Skip to main content
Glama

Get one control area

corf_get_area
Read-onlyIdempotent

Retrieve a CORF control area by ID to view its summary, sub-domain/domain, control IDs, official pages, and ISO 27001, PCI DSS, and SWIFT CSCF references.

Instructions

One control area by id ("crb:5.6.1", "5.6.1" defaults to crb, "tprm 10.1.1"): its own-words summary, sub-domain and domain, the ids and official pages of its controls, and its ISO 27001, PCI DSS and SWIFT CSCF references. The official text is at the page given.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idYesArea id such as "crb:5.6.1".
langNoLanguage for titles and summaries: en or ar.en
response_formatNomarkdown for reading, json for further processing.markdown

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, closed-world and non-destructive, so the safety bar is covered. The description adds substantive context beyond that: it enumerates what payload comes back and clarifies that this is a summary and reference set, with the official text living at the linked page — a semantic distinction that matters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the resource and scope, then one dense clause listing the returned fields, then a short pointer sentence. Slightly packed by the parenthetical examples, but every sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must carry the return contract, and it does list the summary, sub-domain/domain, control ids and official pages, plus crosswalk references. Missing only minor edges such as behavior when an id is unknown.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning to `id` by documenting accepted formats (namespaced, bare, and space-separated with the crb default). It does not extend the lang or response_format enums, which the schema already handles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: retrieve ONE control area by id, with concrete id examples. The singular scope cleanly separates it from the plural sibling corf_list_areas without needing to name it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies usage through the id format examples ("crb:5.6.1", "5.6.1" defaults to crb, "tprm 10.1.1"), which is genuinely helpful for invocation. However it never states when to reach for this tool versus corf_search, corf_list_areas, or corf_list_framework, so routing guidance remains implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.