Skip to main content
Glama
dfkunstler

MCP Server for OSCAL

by dfkunstler
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

list_poam_items

Retrieve POA&M items from OSCAL documents to review security issues and their remediation plans, with optional filtering by parent document and pagination.

Instructions

List POA&M item elements within OSCAL POA&M documents.

POA&M items document specific security issues and their remediation plans. Each item is identified by a UUID (optional in the OSCAL schema).

Args: ctx: MCP server context (injected automatically). parent_doc_uuid: Optional UUID to scope results to a single POA&M document. offset: Zero-based pagination offset (default 0). limit: Maximum items to return, 1-100 (default 10).

Returns: Page_Response dict with keys: items, total, offset, limit, hasMore. Each item contains: id, title, element_type, description, parentDocumentTitle, parentDocumentUuid.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
parent_doc_uuidNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses pagination behavior (offset, limit) and return structure. It mentions that UUIDs are optional in the schema but does not explicitly state read-only nature; however, listing is inherently read-only. Additional details on potential side effects are not needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, Args, Returns). It is slightly verbose but each sentence adds value. Front-loads the main purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with pagination, the description covers parameters and return fields comprehensively. It explains each field in the return dict. Could benefit from a brief note on error handling or limits beyond 100, but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains each parameter (parent_doc_uuid, offset, limit) with types, defaults, and purpose. With 0% schema description coverage, the description fully compensates by providing clear semantics beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists POA&M item elements within OSCAL documents and explains their purpose. It distinguishes from sibling tools like list_poams (which likely list documents themselves) by focusing on items within documents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context for when to use (listing items) and offers optional scoping via parent_doc_uuid. While it doesn't explicitly state when not to use, the sibling differentiation makes the context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools