Skip to main content
Glama
Sign In
MCP Server for OSCAL

MCP Server for OSCAL

by dfkunstler
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

list_ssp_control_implementations

List control-implementation elements from loaded OSCAL SSPs, one per SSP, with paging; retrieve full OSCAL JSON via get_child_element.

Instructions

List the control-implementation element of loaded OSCAL SSPs, one per SSP. Get its OSCAL JSON with get_child_element. Results are paged.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "list_ssp_control_implementations"
  }
}

Input Schema

NameRequiredDescriptionDefault
limitNoMaximum items per page, 1-100.
offsetNoZero-based index of the first item.
parent_doc_uuidNoUUID of one parent document to scope results to. Omit for all documents.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv0.7.1
    • addedInput schema / properties / limit / description
      Added value: +"Maximum items per page, 1-100."
    • addedInput schema / properties / offset / description
      Added value: +"Zero-based index of the first item."
    • addedInput schema / properties / parent_doc_uuid / description
      Added value: +"UUID of one parent document to scope results to. Omit for all documents."
  2. First observedv0.1.0

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description does disclose two real behaviors: results are one-per-SSP (not one-per-control) and the output is paged. It leaves undisclosed whether the operation is read-only, what happens when no SSPs are loaded, and what identifiers the listed items carry that get_child_element would need.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, and the scoping fact (one element per SSP) is front-loaded before the follow-up tool reference. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-optional-parameter read tool with no output schema, this is close to adequate: paging and cardinality are covered. The remaining gap is the return shape — an agent still cannot tell whether the list yields UUIDs or indices usable as input to get_child_element, which is the whole reason to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so limit, offset, and parent_doc_uuid are already fully documented in the schema. The description only adds the general notion of paging and the per-SSP cardinality, which lightly contextualizes limit/offset but adds no new syntax or constraints. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: listing the control-implementation element of loaded OSCAL SSPs, with the important scope detail that there is exactly one per SSP. It separates itself from list_ssps / query_ssp by indicating this returns the control-implementation sub-element rather than the SSP itself, and names get_child_element as the follow-up for the full JSON.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: you enumerate these elements here and fetch each one's OSCAL JSON via get_child_element. That is a useful complementary pointer, but there is no explicit when/when-not guidance versus query_ssp or list_ssp_system_components, and no stated prerequisite that SSPs must already be loaded.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools