covers all necessary aspects: purpose, parameters, behavior, and alternatives. It is complete for an AI agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description fully explains both parameters: `project_path` behavior (walk-up from cwd) and `status_filter` acceptable values and effect (filters controls map, not summary). This compensates the missing schema descriptions completely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads the project's coverage manifest, specifying the resource (`.ism-coverage.toml`) and the action. It also distinguishes itself from a sibling tool, `ism_coverage_gaps, by clarifying that this tool returns curated entries while the sibling shows missing items.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use this tool versus the alternative `ism_coverage_gaps`. It also explains the behavior when `project_path` is omitted (walks up from cwd) and fails if not found, providing clear context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_coverage_upsertAIdempotent
Create or update one entry in the coverage manifest (.ism-coverage.toml).
The only tool that writes to disk. It rewrites the manifest file atomically and an
existing entry for the identifier is replaced whole. status must be one of
covered, partial, not-applicable, or deferred. Validates identifier against the
ISM DB, requires every attachment path to resolve on disk and every url and
attachment to carry a description. last_reviewed defaults to today. Returns the
action taken plus warnings and fails on validation errors.
| Name | Required | Description | Default |
|---|---|---|---|
| urls | No | ||
| files | No | ||
| status | Yes | ||
| commits | No | ||
| how_met | Yes | ||
| identifier | Yes | ||
| attachments | No | ||
| next_review | No | ||
| reviewed_by | No | ||
| project_path | No | ||
| last_reviewed | No | ||
| reviewed_against | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| action | Yes | |
| warnings | Yes | |
| identifier | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond the annotation hints (idempotentHint, destructiveHint). It discloses atomic rewrite, whole replacement of existing entries, validation against ISM DB, requirement for attachment paths to exist on disk, default value for last_reviewed, and return of action taken plus warnings/failures. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise but packs substantial information. It front-loads the core purpose in the first sentence, then adds critical context in subsequent sentences. Every sentence earns its place, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (12 parameters, 3 required, no schema descriptions, and existence of an output schema), the description covers the core behavior, validation rules, and return value. It could mention the output schema or explain more optional parameters, but it provides enough for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates well by explaining the 'status' enum values, the default for 'last_reviewed', validation rules for identifiers and attachments, and that URLs/attachments need descriptions. However, not all 12 parameters are individually described, leaving some like 'files', 'commits', 'reviewed_by' unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates or updates one entry in the coverage manifest, specifying the exact resource (.ism-coverage.toml) and using the verb 'upsert'. It explicitly distinguishes from siblings by stating it is 'the only tool that writes to disk'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: for writes to the coverage manifest, and that it is the only write tool, effectively excluding all sibling read-only tools. It also lists conditions for proper use (valid identifier, attachments on disk, URLs/attachments with descriptions) and failure modes (validation errors).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_diffARead-only
Catalog delta between two ISM versions.
Defaults compare the version before active (from) to the active version (to), so a
bare call answers 'what changed in the latest release'. change_types narrows the
buckets (added, removed, reworded, retitled, moved, applicability_changed,
maturity_changed) and sets unrequested buckets to null. Returns
{from, to, summary, changes}. Fails on unknown versions. Use ism_versions to see
loadable versions, and ism_history for one control's timeline instead of the
whole catalog.
| Name | Required | Description | Default |
|---|---|---|---|
| to_version | No | ||
| change_types | No | ||
| from_version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| to | Yes | |
| from | Yes | |
| changes | Yes | |
| summary | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and openWorldHint=false. Description adds useful context: fails on unknown versions, returns specific structure {from, to, summary, changes}, and change_types behavior (unrequested buckets set to null). Adds value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
112 words, front-loaded with main purpose. Every sentence adds value: defaults, alternatives, parameter effects, return structure, failure case. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, description provides sufficient return structure and error behavior. References sibling tools for context. Covers all necessary aspects without being verbose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description explains all three parameters: from_version and to_version with defaults, change_types with enumerated possibilities and effect (unrequested buckets set to null). This compensates for lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it catalogs delta between two ISM versions, using specific verb+resource. It distinguishes from siblings like ism_history (one control's timeline) and ism_versions (loadable versions).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly explains defaults (version before active vs active), so bare call answers 'what changed in latest release'. Provides alternatives: ism_versions to see loadable versions, ism_history for one control's timeline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_getARead-only
Get the full record for one ISM control by identifier (e.g. ism-1781).
Identifier input is tolerant: ISM-1781, bare 1781, and legacy labels resolve
to the canonical OSCAL id. Returns the control record with title, control text,
section, topic, classification applicability, and Essential Eight maturity flags.
Fails when nothing matches. Use ism_search or ism_applicable first when the
identifier is unknown. Defaults to the active ISM version. Pass version (see
ism_versions) for a historical one.
| Name | Required | Description | Default |
|---|---|---|---|
| version | No | ||
| identifier | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| label | Yes | |
| title | Yes | |
| topic | Yes | |
| applies | Yes | |
| section | Yes | |
| sort_id | Yes | |
| updated | Yes | |
| version | Yes | |
| maturity | Yes | |
| guideline | Yes | |
| identifier | Yes | |
| description | Yes | |
| control_class | Yes | |
| control_revision | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true (safe read). Description adds: input tolerance (various formats), return fields (title, control text, etc.), failure on no match, defaults to active version, and version parameter for historical. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four concise sentences. Front-loaded with purpose and input format. Efficiently covers behavior, defaults, and alternatives. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists (signal indicates true) and annotations provide safety info, description adds all necessary context: input handling, output fields, failure mode, version defaults, and sibling guidance. Complete for a getter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, so description must compensate. It thoroughly explains identifier parameter (tolerant input, example, canonical ID). Version parameter is mentioned as optional with reference to ism_versions, but could provide more detail on format. Still largely covers key aspects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Get' and resource 'full record for one ISM control'. Identifies specific input ('by identifier') and gives example. Differentiates from siblings by recommending ism_search or ism_applicable when identifier is unknown.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (known identifier) and when not to (unknown identifier, suggests alternatives). Mentions default behavior (active version) and optional parameter (version) with reference to ism_versions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_historyARead-only
Show one control's evolution across every loaded ISM version.
Returns a chronological timeline of changes to that single control. Identifier input is tolerant like ism_get. An unknown id returns an empty timeline with a hint rather than an error. For the whole-catalog delta between two versions, use ism_diff instead.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | Yes | |
| timeline | Yes | |
| last_seen | Yes | |
| first_seen | Yes | |
| identifier | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true. Description adds that identifier input is tolerant and unknown IDs return empty timeline with hint rather than error, going beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three efficient sentences, front-loaded with main purpose, no redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main behavior, error handling, and alternative tool. Output schema exists so return format need not be detailed. Could briefly mention that timeline includes changes across versions, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage for the single parameter. Description mentions 'tolerant like ism_get' but does not clarify identifier format or what it represents. Partially compensates but remains vague.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool shows one control's evolution across all loaded ISM versions. Distinguishes from sibling ism_diff by noting it is for whole-catalog delta.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly directs to use ism_diff when needing whole-catalog delta. Mentions identifier tolerance akin to ism_get, but lacks broader comparison to other siblings like ism_search.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_by_classificationARead-only
List controls that apply at a given classification level.
classification takes canonical abbreviations only: NC, OS, P, S, or TS (see
ism_list_classifications for the OFFICIAL through TOP_SECRET mapping). Returns
{classification, count, identifiers} with ids only. Fetch full records with
ism_get. An unknown level fails.
| Name | Required | Description | Default |
|---|---|---|---|
| version | No | ||
| classification | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| identifiers | Yes | |
| classification | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true. The description adds that it returns a summary with ids only, and that an unknown level fails. This provides useful behavioral context beyond the annotations, though it could mention the return type more formally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with three sentences each adding distinct value: purpose, parameter guidance, and return/error behavior. Front-loaded with the main action, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description provides sufficient context: it lists controls by classification, returns a summary format, and errors on invalid input. It could be more explicit about the identifiers' nature, but overall it is complete for a simple listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains the classification parameter in detail, including allowed values and a hint to another tool for mapping. However, it omits any explanation of the optional version parameter. With schema coverage at 0%, the description should cover both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists controls by classification level. The verb 'list' and resource 'controls' are explicit, and it distinguishes itself from siblings like ism_get (full records) and ism_list_by_topic (filter by topic).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It specifies that classification takes canonical abbreviations and directs to ism_list_classifications for the mapping. It also instructs to use ism_get for full records. While it does not explicitly contrast with ism_list_by_topic, the purpose is clear enough for the agent to choose correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_by_topicARead-only
List controls under a specific topic (exact match, use ism_list_topics to enumerate).
Returns {topic, count, identifiers} with ids only. Fetch full records with
ism_get. An unknown topic returns an empty list, not an error.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | ||
| version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| topic | Yes | |
| identifiers | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses return shape `{topic, count, identifiers}` with only IDs, and default behavior for unknown topic (empty list, not error). No contradiction with readOnlyHint annotation; adds value beyond it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, no wasted words. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters and output schema exists, description fully covers behavior: return shape and error handling. Complete for intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 0% means description must compensate. It explains 'topic' is exact match and references ism_list_topics for enumeration, adding semantic value. Version parameter is not mentioned, so partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'List', resource 'controls under a specific topic', and scope 'exact match'. Distinguishes from sibling ism_list_topics by specifying enumeration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: when to use (list by topic), alternative (ism_list_topics for enumeration), and follow-up (ism_get for full records). Lacks explicit 'when not to use' but sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_classificationsARead-only
Return the classification vocabulary as parallel lists.
canonical[i] (NC, OS, P, S, TS) pairs with friendly[i] (OFFICIAL through
TOP_SECRET). ism_applicable accepts either form. ism_list_by_classification
accepts canonical only. Static data, no database read.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| friendly | Yes | |
| canonical | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds value beyond annotations by disclosing 'Static data, no database read' and explaining output structure (parallel lists). Annotations already have readOnlyHint=true, but description provides concrete behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise, two sentences plus a code-like explanation of the data structure. No wasted words, purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has zero parameters, high schema coverage, and output schema exists. Description explains output format and relations to siblings, which is fully adequate for this simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. Description adds meaning by detailing the output structure and interaction with sibling tools, which is helpful for understanding return format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns 'classification vocabulary as parallel lists' with explicit mapping between canonical and friendly terms. Verb 'Return' is specific to resource, and it distinguishes from siblings by mentioning which sibling accepts which form.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool vs alternatives: ism_applicable accepts either form, ism_list_by_classification accepts canonical only. Also clarifies static data with no database read, guiding appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_maturitiesARead-only
Return the Essential Eight maturity levels: ML1, ML2, ML3.
The Essential Eight is the ASD's baseline set of mitigation strategies, and only
controls belonging to it carry a maturity rating. These levels are the vocabulary
for the maturity filter on ism_applicable and for coverage manifest scope.
Static data, no database read.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| maturities | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and openWorldHint=false. The description adds that the data is static and involves no database read, which aligns with annotations and provides extra context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: two sentences that front-load the main purpose and then add necessary context. Every sentence earns its place with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an output schema, the description is fully complete. It explains the tool's return values, its static nature, and its relationship to other tools, leaving no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so schema coverage is 100%. The description adds meaning by listing the actual maturity levels (ML1, ML2, ML3) and explaining their role in the broader system.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Return' and the specific resource 'Essential Eight maturity levels: ML1, ML2, ML3'. It distinguishes from siblings by focusing on maturity levels, which are unique to this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that these maturity levels are used for filtering in ism_applicable and coverage manifest scope, providing context for when to use the tool. It doesn't explicitly state when not to use, but the purpose is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_sectionsARead-only
List the distinct ISM Section values, the vocabulary for the tags filter on ism_applicable.
Returns {count, sections} for the active version unless version is passed.
| Name | Required | Description | Default |
|---|---|---|---|
| version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| sections | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate read-only; the description confirms listing behavior and adds details on return format ({count, sections}) and version handling, going beyond annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two efficient sentences that front-load purpose and cover key behavior without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter and an output schema, the description sufficiently covers purpose, return shape, and version behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description explains that version overrides the active version, adding meaning to the otherwise vague parameter definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists distinct ISM Section values and connects to the `tags` filter on ism_applicable, distinguishing it from sibling list tools like ism_list_classifications.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that this tool provides the vocabulary for the `tags` filter on ism_applicable, implying usage for obtaining filter values, but does not explicitly exclude alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_list_topicsARead-only
List all distinct topic strings present in the ISM.
The vocabulary for the topic argument of ism_list_by_topic. Returns
{count, topics} for the active version unless version is passed.
| Name | Required | Description | Default |
|---|---|---|---|
| version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| topics | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the description's non-destructive nature is reinforced. The description adds behavioral details: it returns {count, topics} and respects an optional version parameter, which goes beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no superfluous words. The first sentence states the core purpose, the second adds contextual information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With the existence of an output schema (not provided but noted), the description's mention of the return format ({count, topics}) is sufficient for a simple listing tool. It covers the single optional parameter and the behavior, making it complete enough for the given complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It explains the version parameter controls which ISM version to query, adding semantic meaning. However, it does not fully describe the version's format or default behavior, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists all distinct topic strings from the ISM, using specific verb 'List' and resource 'distinct topic strings'. It also differentiates itself from sibling by noting it provides the vocabulary for ism_list_by_topic, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly indicates this tool is the source for valid topic arguments for ism_list_by_topic, providing clear usage context. While it doesn't explicitly state when not to use it, the context is strong enough to guide the agent effectively.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_searchARead-only
Full-text keyword search (FTS5 BM25) over ISM control text and topics.
Best when you already know the terms, an exact phrase, or part of a control title.
To rank controls against a free-text description of work, use ism_applicable
instead. FTS operators in the query are neutralised, so input matches literally.
Returns {query, count, results} with full control records. limit defaults to
10 (capped at 200). Defaults to the active ISM version.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| version | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| query | Yes | |
| results | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, but description adds value beyond that: FTS operators are neutralized for literal matching, limit defaults to 10 (capped at 200), and version defaults to the active ISM version. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is 5 sentences, each adding distinct information. It is front-loaded with purpose, then usage guidance, then behavioral details, return format, and defaults. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, description explains return format {query, count, results} with full control records. Covers default behaviors and version handling. With sibling context and clear purpose, it is complete for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must compensate. It clarifies that query is the search term, limit has a default of 10 with a cap of 200, and version defaults to null (active version). This adds meaning beyond the raw schema but doesn't detail each parameter completely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Full-text keyword search (FTS5 BM25) over ISM control text and topics,' using a specific verb and resource. It distinguishes from sibling ism_applicable by clarifying when each is appropriate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Best when you already know the terms... To rank controls against a free-text description of work, use ism_applicable instead,' providing clear guidance on when to use this tool vs. its sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_statsARead-only
Report database state: active ISM version, version and control counts, db path.
Takes no arguments. Useful as a first call to confirm data is ingested and see which ISM release the other tools will answer from. For the full version list use ism_versions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| db_path | Yes | |
| git_tag | Yes | |
| controls | Yes | |
| versions | Yes | |
| oscal_version | Yes | |
| active_version | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, indicating the tool is safe and non-destructive. The description adds that it reports database state and is a first call, but does not disclose additional behavioral traits beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each essential. First states purpose, second notes no arguments, third gives usage context, fourth references sibling. No fluff, perfectly front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema, the description is complete. It covers what the tool does, how to use it (first call), and points to an alternative for full version list. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so baseline is 4. The description adds value by explaining what the output contains (active ISM version, version/control counts, db path), which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports database state with specifics: active ISM version, version and control counts, db path. It distinguishes itself from sibling tools by noting that for the full version list, one should use ism_versions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says it is useful as a first call to confirm data ingestion and identify which ISM release other tools will answer from. Also directs users to ism_versions for the full version list, providing clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ism_versionsARead-only
List loaded ISM versions, newest first. The vocabulary for version/from/to arguments.
Returns {active, count, versions} where each entry carries version, label,
published date, control_count, and git_tag. Call this before passing version,
from_version, or to_version to other tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| active | Yes | |
| versions | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description adds the return structure and ordering (newest first). No contradictory or missing behavioral traits given the tool's read-only nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main action, then return format and usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, output schema exists), the description fully covers what the tool does, its return value, and its role relative to siblings. Complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has zero parameters, so no parameter information is needed. Baseline score of 4 is appropriate as the description explains the tool's purpose without needing to elaborate on parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'List loaded ISM versions, newest first' with a specific verb and resource. It also clarifies that this tool provides the vocabulary for version/from/to arguments, distinguishing it from siblings like ism_get or ism_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to call this before passing version, from_version, or to_version to other tools. Provides clear context for use, though no explicit when-not-to or alternative suggestions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Every tool has a clearly distinct purpose: discovery, coverage management, version diffing, listing by various facets, and database queries. No two tools overlap in functionality.
All tool names follow the consistent pattern 'ism_' prefix followed by a descriptive verb_noun or verb phrase in snake_case (e.g., ism_applicable, ism_coverage_gaps, ism_list_topics). No mixing of conventions.
With 17 tools, the server covers the domain of ISM control discovery, coverage management, versioning, and listing without being excessive. Each tool fills a specific role with no redundancy.
The tool set covers discovery, search, coverage CRUD (create, read, update), version diffing, and history. A minor gap is the lack of an explicit delete tool for coverage entries, but the 'not-applicable' status may compensate.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Cited, standards-aware compliance overlay for AI assistants (ISO, NIST, FedRAMP, IRAP), over MCP.
EU compliance corpus across 8 frameworks (NIS2, DORA, AI Act, ISO 27001 + more) via MCP.
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.
Related MCP Servers
- FlicenseAqualityBmaintenanceServes the Australian Cyber Security Centre Information Security Manual (ISM) via MCP, providing access to all historical and current versions, search, and comparison tools.11
- FlicenseAqualityDmaintenanceAn unofficial MCP server that exposes public FedRAMP 20x documentation as deterministic, citable lookup tools for AI assistants, with every response citing the exact upstream source.7
- FlicenseNot gradedqualityDmaintenanceProvides search, detail lookup, and gap listing tools for a security control inventory, enabling natural language queries about control status and gaps.
- AlicenseAqualityFmaintenanceEnables querying British cybersecurity data, including regulations, decisions, and requirements from the NCSC, directly from any MCP-compatible client.81Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/SamuelDudley/ism-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server