Devici MCP Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Devici MCP Servershow me the threat models in the 'Web App' collection"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Devici MCP Server
A Model Context Protocol (MCP) server for interacting with the Devici API. This server provides LLM tools to manage users, collections, threat models, components, threats, mitigations, teams, and dashboard data through the Devici platform.
Features
The Devici MCP Server provides tools for:
User Management
Get users with pagination
Get specific user by ID
Search users by field and text
Invite new users
Collections Management
Get collections with pagination
Get specific collection by ID
Create new collections
Threat Models Management
Get all threat models with pagination
Get threat models by collection
Get specific threat model by ID
Create new threat models
Components Management
Get components with pagination
Get specific component by ID
Get components by canvas
Create new components
Threats Management
Get threats with pagination
Get specific threat by ID
Get threats by component
Create new threats
Mitigations Management
Get mitigations with pagination
Get specific mitigation by ID
Get mitigations by threat
Create new mitigations
Teams Management
Get teams with pagination
Get specific team by ID
Get team users
Create new teams
Dashboard & Reports
Get dashboard data
Get report data
Get threat model statistics
Comments & Audit
Get comments with pagination
Get specific comment by ID
Get audit logs
Codex Integration
Get codex attributes
Get codex mitigations
Get codex threats
Related MCP server: TODO MCP Server
Quick Start
Using uvx (recommended)
Option 1: From GitHub (Current)
uvx git+https://github.com/geoffwhittington/devici-mcp.gitOption 2: From PyPI (Future - when published)
uvx devici-mcp-serverUsing uv
Install from GitHub
uv pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-serverInstall from PyPI (when available)
uv pip install devici-mcp-server
devici-mcp-serverUsing pip
Install from GitHub
pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-serverInstall from PyPI (when available)
pip install devici-mcp-server
devici-mcp-serverConfiguration
The server requires three environment variables:
DEVICI_API_BASE_URL: Your Devici instance URL (e.g.,https://api.devici.com/v1)DEVICI_CLIENT_ID: Your Devici client IDDEVICI_CLIENT_SECRET: Your Devici client secret
Setting Environment Variables
Option 1: Environment Variables
export DEVICI_API_BASE_URL="https://api.devici.com/v1"
export DEVICI_CLIENT_ID="your-client-id-here"
export DEVICI_CLIENT_SECRET="your-client-secret-here"Option 2: .env File
Create a .env file in your working directory:
DEVICI_API_BASE_URL=https://api.devici.com/v1
DEVICI_CLIENT_ID=your-client-id-here
DEVICI_CLIENT_SECRET=your-client-secret-hereGetting Your API Credentials
Log into your Devici instance
Go to Settings > API Access
Generate a new client ID and secret
Copy the values for use as
DEVICI_CLIENT_IDandDEVICI_CLIENT_SECRET
MCP Client Configuration
Claude Desktop
Add this to your Claude Desktop configuration file:
Option 1: From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 2: From PyPI (Future)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["devici-mcp-server"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Cline
Add this to your Cline MCP settings:
From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Continue
Add this to your Continue configuration:
From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Cursor
Add this to your Cursor configuration file:
Option 1: From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 2: Using local installation
If you have the package installed locally:
{
"mcpServers": {
"devici": {
"command": "devici-mcp-server",
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 3: Using Python module directly
{
"mcpServers": {
"devici": {
"command": "python",
"args": ["-m", "devici_mcp_server"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Development
Prerequisites
uv installed
Python 3.10 or higher
Setup
# Clone the repository
git clone <repository-url>
cd devici-mcp
# Create virtual environment and install dependencies
uv sync
# Run in development mode
uv run python -m devici_mcp_serverTesting
# Run the import test
uv run python test_basic.py
# Test with environment variables
DEVICI_API_BASE_URL=https://api.devici.com/api/v1 DEVICI_CLIENT_ID=test DEVICI_CLIENT_SECRET=test uv run python -m devici_mcp_serverBuilding
# Build the package
uv build
# Install locally for testing
uv pip install dist/*.whlFeatures
Full API Coverage: Supports all major Devici API endpoints
Authentication: Secure client ID/secret-based authentication
Error Handling: Comprehensive error handling and validation
Environment Configuration: Flexible configuration via environment variables
Modern Python: Built with modern Python packaging (uv, pyproject.toml)
MCP Compliant: Fully compatible with the Model Context Protocol
API Coverage
This server provides access to:
Users and Teams
Collections and Threat Models
Components and Threats
Mitigations and Comments
Dashboard Data and Reports
Audit Logs and Codex Integration
Search and Bulk Operations
License
This project is licensed under the MIT License - see the LICENSE file for details.
Contributing
Fork the repository
Create a feature branch (
git checkout -b feature/amazing-feature)Commit your changes (
git commit -m 'Add some amazing feature')Push to the branch (
git push origin feature/amazing-feature)Open a Pull Request
Support
For issues and questions:
Check the Issues page
Review the Devici API documentation
Ensure your API credentials have proper permissions
Note: This is an unofficial MCP server for Devici. For official Devici support, please contact the Devici team.
Available Tools
25 toolscreate_collectionD
Create a new collection
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| description | No | ||
| other_properties | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but offers none. It doesn't indicate whether this is a read-only or destructive operation, what permissions are required, how errors are handled, or what the response looks like. For a creation tool with zero annotation coverage, this is a critical gap that leaves the agent guessing about the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words, with zero wasted language. It's front-loaded with the core action and resource. While this conciseness comes at the cost of completeness, the structure itself is optimal for what little information it provides.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (creation operation with 3 parameters), complete lack of annotations, 0% schema description coverage, and presence of an output schema (which the description doesn't reference), the description is severely incomplete. It fails to address behavioral aspects, parameter meanings, or usage context that would help an agent invoke it correctly. The output schema existence slightly mitigates but doesn't compensate for the fundamental gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, meaning none of the three parameters (name, description, other_properties) are documented in the schema. The description adds no information about these parameters—it doesn't explain what 'name' should contain, what 'description' is for, or what 'other_properties' represents. This leaves all parameters completely undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a new collection' is a tautology that restates the tool name without adding meaningful specificity. It doesn't clarify what type of collection (e.g., threat model collection, data collection) or what system it operates in, though sibling tools suggest a threat modeling context. This provides minimal differentiation from siblings like 'create_threat_model' beyond the resource name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, appropriate contexts, or exclusions, and fails to differentiate from sibling tools like 'create_threat_model' or 'get_collection'. This leaves the agent with no usage context beyond the basic action implied by the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_threat_modelC
Create a new threat model
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| collection_id | Yes | ||
| description | No | ||
| other_properties | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states 'Create a new threat model', implying a write/mutation operation, but doesn't disclose behavioral traits like required permissions, whether changes are reversible, rate limits, or what the output contains. For a creation tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It's appropriately sized for a basic tool name restatement, though this conciseness comes at the cost of detail. No extraneous information is included, making it front-loaded but under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which should cover return values), the description's minimalism is partially offset. However, with 4 parameters, 0% schema coverage, and no annotations, the description is incomplete for a creation tool. It lacks context on usage, parameters, and behavior, making it inadequate despite the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but adds no parameter information. It doesn't explain what 'name', 'collection_id', 'description', or 'other_properties' mean, their formats, or how they affect the threat model creation. With 4 parameters (3 required) and no schema descriptions, the description fails to provide necessary semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Create a new threat model' restates the tool name 'create_threat_model' without adding specificity. It uses the verb 'create' but doesn't clarify what a 'threat model' is in this context or what resources it creates. While it distinguishes from read-only siblings like 'get_threat_model', it lacks detail about the scope or nature of the creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a collection_id from 'get_collection'), exclusions, or how it relates to siblings like 'create_collection'. The description implies it's for creation but offers no context about appropriate scenarios or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_collectionB
Get a specific collection by ID
| Name | Required | Description | Default |
|---|---|---|---|
| collection_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves data ('Get'), implying a read operation, but doesn't specify if it's safe, requires authentication, has rate limits, or what happens if the ID is invalid. This leaves significant gaps for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded, consisting of a single, direct sentence that states the core purpose without any wasted words. It efficiently communicates the essential information in minimal space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter, no nested objects) and the presence of an output schema (which handles return values), the description is somewhat complete for basic use. However, with no annotations and minimal behavioral details, it lacks depth for safe and effective invocation in a broader context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal meaning beyond the input schema: it clarifies that 'collection_id' is used to identify a specific collection. With 0% schema description coverage and 1 parameter, this provides some context, but it's basic and doesn't detail format or constraints, aligning with the baseline for low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and resource ('a specific collection by ID'), making the purpose understandable. However, it doesn't differentiate from sibling tools like 'get_collections' (plural) which likely retrieves multiple collections, so it's not fully distinguished.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'get_collections' for listing multiple collections or 'get_threat_models_by_collection' for related data, leaving the agent without context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_collectionsB
Get collections from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'with pagination', which adds useful context about handling large result sets, but doesn't cover other critical aspects like whether this is a read-only operation, authentication requirements, rate limits, error conditions, or what the output looks like. For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence with no wasted words. It's front-loaded with the core purpose ('Get collections from Devici') and includes the key behavioral trait ('with pagination') efficiently. Every part of the sentence earns its place by conveying essential information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (2 simple parameters) and the presence of an output schema (which likely defines the return structure), the description is somewhat complete but has notable gaps. It covers the basic action and pagination behavior but lacks guidance on usage versus siblings and doesn't address authentication or error handling. With no annotations, it should do more to compensate, making it adequate but not fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't add any meaning beyond what the input schema provides—it doesn't explain what 'limit' or 'page' parameters do, their typical ranges, or how pagination works (e.g., zero-based indexing). With 0% schema description coverage, the schema only provides titles and types without descriptions. The description doesn't compensate for this gap, so it meets the baseline for minimal parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('collections from Devici'), making the purpose understandable. It distinguishes from siblings like 'get_collection' (singular) by implying it retrieves multiple collections. However, it doesn't specify if this is a list-all operation or filtered, leaving some ambiguity compared to more specific alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_collection' (singular), 'get_threat_models_by_collection', or 'search_users'. It mentions pagination, which hints at usage for large datasets, but doesn't explicitly state when to choose this over other collection-related tools or what scenarios it's best suited for.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_componentB
Get a specific component by ID
| Name | Required | Description | Default |
|---|---|---|---|
| component_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states 'Get' which implies a read operation, but doesn't disclose behavioral traits like authentication requirements, rate limits, error handling, or what happens if the ID doesn't exist. For a tool with zero annotation coverage, this leaves significant gaps in understanding how it behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core action ('Get a specific component by ID') with zero wasted words. It's appropriately sized for a simple retrieval tool and doesn't include unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, read operation) and the presence of an output schema (which handles return values), the description is minimally adequate. However, with no annotations and multiple sibling tools, it lacks context about the domain (e.g., threat modeling components) and differentiation, leaving the agent to rely heavily on the tool name and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning by specifying that the 'component_id' parameter is used to get a 'specific component', which clarifies the purpose of the single parameter. With 0% schema description coverage (the schema only has titles, no descriptions), this compensates well by explaining the parameter's role, though it doesn't detail format or constraints. For a tool with 1 parameter, this is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get a specific component by ID' clearly states the action (get) and resource (component), but it's vague about what 'component' means in this context and doesn't differentiate from sibling tools like 'get_components' or 'get_components_by_canvas'. It provides basic purpose but lacks specificity about the domain or how it differs from related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. With siblings like 'get_components' (plural) and 'get_components_by_canvas', the description doesn't indicate that this tool is for retrieving a single component by its ID, nor does it mention prerequisites or exclusions. The agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_componentsC
Get components from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'pagination', which hints at how results are returned, but doesn't describe what 'components' are, whether this is a read-only operation, what permissions are needed, or any rate limits. For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence: 'Get components from Devici with pagination'. It is front-loaded with the core action and includes essential context (pagination) without unnecessary words. Every part of the sentence earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a read operation with pagination), no annotations, and an output schema (which reduces the need to describe return values), the description is minimally adequate. It covers the basic purpose and hints at behavior but lacks details on usage, parameters, and behavioral traits. With an output schema, it meets a baseline level but has clear gaps in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 2 parameters (limit and page) with 0% description coverage, meaning the schema provides no semantic details. The description adds value by mentioning 'pagination', which implicitly relates to these parameters, but doesn't explain their specific roles, default values, or constraints. This partially compensates for the low schema coverage but falls short of fully clarifying parameter meanings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool 'Get components from Devici with pagination', which provides a clear verb ('Get') and resource ('components'), and mentions pagination. However, it doesn't distinguish this tool from sibling tools like 'get_component' (singular) or 'get_components_by_canvas', leaving the scope somewhat vague. The purpose is understandable but lacks sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention when to choose 'get_components' over 'get_component' (singular) or 'get_components_by_canvas', nor does it specify any prerequisites or exclusions. Usage is implied only by the name and basic function, with no explicit context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_components_by_canvasC
Get components for a specific canvas
| Name | Required | Description | Default |
|---|---|---|---|
| canvas_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It implies a read operation ('Get') but doesn't specify if it's safe, requires permissions, has rate limits, or what the output entails. This is a significant gap for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's appropriately sized and front-loaded, making it easy to parse quickly without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter) and the presence of an output schema, the description is minimally adequate. However, with no annotations and low schema coverage, it lacks details on behavior and parameters, making it incomplete for optimal agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'for a specific canvas', which hints at the 'canvas_id' parameter's purpose, adding some meaning beyond the bare schema. However, it doesn't detail format or constraints, leaving the parameter partially documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool's purpose as retrieving components for a canvas, which is clear but vague. It uses a specific verb ('Get') and resource ('components'), but doesn't distinguish from sibling tools like 'get_component' or 'get_components', leaving ambiguity about scope or differences.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites, exclusions, or compare to siblings like 'get_components' or 'get_component', leaving the agent to infer usage context without explicit direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_dataC
Get dashboard data for a specific chart type
| Name | Required | Description | Default |
|---|---|---|---|
| chart_type | Yes | ||
| limit | No | ||
| page | No | ||
| start | No | ||
| end | No | ||
| project_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'Get dashboard data' which implies a read-only operation, but doesn't cover critical aspects like authentication needs, rate limits, error handling, or what the output contains. For a tool with 6 parameters and no annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that is front-loaded with the core purpose. There's no wasted wording, and it directly states what the tool does without unnecessary elaboration, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters, 0% schema coverage, no annotations, but an output schema exists, the description is incomplete. It covers the basic purpose but lacks details on parameters, usage context, and behavioral traits. The output schema mitigates some gaps by documenting return values, but overall, the description doesn't provide enough context for effective tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters are undocumented in the schema. The description only mentions 'chart_type' implicitly, but doesn't explain any of the 6 parameters (e.g., what 'limit', 'page', 'start', 'end', 'project_id' do or their formats). It adds minimal value beyond the schema, failing to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool 'Get dashboard data for a specific chart type' which provides a clear verb ('Get') and resource ('dashboard data'), but it's vague about what 'dashboard data' entails and doesn't distinguish from siblings like 'get_dashboard_types'. It specifies 'for a specific chart type' which adds some specificity, but overall lacks detailed differentiation from related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives is provided. The description implies usage for retrieving dashboard data based on chart type, but it doesn't mention prerequisites, exclusions, or compare to siblings like 'get_dashboard_types'. Without this, the agent has minimal context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dashboard_typesB
Get available dashboard chart types
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states 'Get' implies a read operation, but doesn't specify if it requires authentication, rate limits, or what the return format looks like. The presence of an output schema helps, but the description itself lacks critical behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It's front-loaded with the core purpose and efficiently communicates the tool's function without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 0 parameters, 100% schema coverage, and an output schema exists, the description is minimally adequate. However, as a read operation with no annotations, it should ideally mention authentication needs or return format context, but the output schema mitigates some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and schema description coverage is 100%, so the schema fully documents the input (none). The description doesn't need to add parameter semantics, and it appropriately doesn't mention any. A baseline of 4 is applied for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get available dashboard chart types' clearly states the verb 'Get' and the resource 'dashboard chart types', making the purpose unambiguous. However, it doesn't differentiate from sibling tools like 'get_dashboard_data', which suggests a similar domain but different function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, exclusions, or related tools like 'get_dashboard_data', leaving the agent to infer usage context solely from the tool name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mitigationC
Get a specific mitigation by ID
| Name | Required | Description | Default |
|---|---|---|---|
| mitigation_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states it's a read operation ('Get'), but doesn't disclose behavioral traits such as error handling (e.g., what happens if the ID is invalid), authentication needs, rate limits, or the format of the returned data. The description is minimal and lacks essential operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single, direct sentence that front-loads the core purpose. There is no wasted language, and it efficiently communicates the basic action without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, read operation) and the presence of an output schema, the description is minimally adequate. However, with no annotations and 0% schema coverage, it lacks context on error cases, authentication, or data format, leaving gaps that could hinder effective use by an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the input schema, which has 0% description coverage. It mentions 'by ID' which aligns with the 'mitigation_id' parameter, but provides no additional details like ID format, examples, or constraints. With one parameter and no schema descriptions, the baseline is 3 as the description doesn't compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get a specific mitigation by ID' clearly states the action (get) and resource (mitigation), but it's vague about what a 'mitigation' entails in this context. It distinguishes from sibling 'get_mitigations' by specifying retrieval of a single item, but doesn't explain what distinguishes a mitigation from other resources like threats or components.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a valid mitigation ID), when not to use it, or how it differs from related tools like 'get_mitigations' or 'get_mitigations_by_threat' beyond the single vs. multiple item distinction implied in the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mitigationsC
Get mitigations from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions 'with pagination', which hints at behavioral traits like handling large datasets, but doesn't disclose critical details such as rate limits, authentication needs, error handling, or what 'mitigations' entails (e.g., format, content). This is a significant gap for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence: 'Get mitigations from Devici with pagination'. It's front-loaded with the core action and includes key behavioral info (pagination), making it appropriately sized with no wasted words, though it could be more structured for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which likely defines return values), the description doesn't need to explain outputs. However, with no annotations, 2 parameters, and low schema coverage, it's incomplete: it lacks context on when to use it, detailed parameter semantics, and full behavioral transparency. It's minimally viable but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description doesn't add meaning beyond the input schema, which has 2 parameters (limit, page) with 0% schema description coverage. It mentions 'pagination', implying the use of limit and page, but doesn't explain their semantics (e.g., default values, ranges, or how pagination works). With low schema coverage, the description compensates minimally, aligning with the baseline for partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool's purpose as 'Get mitigations from Devici with pagination', which includes a verb ('Get') and resource ('mitigations'), making it clear what it does. However, it doesn't distinguish it from sibling tools like 'get_mitigation' (singular) or 'get_mitigations_by_threat', leaving the scope vague beyond pagination.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It mentions pagination, but doesn't specify contexts like retrieving all mitigations versus filtered ones (e.g., by threat), nor does it reference sibling tools for comparison, leaving usage unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_mitigations_by_threatB
Get mitigations for a specific threat
| Name | Required | Description | Default |
|---|---|---|---|
| threat_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states what the tool does ('Get mitigations'), but doesn't describe whether it's read-only, requires authentication, has rate limits, or what the output format entails. This is inadequate for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence that directly states the tool's purpose. It's front-loaded and wastes no words, making it efficient for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which handles return values) and only 1 parameter, the description is minimally complete. However, with no annotations and sibling tools that could cause confusion, it lacks sufficient context for optimal agent use, especially regarding behavioral aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'for a specific threat', which implies the 'threat_id' parameter is required to identify the threat. However, with 0% schema description coverage and only 1 parameter, the description adds minimal value beyond what the schema's title ('Threat Id') already suggests. The baseline is appropriate given the low parameter count.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'mitigations for a specific threat', making the purpose understandable. However, it doesn't differentiate from sibling tools like 'get_mitigation' or 'get_mitigations', which could be confusing for an agent trying to select the right tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_mitigation' or 'get_mitigations'. It doesn't specify prerequisites, context, or exclusions, leaving the agent without clear usage instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_teamB
Get a specific team by ID
| Name | Required | Description | Default |
|---|---|---|---|
| team_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the basic action. It doesn't disclose behavioral traits like whether this is a read-only operation (implied but not stated), authentication needs, error handling, rate limits, or what happens if the team ID doesn't exist. The description is minimal and lacks necessary context for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero wasted words. It's appropriately sized for a simple retrieval tool and front-loads the essential information immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, has output schema) but lack of annotations, the description is minimally adequate. The output schema existence means return values don't need explanation, but the description should still cover more behavioral aspects for a complete understanding. It meets basic requirements but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'by ID' which adds meaning to the 'team_id' parameter beyond what the schema provides (0% coverage, just title 'Team Id'). However, it doesn't explain the ID format, source, or constraints. With 1 parameter and low schema coverage, this provides basic but incomplete semantic context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a specific team by ID'), making the purpose unambiguous. It distinguishes from the sibling 'get_teams' by specifying retrieval of a single team rather than multiple teams. However, it doesn't fully differentiate from other get_* tools like 'get_user' or 'get_collection' beyond the resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need a specific team identified by ID, but doesn't explicitly state when to use this versus alternatives like 'get_teams' for listing teams or other get_* tools for different resources. No guidance on prerequisites or exclusions is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_teamsC
Get teams from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions pagination, which is useful context, but fails to describe other critical traits such as whether this is a read-only operation, any authentication requirements, rate limits, error handling, or the structure of returned data. For a tool with two parameters and an output schema, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('Get teams from Devici') and adds essential detail ('with pagination') without unnecessary words. Every part earns its place, making it highly concise and well-structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (2 parameters, no nested objects) and the presence of an output schema, the description is minimally adequate. It covers the basic action and pagination but lacks details on behavioral traits and parameter semantics. With no annotations, it should do more to explain usage and constraints, but the output schema mitigates some completeness needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for undocumented parameters. It mentions 'pagination' but doesn't explain the specific parameters 'limit' and 'page' or their semantics (e.g., what 'page' 0 means, default values, or valid ranges). This adds minimal value beyond the schema's titles, failing to adequately clarify parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get teams from Devici with pagination' clearly states the action (Get), resource (teams), and system (Devici), with the addition of pagination as a key feature. It distinguishes from sibling 'get_team' (singular) by implying it retrieves multiple teams. However, it doesn't explicitly differentiate from other list-like siblings like 'get_collections' or 'get_users', keeping it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention when to choose 'get_teams' over 'get_team' (singular) or other retrieval tools like 'get_collections', nor does it specify prerequisites or exclusions. The mention of pagination hints at usage for large datasets but lacks explicit context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threatB
Get a specific threat by ID
| Name | Required | Description | Default |
|---|---|---|---|
| threat_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states the action ('Get') but lacks behavioral details: it doesn't specify if this is a read-only operation, what permissions are required, error handling (e.g., for invalid IDs), or response format. The description is minimal and misses key operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's function without unnecessary words. It's appropriately sized for a simple retrieval tool and front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter) and the presence of an output schema (which handles return values), the description is minimally adequate. However, with no annotations and 0% schema coverage, it lacks context on behavior, usage, and parameter details, making it incomplete for optimal agent understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'by ID', which clarifies the 'threat_id' parameter's purpose, but adds no details on format, constraints, or examples. This provides basic meaning but doesn't fully address the coverage gap, aligning with the baseline for partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a specific threat by ID'), making the purpose immediately understandable. It distinguishes from sibling tools like 'get_threats' (plural) by specifying retrieval of a single threat, though it doesn't explicitly contrast with other threat-related tools like 'get_threats_by_component'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a threat ID), exclusions, or comparisons to siblings like 'get_threats' (for listing) or 'get_threats_by_component' (for filtered retrieval).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threat_modelB
Get a specific threat model by ID
| Name | Required | Description | Default |
|---|---|---|---|
| threat_model_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It states it's a read operation ('Get'), implying it's non-destructive, but doesn't mention authentication needs, rate limits, error handling, or what happens if the ID doesn't exist. For a tool with no annotation coverage, this leaves critical behavioral traits unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence with no wasted words. It's front-loaded with the core action and resource, making it easy to parse quickly. Every word earns its place by conveying essential information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter) and the presence of an output schema (which handles return values), the description is minimally adequate. However, with no annotations and incomplete parameter guidance, it lacks context on usage scenarios and behavioral traits, making it incomplete for optimal agent decision-making.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions the parameter ('by ID'), which adds meaning beyond the schema's 0% description coverage. However, it doesn't specify the ID format (e.g., UUID, numeric) or where to find it, leaving gaps. With one parameter and low schema coverage, the description provides some but incomplete compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a specific threat model by ID'), making the purpose understandable. However, it doesn't distinguish this tool from sibling tools like 'get_threat_models' (plural) or 'get_threat_models_by_collection', leaving some ambiguity about when to use this specific retrieval method versus others.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With sibling tools like 'get_threat_models' (likely for listing) and 'get_threat_models_by_collection', there's no indication whether this is for single-item retrieval by unique ID or if it has specific prerequisites. This lack of context could lead to misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threat_modelsB
Get threat models from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions pagination, which is useful context, but fails to describe other key behaviors such as authentication requirements, rate limits, error handling, or what the output looks like (though an output schema exists). For a list tool with zero annotation coverage, this leaves significant gaps in understanding how the tool operates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose ('Get threat models from Devici') and adds essential context ('with pagination'). There is no wasted verbiage, making it appropriately concise and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a list operation with pagination), no annotations, and an output schema (which reduces the need to describe return values), the description is minimally adequate. It covers the basic action and hints at pagination, but lacks details on usage context, behavioral traits, and parameter meanings, leaving room for improvement in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema provides no descriptions for the 'limit' and 'page' parameters. The description adds value by mentioning 'pagination', which implies the use of these parameters, but it doesn't explain their semantics (e.g., what 'limit' and 'page' mean in this context, default values, or constraints). This partial compensation justifies a baseline score of 3, as it hints at parameter usage without full details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and resource ('threat models from Devici'), making the purpose understandable. However, it doesn't differentiate this tool from sibling tools like 'get_threat_model' (singular) or 'get_threat_models_by_collection', leaving some ambiguity about when to use this specific list endpoint versus alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_threat_model' (singular) or 'get_threat_models_by_collection'. It mentions pagination, which implies usage for listing multiple items, but lacks explicit context or prerequisites for selection among similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threat_models_by_collectionC
Get threat models for a specific collection
| Name | Required | Description | Default |
|---|---|---|---|
| collection_id | Yes | ||
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the basic action without mentioning permissions, rate limits, pagination behavior (implied by 'limit' and 'page' parameters but not explained), or response format. This is inadequate for a tool with parameters and potential complexity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's purpose without unnecessary words. It's appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 parameters, 0% schema coverage, no annotations, but an output schema exists, the description is incomplete. It covers the basic purpose but lacks details on parameter usage, behavioral traits, and differentiation from siblings. The output schema mitigates some gaps by documenting return values, but overall, it's minimally viable with clear deficiencies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but fails to do so. It mentions 'for a specific collection', which hints at 'collection_id', but doesn't explain 'limit' or 'page' parameters or their effects (e.g., pagination). The description adds minimal meaning beyond the schema, leaving key parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get threat models for a specific collection' clearly states the action (get) and resource (threat models), but it's vague about scope and doesn't distinguish from siblings like 'get_threat_models' or 'get_threat_models_report'. It specifies 'for a specific collection', which adds some context but remains basic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as 'get_threat_models' (which might fetch all threat models) or 'get_threat_models_report' (which might generate reports). The description implies usage for a specific collection but lacks explicit when/when-not instructions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threat_models_reportD
Get threat models report data
| Name | Required | Description | Default |
|---|---|---|---|
| start | No | ||
| end | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure but provides none. It doesn't indicate whether this is a read-only operation, what format the report data takes, whether it's paginated or filtered, what permissions are required, or any rate limits. The description fails to disclose any behavioral traits beyond the basic action implied by 'get'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is maximally concise at just 5 words, with no wasted words or unnecessary elaboration. It's front-loaded with the core action and resource. While this conciseness comes at the expense of completeness, the description itself is structurally efficient with every word serving a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a tool with 2 parameters (0% schema coverage), no annotations, multiple similar sibling tools, and an output schema (which means the description doesn't need to explain return values), the description is completely inadequate. It fails to address the parameter meaning gap, provides no behavioral context, and offers no differentiation from alternatives. For a report-generation tool with date filtering parameters, this minimal description leaves critical questions unanswered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for both parameters (start and end), and the tool description provides absolutely no information about what these parameters mean or how they should be used. The description doesn't mention that date filtering is available, doesn't explain what format the dates should be in, and doesn't clarify whether both parameters are required or optional. With 2 undocumented parameters and no compensation in the description, this is inadequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get threat models report data' is a tautology that essentially restates the tool name 'get_threat_models_report'. It specifies the verb 'get' and resource 'threat models report data', but doesn't clarify what constitutes 'report data' versus regular threat model data available through sibling tools like 'get_threat_model' or 'get_threat_models'. The purpose remains vague about what distinguishes this report from other threat model retrieval operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides absolutely no guidance on when to use this tool versus alternatives. With multiple sibling tools for retrieving threat models (get_threat_model, get_threat_models, get_threat_models_by_collection) and no indication of what makes this 'report' different, there's no help for an agent to choose appropriately. No context, prerequisites, or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threatsC
