Analyzes raw CSPM findings, deduplicates overlapping issues, and returns a prioritized list of actionable tickets so security teams can focus on critical cloud risks.
Analyzes raw CSPM findings, deduplicates them, and returns a prioritized list of actionable tickets.
| Name | Required | Description | Default |
|---|---|---|---|
| top_n | No | Number of top tickets to return (default: 10) | |
| use_llm | No | Whether to generate LLM summaries (requires OPENAI_API_KEY env var) |
Changes observed during successful MCP inspections.
v0.1.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not state whether the tool is read-only or persists tickets, whether it requires cloud/API credentials, whether results are cached, or how costly the LLM path is beyond the env-var note in the schema. 'Actionable tickets' also ambiguously suggests ticket creation, which the get_ prefix does not resolve.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the processing pipeline and ends with the output. Nothing is redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should carry more weight than it does. It describes the output as a 'prioritized list of actionable tickets' but not its structure, priority basis, or the origin of the raw findings, so key details an agent would want are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so top_n and use_llm are already documented in the schema. The description adds no extra meaning about these parameters, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives specific verbs and a resource: analyzes raw CSPM findings, deduplicates, and returns a prioritized list of actionable tickets. The purpose is unambiguous. No sibling tools exist, so no differentiation is needed, but it leaves open where the 'raw findings' come from since no input parameter identifies a source.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisite or ordering information (e.g. must raw findings be ingested first), and no statement of when to prefer this over alternative analysis paths. The usage context is only inferable from the verb 'get'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.