Skip to main content
Glama
adog0822

@loxeai/mcp-server

by adog0822

Draft a SOC 2 policy grounded in your actual setup

draft_policy
Read-onlyIdempotent

Generate a Markdown policy draft grounded in your compliance answers and optional scan results, with explicit placeholders for unresolved decisions so you can review before approval.

Instructions

Produces a policy DRAFT in Markdown, grounded in the answers you gave to applicability_brief and, optionally, a real scan. Returned as a string; this server writes no files. Every judgment call is left as an explicit {{PLACEHOLDER}}, counted and returned separately rather than silently filled with a plausible default — because a policy describing controls you do not actually operate is worse than no policy, and becomes an audit exception. The draft states in its own header that having the document does not satisfy the criteria it supports; SOC 2 also wants evidence it was approved, communicated, acknowledged and followed.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
kindYesWhich policy to draft
cloudNo
batchIdNoOptional scan batch to ground the draft in
premisesNo
timelineNo
workforceNo
companyNameNoCompany name. Omitted leaves a placeholder.
iacCoverageNo
customerDataNo
changeProcessNo
productionAccessNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
kindYes
titleYes
markdownYes
warningsYesSet when the draft would describe a control you do not operate.
groundedInYesFacts from your answers and scan that shaped this draft.
alsoRequiresYesWhat else you must produce beyond the document.
placeholdersYesEvery {{PLACEHOLDER}} a human must resolve before use.
placeholderCountYes
supportsCriteriaYesCriteria this CONTRIBUTES toward. A policy never satisfies one on its own.
suggestedFilenameYes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv0.1.0

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, the description adds meaningful behavioral detail beyond them: the server writes no files, placeholders are explicitly marked and counted rather than silently filled, and the draft itself warns that possessing the document does not satisfy the SOC 2 criteria. This is exactly the kind of non-obvious behavior an agent needs to know.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but each sentence earns its place: purpose and format, grounding source, placeholder behavior and rationale, and the audit-safety caveat. The core function is front-loaded, and the additional sentences address exactly what an agent must not overlook.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the lack of detailed documentation for 11 parameters, and the presence of annotations and an output schema, the description is remarkably complete. It clarifies output format, side effects, placeholder handling, and a non-behavioral safety concern. There is no missing behavioral information that would prevent correct invocation or mislead the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 27%, so the description bears extra responsibility for parameter semantics. It does add useful meaning by tying the draft to applicability_brief answers and an optional scan batch, which helps map parameters to context. However, it does not explain the individual parameter roles or how they override or supplement the applicability_brief answers, leaving much of the semantic burden on self-explanatory enum names and the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: it produces a policy DRAFT in Markdown, grounded in applicability_brief answers and optionally a scan. It clearly distinguishes itself from sibling tools like list_policies (which lists existing policies) and applicability_brief (which gathers answers), so an agent can tell them apart immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states the grounding requirement: use the answers from applicability_brief and optionally a real scan. This gives clear when-to-use context. It does not explicitly name when not to use this tool or mention alternatives by name, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/adog0822/loxeai-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server