Get threats from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'pagination', which is a useful behavioral trait, but lacks details on permissions, rate limits, response format, or error handling. For a read operation with no annotation coverage, this leaves significant gaps in understanding how the tool behaves beyond basic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence: 'Get threats from Devici with pagination'. It's front-loaded with the core action and resource, and the additional detail (pagination) is relevant and concise. There's no wasted verbiage, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a read operation with pagination), no annotations, and an output schema (which handles return values), the description is minimally adequate. It covers the basic purpose and hints at behavior but lacks details on usage context, parameter semantics, and full behavioral traits. With output schema present, it doesn't need to explain returns, but overall completeness is limited.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 2 parameters (limit, page) with 0% description coverage, so the schema provides no semantic context. The description adds value by implying pagination, which relates to these parameters, but doesn't explain their roles (e.g., limit controls results per page, page indicates offset). It partially compensates for the schema gap but doesn't fully clarify parameter meanings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get threats from Devici with pagination' clearly states the action (get) and resource (threats), and mentions the system (Devici) and a key feature (pagination). However, it doesn't differentiate from sibling tools like 'get_threat' (singular) or 'get_threats_by_component', leaving the scope ambiguous. It's specific enough to understand the basic function but lacks sibling distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'get_threat' (for a single threat) and 'get_threats_by_component' (for filtered threats), there's no indication of context, prerequisites, or exclusions. The mention of 'pagination' hints at usage for large datasets but doesn't explicitly guide selection among similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threats_by_componentC
Get threats for a specific component
| Name | Required | Description | Default |
|---|---|---|---|
| component_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states this is a 'Get' operation, implying read-only behavior, but doesn't clarify authentication needs, rate limits, error conditions, or what the output contains (though an output schema exists). For a tool with zero annotation coverage, this minimal description leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's front-loaded with the core action and resource, making it easy to parse quickly. Every word earns its place in conveying the basic purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one required parameter) and the presence of an output schema (which handles return values), the description is minimally adequate. However, with no annotations and poor schema coverage, it should provide more context about parameter meaning and usage distinctions from siblings to be fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description mentions 'a specific component' but doesn't explain what 'component_id' represents, its format, or where to obtain it. With 0% schema description coverage (the schema only provides a title 'Component Id'), the description fails to compensate for this gap. It adds minimal value beyond the schema's basic parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get threats for a specific component' clearly states the verb ('Get') and resource ('threats'), with a scope modifier ('for a specific component'). However, it doesn't distinguish this tool from sibling tools like 'get_threats' (which likely gets all threats) or 'get_threat' (which gets a single threat), leaving ambiguity about when to use this specific tool versus those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'get_threats' and 'get_threat' available, there's no indication whether this tool is for filtering threats by component, retrieving component-specific threat details, or some other purpose. No prerequisites, exclusions, or comparative context are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_userB
Get a specific user by ID
| Name | Required | Description | Default |
|---|---|---|---|
| user_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'Get' implies a read operation, but it doesn't specify whether this requires authentication, what happens if the user doesn't exist, rate limits, or response format. The description is minimal and lacks crucial behavioral context for a tool that likely interacts with user data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just 5 words, front-loading the essential information ('Get a specific user') with no wasted words. Every element serves a purpose, making it efficient despite its brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which handles return values) and only one parameter, the description's minimalism is somewhat acceptable. However, with no annotations and 0% schema coverage, it should provide more context about authentication needs, error conditions, or differentiation from siblings to be truly complete for a data retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema provides no parameter documentation. The description adds some meaning by specifying 'by ID', which clarifies the purpose of the 'user_id' parameter. However, it doesn't explain format requirements (e.g., UUID, numeric ID) or constraints, leaving significant gaps in parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a specific user by ID'), making the purpose immediately understandable. However, it doesn't differentiate from sibling tools like 'get_users' (plural) or 'search_users', which would require explicit comparison to earn a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_users' or 'search_users'. It mentions 'by ID' which implies you need a specific user identifier, but doesn't explicitly state prerequisites or contrast with sibling tools that might serve similar purposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_usersB
Get users from Devici with pagination
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions pagination, which hints at list behavior, but doesn't disclose critical details like authentication requirements, rate limits, error conditions, or what the output contains. For a read operation with zero annotation coverage, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's front-loaded with the core purpose ('Get users from Devici') and adds necessary detail ('with pagination') without redundancy. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists, the description doesn't need to explain return values. However, with 2 parameters at 0% schema coverage and no annotations, the description is incomplete—it lacks details on authentication, errors, and parameter usage. It's minimally adequate but has clear gaps for a tool with pagination parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'pagination', which implicitly relates to the 'limit' and 'page' parameters, but doesn't explain their semantics (e.g., what 'page=0' means, default values, or valid ranges). This adds some context but falls short of fully documenting the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and resource 'users from Devici', making the purpose understandable. It also mentions 'with pagination', which adds useful context about the operation's scope. However, it doesn't distinguish this tool from its sibling 'get_user' (singular) or 'search_users', which is a minor gap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_user' (for a single user) or 'search_users' (for filtered searches). It mentions pagination, which implies use for bulk retrieval, but doesn't explicitly state this as a usage scenario or differentiate from siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
