Skip to main content
Glama
awslabs

Threat Modeling MCP Server

Official
by awslabs

add_flow

Add asset flows to a threat model, specifying source, destination, and security controls. Supports batch addition of multiple flows.

Instructions

Add a new asset flow to the system. Supports batch operations via the 'items' parameter.

This tool adds one or more asset flows to the system. For single item: provide asset_id, source_id, destination_id, and optional fields directly. For batch: provide a list of flow dicts in the 'items' parameter.

Args: ctx: MCP context for logging and error handling asset_id: ID of the asset being transferred (required for single item mode) source_id: ID of the source component or trust zone (required for single item mode) destination_id: ID of the destination component or trust zone (required for single item mode) transformation_type: Type of transformation applied to the asset controls: List of security controls applied to the flow description: Description of the flow protocol: Protocol used for the flow encryption: Whether the flow is encrypted authenticated: Whether the flow is authenticated authorized: Whether the flow is authorized validated: Whether the flow is validated risk_level: Risk level of the flow (1-5) items: Optional list of flow dicts for batch operation

Returns: A confirmation message with the flow ID(s)

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
itemsNo
asset_idNo
controlsNo
protocolNo
source_idNo
validatedNo
authorizedNo
encryptionNo
risk_levelNo
descriptionNo
authenticatedNo
destination_idNo
transformation_typeNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose side effects and constraints. It mentions that it adds flows and returns confirmation with flow ID(s), but does not describe validation rules, prerequisites (e.g., whether referenced assets/trust zones must exist), idempotency, or error behavior. This lack of context is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with sections (Args, Returns) and is mostly efficient. However, the first line 'Add a new asset flow to the system' is repeated nearly verbatim in the second paragraph ('This tool adds one or more asset flows to the system'), which is redundant and could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters, no annotations, 0% schema coverage), the description covers the primary purpose and parameter semantics, but lacks critical contextual details. It does not specify validation behavior, dependencies on other entities (assets, trust zones), or the exact shape of batch items. The presence of an output schema partially mitigates the missing return-value details, but overall completeness remains moderate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 0%, so the description must compensate. It provides a parameter list with meaningful descriptions (e.g., 'ID of the asset being transferred', 'Risk level of the flow (1-5)') and clarifies that asset_id, source_id, and destination_id are required for single-item mode. However, it does not detail the structure of items for batch mode, which is a notable omission.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Add a new asset flow to the system') with a specific verb and resource. It distinguishes itself from sibling tools by focusing on asset flows and mentions batch operations via the 'items' parameter, which adds clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to use single vs. batch modes ('provide asset_id, source_id, destination_id, and optional fields directly' vs. 'provide a list of flow dicts in the items parameter'), which is useful. However, it does not explicitly state when to use this tool over alternatives (e.g., update_flow) or provide any when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/awslabs/threat-modeling-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server