Skip to main content
Glama
awslabs

Threat Modeling MCP Server

Official
by awslabs

update_flow

Update existing asset flows in a threat model, modifying properties like source, destination, controls, and risk level. Supports batch updates via the items parameter.

Instructions

Update an existing asset flow. Supports batch operations via the 'items' parameter.

This tool updates one or more existing asset flows in the system. For single item: provide id and fields to update directly. For batch: provide a list of flow dicts in the 'items' parameter (each must include 'id').

Args: ctx: MCP context for logging and error handling id: ID of the flow to update (required for single item mode) asset_id: New ID of the asset being transferred source_id: New ID of the source component or trust zone destination_id: New ID of the destination component or trust zone transformation_type: New type of transformation applied to the asset controls: New list of security controls applied to the flow description: New description of the flow protocol: New protocol used for the flow encryption: New encryption status authenticated: New authentication status authorized: New authorization status validated: New validation status risk_level: New risk level of the flow (1-5) items: Optional list of flow dicts for batch update

Returns: A confirmation message

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idNo
itemsNo
asset_idNo
controlsNo
protocolNo
source_idNo
validatedNo
authorizedNo
encryptionNo
risk_levelNo
descriptionNo
authenticatedNo
destination_idNo
transformation_typeNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses single vs batch behavior, that fields are new values, and that a confirmation message is returned. However, it does not discuss error handling, partial failures, idempotency, or whether unspecified fields are left unchanged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary line and an Args list. The opening is slightly repetitive ('Update an existing asset flow' followed by 'This tool updates...'), but overall it is efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (14 params, batch support) and zero annotations, the description provides substantial coverage: modes, parameter meanings, and return type. Gaps include error conditions, required vs optional fields, and concurrency semantics, so it is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by listing every parameter with meaningful semantics (e.g., 'New ID of the asset being transferred', 'risk_level (1-5)'). It also clarifies that batch items must include 'id' and that id is required for single mode.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it updates existing asset flows, using a specific verb and resource. It distinguishes from sibling update tools by naming the resource (asset flow) and explaining both single and batch modes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context for when to use: updating existing asset flows, with explicit mode instructions (single id vs items list). However, it does not explicitly mention when not to use it or reference alternatives like add_flow or update_asset.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/awslabs/threat-modeling-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server