invite_userB
Invite a new user to Devici
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | |||
| first_name | Yes | ||
| last_name | Yes | ||
| role | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states the action is 'invite' but doesn't clarify whether this sends an email invitation, requires admin permissions, has rate limits, or what happens if the user already exists. This leaves critical behavioral aspects unspecified for a mutation operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without unnecessary words. It's appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, 4 parameters, and an output schema (which reduces need to describe returns), the description is minimally adequate. It states what the tool does but lacks crucial context about permissions, side effects, and error conditions that would help an agent use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no parameter information beyond what's in the schema (which has 0% description coverage). While the schema clearly defines four required parameters (email, first_name, last_name, role), the description doesn't explain their purpose, constraints, or relationships. The baseline is 3 since the schema provides structure, but the description fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Invite') and the target ('a new user to Devici'), making the purpose immediately understandable. However, it doesn't differentiate this tool from potential alternatives like 'create_user' or specify what 'invite' entails versus direct creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. Given sibling tools include 'create_collection' and 'get_user', there's no indication of whether this is for initial user onboarding versus other user management scenarios, leaving the agent to guess based on context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_usersC
Search users by field and text
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | ||
| text | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions searching but doesn't describe key traits like whether it's read-only (implied by 'search'), what permissions are required, if there are rate limits, pagination behavior, or the format of results. This leaves significant gaps for an agent to understand how to invoke it effectively.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with a single sentence, 'Search users by field and text', which is front-loaded and wastes no words. It efficiently conveys the core action, though this brevity contributes to gaps in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which likely defines return values), the description doesn't need to explain results. However, with 2 parameters, 0% schema coverage, and no annotations, the description is incomplete—it lacks details on parameter usage, behavioral context, and differentiation from siblings. It's minimally adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema provides no details about parameters. The description adds minimal semantics by naming 'field' and 'text' but doesn't explain what fields are valid (e.g., 'name', 'email'), what text matching is used, or any constraints. This insufficiently compensates for the lack of schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Search users by field and text' states a clear verb ('search') and resource ('users'), but it's vague about what constitutes a 'field' and what type of search is performed (e.g., exact match, partial, case-sensitive). It doesn't distinguish this tool from sibling 'get_users' or 'get_user', leaving ambiguity about when to use each.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'get_users' (which might list all users) or 'get_user' (which might fetch a specific user by ID). The description implies a filtered search but doesn't specify contexts or exclusions, such as whether it's for admin-only access or specific use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
25 tool updates
- First observed
create_collection - First observed
create_threat_model - First observed
get_collection - First observed
get_collections - First observed
get_component - First observed
get_components - First observed
get_components_by_canvas - First observed
get_dashboard_data - First observed
get_dashboard_types - First observed
get_mitigation - First observed
get_mitigations - First observed
get_mitigations_by_threat - First observed
get_team - First observed
get_teams - First observed
get_threat - First observed
get_threat_model - First observed
get_threat_models - First observed
get_threat_models_by_collection - First observed
get_threat_models_report - First observed
get_threats - First observed
get_threats_by_component - First observed
get_user - First observed
get_users - First observed
invite_user - First observed
search_users
TDQS
Every tool has a clearly distinct purpose with no ambiguity. Tools are organized around specific resources (collections, threat models, components, mitigations, teams, threats, users) and actions (create, get, invite, search), with clear boundaries between them. For example, get_threat and get_threat_model target different entities, and paginated list tools are distinguished from single-item retrieval tools.
Tool names follow a highly consistent verb_noun pattern throughout. All tools use snake_case with clear verbs like 'create', 'get', 'invite', or 'search' followed by a noun or noun phrase (e.g., 'create_collection', 'get_components_by_canvas'). There are no deviations in naming conventions, making the set predictable and readable.
With 25 tools, the count feels heavy and borderline excessive for the apparent scope of a threat modeling and security management server. While the tools cover many resources, the high number suggests potential over-fragmentation, such as having separate tools for paginated lists and single-item retrieval for each resource, which could overwhelm agents or lead to unnecessary complexity in tool selection.
The tool surface is largely complete for the domain of threat modeling and security management, covering CRUD operations for key resources like collections, threat models, components, mitigations, teams, threats, and users. Minor gaps exist, such as missing update or delete operations for most resources (only create and get are present), but agents can likely work around this with existing tools for core workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Gateway between LLM agents and world data through eight tools and a bundled endpoint catalog.
Point Gecko at an OpenAPI spec; get first-call-correct, auth-hidden agent tools.
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceProvides broad, typed access to the ftrack Studio production-tracking API for LLM agents via 28 tools, including generic CRUD and convenience operations for projects, tasks, notes, and more.MIT
- FlicenseNot gradedqualityBmaintenanceExposes tools to create and list tasks by wrapping a REST API, enabling LLMs to manage a TODO list via natural language.-
- FlicenseNot gradedqualityCmaintenanceEnables LLM clients to interact with ThreatConnect v3 for case management and threat intelligence, providing typed tools for creating/updating cases, indicators, and artifacts while handling HMAC authentication and API quirks.-
- AlicenseAqualityBmaintenanceExposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling queries on security profiles, activity timelines, AD objects, and more.155MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/geoffwhittington/devici-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server