agentflow-mcp

risk_policy_lookup

Retrieve required controls, risk flags, and human-in-the-loop triggers for an architecture by providing industry, data classification, region, deployment, and governance constraints.

Instructions

Return required controls, risk flags, and human-in-the-loop triggers for an architecture based on industry, data classification (PHI, PII, regulated financial data), region, deployment model, and governance constraints.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "industry": "<industry>",
      "data_classification": "<data_classification>",
      "region": "<region>",
      "deployment": "<deployment>"
    },
    "name": "risk_policy_lookup"
  }
}

Input Schema

Name	Required	Description
`region`	Yes	Data region, e.g. US or EU
`industry`	Yes	Industry, e.g. healthcare, financial_services, media_agency, retail
`deployment`	Yes	Deployment model: cloud, on-prem, or hybrid
`constraints`	No	Governance constraints from the architecture brief, e.g. ["cross-client governance", "EU data residency"]
`data_classification`	Yes	Data classifications in scope, e.g. ["PHI", "PII"], ["regulated financial data"], ["non-sensitive"]

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Aug 23, 2026

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the full burden. It surfaces that the tool computes/returns policy-derived values and maps inputs to outputs, which is genuinely informative, but it doesn't say whether the data is static, whether lookups can return empty/no-match results, or whether governance constraints are validated at runtime. 3 is fair.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence with a heavy enumerative tail, but every phrase contributes. Front-loads the return value ('required controls, risk flags...') before diving into the lookup axes. Slightly long but not bloated; the enumeration is useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a lookup tool with 5 params, 100% schema coverage, and no output schema, the description covers the key decision context (what it returns and on what basis). It doesn't state the output shape, but with no output schema that gap is mostly acceptable, though adding 'returns a list of policy items' would make it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents every parameter with 100% coverage, so the baseline is 3 per the rubric. The description clarifies the semantic intent behind the parameters as a group (industry/classification/region/deployment drive policy), but adds no individual parameter details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Return') and a specific resource ('required controls, risk flags, and human-in-the-loop triggers for an architecture') and enumerates the dimensions the lookup is based on, clearly distinguishing it from sibling lookup tools such as brand_context_lookup or arch_pattern_lookup. The scope is explicit enough that an agent can tell when to reach for this tool instead of the others.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies this tool is for policy/risk-oriented lookups and lists the exact inputs that drive the lookup, which gives strong context on when to use it. The only thing missing is an explicit 'use this instead of X when...' statement, but the sibling names (brand_context_lookup, arch_pattern_lookup) are distinguishable from the plain wording.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server