ism-mcp

Overview Schema Source Related Servers Discussions Admin

ism_search

Read-only

Perform full-text keyword search over ISM control text and topics. Returns matching control records with count and relevance scores.

Instructions

Full-text keyword search (FTS5 BM25) over ISM control text and topics.

Best when you already know the terms, an exact phrase, or part of a control title. To rank controls against a free-text description of work, use ism_applicable instead. FTS operators in the query are neutralised, so input matches literally. Returns {query, count, results} with full control records. limit defaults to 10 (capped at 200). Defaults to the active ISM version.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`limit`	No
`query`	Yes
`version`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
`count`	Yes
`query`	Yes
`results`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed8 schema fields changedv1.1.1Jul 6, 2026

addedInput schema / properties / version

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Version"
+}

addedOutput schema / $defs

Added value: +{
+  "AppliesMap": {
+    "properties": {
+      "NC": {
+        "title": "Nc",
+        "type": "boolean"
+      },
+      "OS": {
+        "title": "Os",
+        "type": "boolean"
+      },
+      "P": {
+        "title": "P",
+        "type": "boolean"
+      },
+      "S": {
+        "title": "S",
+        "type": "boolean"
+      },
+      "TS": {
+        "title": "Ts",
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "NC",
+      "OS",
+      "P",
+      "S",
+      "TS"
+    ],
+    "title": "AppliesMap",
+    "type": "object"
+  },
+  "ControlRecord": {
+    "properties": {
+      "applies": {
+        "$ref": "#/$defs/AppliesMap"
+      },
+      "control_class": {
+        "title": "Control Class",
+        "type": "string"
+      },
+      "control_revision": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Control Revision"
+      },
+      "description": {
+        "title": "Description",
+        "type": "string"
+      },
+      "guideline": {
+        "title": "Guideline",
+        "type": "string"
+      },
+      "identifier": {
+        "title": "Identifier",
+        "type": "string"
+      },
+      "label": {
+        "title": "Label",
+        "type": "string"
+      },
+      "maturity": {
+        "$ref": "#/$defs/MaturityMap"
+      },
+      "section": {
+        "title": "Section",
+        "type": "string"
+      },
+      "sort_id": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Sort Id"
+      },
+      "title": {
+        "title": "Title",
+        "type": "string"
+      },
+      "topic": {
+        "title": "Topic",
+        "type": "string"
+      },
+      "updated": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "title": "Updated"
+      },
+      "version": {
+        "title": "Version",
+        "type": "string"
+      }
+    },
+    "required": [
+      "version",
+      "identifier",
+      "label",
+      "title",
+      "control_class",
+      "guideline",
+      "section",
+      "topic",
+      "description",
+      "control_revision",
+      "updated",
+      "sort_id",
+      "applies",
+      "maturity"
+    ],
+    "title": "ControlRecord",
+    "type": "object"
+  },
+  "MaturityMap": {
+    "properties": {
+      "ML1": {
+        "title": "Ml1",
+        "type": "boolean"
+      },
+      "ML2": {
+        "title": "Ml2",
+        "type": "boolean"
+      },
+      "ML3": {
+        "title": "Ml3",
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "ML1",
+      "ML2",
+      "ML3"
+    ],
+    "title": "MaturityMap",
+    "type": "object"
+  }
+}

addedOutput schema / properties / count

Added value: +{
+  "title": "Count",
+  "type": "integer"
+}

addedOutput schema / properties / query

Added value: +{
+  "title": "Query",
+  "type": "string"
+}

removedOutput schema / properties / result

Removed value: -{
-  "title": "Result",
-  "type": "string"
-}

addedOutput schema / properties / results

Added value: +{
+  "items": {
+    "$ref": "#/$defs/ControlRecord"
+  },
+  "title": "Results",
+  "type": "array"
+}

changedOutput schema / required

Previous value: -[
-  "result"
-]New value: +[
+  "query",
+  "count",
+  "results"
+]

changedOutput schema / title

Previous value: -"ism_searchOutput"New value: +"SearchResult"

First observedv1.1.0Jun 4, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, but description adds value beyond that: FTS operators are neutralized for literal matching, limit defaults to 10 (capped at 200), and version defaults to the active ISM version. No contradictions found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is 5 sentences, each adding distinct information. It is front-loaded with purpose, then usage guidance, then behavioral details, return format, and defaults. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, description explains return format {query, count, results} with full control records. Covers default behaviors and version handling. With sibling context and clear purpose, it is complete for a search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must compensate. It clarifies that query is the search term, limit has a default of 10 with a cap of 200, and version defaults to null (active version). This adds meaning beyond the raw schema but doesn't detail each parameter completely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Full-text keyword search (FTS5 BM25) over ISM control text and topics,' using a specific verb and resource. It distinguishes from sibling ism_applicable by clarifying when each is appropriate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Best when you already know the terms... To rank controls against a free-text description of work, use ism_applicable instead,' providing clear guidance on when to use this tool vs. its sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server