Skip to main content
Glama
Sign In
ai-secure-by-design

ai-secure-by-design

by ankush1982
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Plan scaffolds

sbd_plan_scaffold
Read-onlyIdempotent

Lists the security scaffolds a manifest requires, including destinations, templates, and existing status, without writing files. Use it to plan NIST SSDF, ISO 27001, or DPDP compliance scaffolding.

Instructions

List the scaffolds the manifest requires, where each goes, its template, and whether it is already present. Writes nothing.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "sbd_plan_scaffold"
  }
}

Input Schema

NameRequiredDescriptionDefault
stackNoTemplate stack. Default: product.stack in the manifest, then detection, then typescript-express.
manifestPathNoManifest path relative to the workspace root. Default privacy-security-manifest.yaml.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered before the description is read. 'Writes nothing' restates the readOnlyHint rather than adding new behavior, and there is no disclosure of output shape, ordering, or how missing scaffolds are reported.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tightly packed sentence that front-loads the action and then lists the return payload in priority order. 'Writes nothing' is slightly redundant against readOnlyHint but is a useful, cheap reassurance for an agent deciding whether to call it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two optional parameters and no output schema, the description compensates well by enumerating the fields of each returned scaffold entry. The remaining gap is minor: no mention of ordering, empty-result behavior, or error conditions when the manifest is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both optional parameters (stack and manifestPath) fully documented including their default-resolution chains, so the schema carries the load. The description only implicitly gestures at these via 'manifest' and 'template' without adding resolution order or format detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('List the scaffolds') and enumerates exactly what each entry contains: location, template, and presence status. It is clearly a read-only planning tool, distinguishable in spirit from siblings like sbd_plan_deploy or sbd_plan_init, but it never names or contrasts those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the 'plan' naming plus 'Writes nothing' signals this is a preview step to run before scaffolding or deploying, and 'the manifest requires' implies a manifest must exist first. There is no explicit statement of when to prefer this over sbd_plan_init or sbd_plan_deploy, and no stated exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools