Skip to main content
Glama
Atlasent

atlasent-mcp

Official

@atlasent/mcp-server

MCP server that enforces authorize-before-execute for any MCP-compatible AI agent.

It is the developer entry point to AtlaSent AI Action Protection, which Enterprise teams adopt through a design partner program.

npm version CI License: Apache-2.0 Glama MCP server

AtlaSent is security and organizational authority infrastructure for consequential actions by people, software, and AI.

This MCP server brings it to AI agents (Claude, Cursor, Windsurf, any MCP host). Before an agent's tool call changes a real system (a production deploy, a data export, an access grant), the agent asks AtlaSent first. With an API key (remote mode):

  1. Connect it to your agent with a few lines of config.

  2. Risky actions wait for a person to approve them. Everything else runs as normal.

  3. Every decision gets a signed record, including who approved it when the decision relied on an approval.

Try it in 60 seconds with no account: npx -y @atlasent/mcp-server (local mode, a demo that protects nothing).

Local blocking is free. To actually block on your own machine without an account, use MCP Gate or the Claude Code agent guard. Both are part of the free Community plan. Hosted decisions, shared policies and approvals for a team are on the AtlaSent plans.

For engineers

AtlaSent performs execution-time authorization: determine whether a specific consequential Action is authorized now, issue a bounded Permit on allow, verify that Permit at the execution Gate, and only then allow the governed native effect.

A plausible request is not organizational authority.

This MCP server exposes AtlaSent authorization primitives to Model Context Protocol hosts and includes a protected deployment demo that proves the ordering end to end.

Which authority decided?

This repository ships two packages, and one of them has two modes. All three block tool calls. Only one of the three is evidence, and the difference is not a feature list — it is who said yes.

Surface

Who decided

What it is

@atlasent/mcp-server local mode

a built-in heuristic

nothing — a credential-free demo. Its terminal rule is allow, including for action types it does not recognise. Never rely on it as protection.

@atlasent/mcp-gate + policy.json

you, in advance, in a file you can edit

operator configuration. Starts at {"default":"deny","rules":[]} and blocks everything until you write a rule. Runs with no account and no network.

@atlasent/mcp-gate cloud mode

your organization, at execution time

an organizational permit — single-use, bound to that call, verifiable afterwards.

A rule you can silently edit is configuration. A permit your organization issued, that was consumed once and can be produced later, is authority. Both stop the call; only the second answers "who authorized this?" — which is the question that arrives after an incident, not before one.

The gate says which one decided, on every decision: no_matching_rule is your local policy, cloud_permit_consumed is an organizational permit. These reason strings are deliberately not normalised into a generic "blocked." Do not collapse them.

The two packages point in opposite directions, which is why they are separate: mcp-server exposes AtlaSent as MCP tools an agent calls to ask for authorization; mcp-gate sits in front of someone else's MCP server and intercepts.

Related MCP server: permitd MCP Server

The invariant

For an enforced protected path:

Action proposed
  → current organizational Authority + Policy + Context evaluated
  → Decision
      deny / hold / escalate → STOP
      allow → bounded Permit
  → Permit Verification at the execution Gate
      invalid / expired / replayed / mismatched / error → STOP
      verified → native effect may execute
  → execution/native-effect Evidence recorded where the integration supplies it

Evaluation is not execution. A positive Decision is not the Gate. Permit Verification happens before the protected side effect.

Quickstart: 60 seconds, no account

You don't need an AtlaSent account or API key to try this server. With no credentials set, it runs in local mode: an in-process rules engine that works offline.

Add this to your MCP host config (Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, and others; per-host file locations are below):

{
  "mcpServers": {
    "atlasent": {
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": { "ATLASENT_MODE": "local" }
    }
  }
}

Then ask your agent to "deploy billing-api to production". The built-in rules deny it because it has no approvals. Ask again with an approval and it's allowed, and the server verifies the permit before the simulated deploy runs.

Built-in local rules (src/localEngine.ts):

Situation

Decision

Production action with no approvals

deny

Destructive action (delete, drop, purge, ...) outside a change window

hold

Sign / certify / grant / revoke / suspend / resume actions

deny

Override / release / export / import / publish actions

hold

Anything that passes the rules

allow → single-use permit, 5-minute TTL

Local permits are unsigned, so local mode is for development, CI, and trying things out. It's not a production enforcement boundary. The server refuses to fall back to local mode under NODE_ENV=production. When you're ready for signed permits, audit evidence, and your organization's own policies, switch to remote mode — get an API key.

Run from source

git clone https://github.com/AtlaSent/atlasent-mcp-server.git
cd atlasent-mcp-server
npm install
npm run build
npm run demo      # blocked deploy → approved + verified deploy → replay refused, fully offline

Run with Docker

docker build -t atlasent-mcp .
docker run -i --rm atlasent-mcp                                          # local mode, stdio
docker run -i --rm -e ATLASENT_API_KEY -e ATLASENT_BASE_URL atlasent-mcp  # remote mode

Claude Code plugin: stop agents destroying production

packages/agent-hooks is a Claude Code plugin. Destructive and shipping commands wait for a person: DROP TABLE, terraform destroy, volume deletes, git push --force, production deploys. With nobody to ask, they are refused. Everything else runs as normal. Local, no account.

/plugin marketplace add AtlaSent/atlasent-mcp-server
/plugin install atlasent-guard@atlasent

"Someone at the keyboard said yes" is where it stops. The rest of this repository is the organizational version: an approver your organization named, and a permit you can prove afterwards.

Canon-backed Actions

AtlaSent does not treat every ad-hoc tool string as a new governed Action Type.

Use the Protected Action Canon for stable Action identity. Two important examples are:

production.deploy
agent.tool.invoke

For a generic AI tool invocation, use agent.tool.invoke as the public Canon-backed Action Type and carry tool-specific facts—tool name, target, environment, arguments/payload digest, resource state, and other required context—in the authorization context or binding fields supported by the selected integration path.

Use the read-only atlasent_lookup_action tool to discover Canon-backed Action Types instead of inventing a parallel taxonomy.

Authority is not Approval

Keep the concepts separate:

  • Authority — standing, scoped organizational right to cause a class of change.

  • Authorization — per-request determination whether this exact Action may proceed now.

  • Policy — versioned conditions applied to the determination.

  • Approval — verified input that may satisfy a Policy condition; not standing Authority and not the final Authorization result.

  • Decision — allow | deny | hold | escalate at the platform boundary.

  • Permit — bounded positive-Authorization artifact.

  • Verification — execution-boundary check of the Permit and applicable bindings.

  • Execution / native effect — what the underlying tool or system actually does.

  • Evidence / Proof — durable evidence of the authorization and, where observed, the effect/result.

A human Approval, favorable risk signal, policy match, deployment ticket, or workflow status does not by itself become organizational Authority.

Protected-tool demo

deploy_service is intentionally small. It demonstrates a two-layer protected path:

agent requests deploy_service
  → authorize internal agent-tool compatibility gate
  → verify outer Permit
  → authorize production.deploy
  → verify production.deploy Permit
  → simulated deployment effect

The internal outer gate uses the Canon-backed agent.tool.invoke Action (CANON-000026 / ACT-0029) — the same public identifier documented throughout the AtlaSent ecosystem as the canonical generic AI-agent tool invocation. It previously used a legacy, uncatalogued identity, model.agent.execute_tool, which had no corresponding action_classes provisioning path in the runtime (no seed/migration anywhere creates a row with that slug) — so against a real, unmodified Atlasent org the outer gate could only ever return NO_ACTION_CLASS deny, regardless of the tool-specific inner gate's own decision. Migrating the outer gate onto agent.tool.invoke gives it the runtime's real "AI Agent Safeguard" provisioning path, which already exists for exactly this purpose. See AtlaSent/atlasent-mcp-server#121 for the full investigation and decision record.

If either Decision is non-allow or either Permit fails Verification, no deployment result is produced.

The protected-tool response includes the action-specific Verification result alongside the simulated native result:

{
  "decision": "allow",
  "permit_token": "...",
  "verification": {
    "outcome": "verified",
    "valid": true
  },
  "result": {
    "status": "deployed",
    "service": "billing-api"
  }
}

The returned Permit has already been consumed by the execution-boundary Verification. Verifying it again should be treated as a replay, not as a step required after deployment.

Human-in-the-loop demo: hold, approve, execute, record

examples/hitl-demo.mjs shows one uninterrupted sequence against a hosted runtime and a real GitHub repository, using atlasent_governed_file_change (AI Action Protection, a design partner program):

Stage

What you see

1 ATTEMPT

The agent asks to change a config file

2 HOLD

The runtime holds it and returns an approval_request_id. The file is re-read and is unchanged

3 BOUND

The same request with different content is refused, so the approval covers only this change

4 APPROVE

A person approves the request in the AtlaSent console (Approvals)

5 EXECUTE

The permit is verified at the boundary, then exactly one write is made, and the commit sha is printed

6 RECORD

The tool re-reads the effect at the commit and at the branch head, the demo re-reads it again, and the ai_action_proof.v1 hash is printed

The key must be agent-bound (console: Settings → Connect an AI agent). Use a dedicated demo repository.

npm run build
ATLASENT_API_KEY=ask_test_... \
ATLASENT_BASE_URL=https://<ref>.supabase.co/functions/v1 \
ATLASENT_ENVIRONMENT=staging \
ATLASENT_AI_ACTION_GITHUB_REPO=owner/demo-repo \
ATLASENT_AI_ACTION_GITHUB_BRANCH=main \
ATLASENT_AI_ACTION_GITHUB_TOKEN=<token that can write only that repo> \
npm run demo:hitl

The demo prints only what the tool returned or the repository showed. If a stage doesn't happen, the demo stops with FAIL at <stage> and exits 1. For example, if the org's agent.tool.invoke policy allows the change with no person involved, the demo fails at ATTEMPT rather than skipping the hold. The org's policy must require human approval. It writes hitl-demo-evidence-<ts>.json, and the permit appears in it only as a sha256.

Before presenting, run npm run demo:hitl:preflight. It's a read-only setup check: it makes GET requests only and creates no request, approval, permit or commit. The presenter run sheet, with prerequisites, console clicks and expected output, is docs/DEMO_90_SECONDS.md.

npm run demo:hitl -- --simulate rehearses the same stages offline with an in-memory runtime, repository and approver. Every line it prints starts with [SIMULATED], and it refuses any real network call. Don't present a simulated run as a live one.

Self-gating agent pattern

For an agent or MCP host that owns its own native tool boundary, the safe pattern is:

const decision = await evaluate({
  action_type: "agent.tool.invoke",
  actor_id: "agent:research-bot",
  environment: "production",
});

if (decision.decision !== "allow") {
  throw new Error("Action is not authorized");
}

const verification = await verify_permit({
  permit_token: decision.permit_token,
  action_type: "agent.tool.invoke",
  actor_id: "agent:research-bot",
  environment: "production",
  // Present target_id / payload_hash when the selected authorization path
  // binds those fields.
});

if (!verification.valid) {
  throw new Error("Permit did not verify");
}

// Only now may the protected native effect occur.
const result = await runProtectedTool();

A wrapper, decorator, prompt, or MCP tool definition is not automatically a non-bypassable Gate. The enforcement claim belongs to the actual topology: the native effect must be unreachable through the claimed protected path unless required Authorization and Permit Verification succeeded.

Core tools

evaluate

Simple local/remote authorization helper for MCP hosts.

Input:  { action_type, actor_id, environment, approvals?, change_window?, target_id?, change_plan?, target_system? }
Output: { decision: "allow" | "deny" | "hold", permit_token?, notes?, ... }

On allow, do not execute yet. Present the Permit to verify_permit at the execution boundary first.

verify_permit

Execution-boundary verification helper.

Input: {
  permit_token,
  action_type,
  actor_id,
  environment,
  approvals?,
  change_window?,
  target_id?,
  payload_hash?
}
Output: { outcome: "verified" | "expired" | "invalid" | "error", valid, ... }

Proceed only when valid === true. Successful Verification consumes a single-use Permit where that contract applies.

deploy_service

Protected deployment demonstration. It performs the necessary Authorization and Verification internally before producing its simulated deployment result.

atlasent_evaluate / atlasent_verify_permit

Hosted V1 API-facing tools. Use the richer remote evaluation path when you need additional context beyond the small evaluate demo envelope. Verification remains an execution-boundary operation.

atlasent_lookup_action

Read-only Canon lookup for Action Types, gate flags, authorization patterns, evidence requirements, and graph relationships.

Input:  { slug? }    // exact Canon slug, e.g. "production.deploy"
        { query? }   // plain language, e.g. "deploy the api service to prod"
        {}           // list the full Canon
Output: { found, result_count, actions[], retrieval? }

query is resolved by a deterministic, fully offline ranker over the vendored Canon (no embeddings service, no network — src/actionRetrieval.ts). The response carries a retrieval block:

retrieval.confidence

Meaning

confident

One Canon entry clearly matches. actions[0] is it. Safe to act on.

ambiguous

Two or more entries are close, or the request only partly matched. Read retrieval.candidates and pick, or rephrase.

none

The Canon has no action matching this description. found is false, actions is empty, and hint points at the Canon intake pipeline.

The tool never invents an action type: every candidate is a Canon entry by reference, and a request the Canon cannot answer comes back as none rather than a plausible-looking slug. Context words such as emergency, weekend, or urgent are treated as policy context, not as evidence of a different action — "emergency deploy to production" still resolves to production.deploy, per LIFECYCLE.md's classification principle.

atlasent_atlas_lookup

Read-only lookup of canonical AtlaSent concepts such as Authority, Policy, Decision, Permit, Verification, Evidence, Gate, and Trust Root.

atlasent_evidence_gap_report

"Where are my deploys ungoverned?" Pass the text of your .github/workflows/*.yml files and get back every step that changes a real system (deploys, package and image publishes, database migrations, terraform/pulumi applies), each with a status:

status

Meaning

bound

A gate runs earlier in the job, and the step runs only if: steps.<gate>.outputs.verified == 'true'.

gated

A gate runs earlier in the job; a deny fails the job before the step.

gated_upstream

The gate is in a job this job needs:. Nothing re-verifies the permit where the step runs.

weak

A gate exists but cannot stop the step: continue-on-error, its own if: (a skip_gate input, for example), or mode: evaluate-only with nothing consuming the permit.

ungoverned

No gate at all.

Input:  { workflows: [{ path, content }], gate_actions? }
Output: { summary, findings[], triggers, parse_errors[], not_checked[], next_step, setup? }

Every gap (ungoverned or weak) carries a fix: the atlasent-action step to insert before it (with the action type that fits: production.deploy, package.release or infrastructure.change), the exact if: that binds the step to the gate's verified permit, and any change the existing gate needs (drop continue-on-error, drop a skip_gate condition, add id-token: write). When there are gaps, setup gives the sign-up link for the API key the gate needs. Apply the fix and run the report again: the step shows as bound.

Works in local mode: no API key, no network, nothing executed. gate_actions names your own gate wrappers (a composite action, say); they are reported as custom gates whose internals were not inspected. The report always lists what it cannot see (repository settings, deploys outside CI, the inside of ./deploy.sh), and a file it cannot parse is listed in parse_errors, never skipped. A clean report is not proof that nothing is ungoverned.

atlasent_exposure_review

The free Authorization Exposure Review. It runs the same offline analysis as atlasent_evidence_gap_report and returns it as a review a person can read: what was scanned and what it cannot see, every step that can change a real system without a gate that can stop it, the exact fix for each, and what is already gated.

Input:  { workflows: [{ path, content }], gate_actions? }
Output: { review: "exposure_review.v1", markdown, summary, help?, sign_up_url? }

Show markdown as is. It says plainly that it covers only the files passed in and is not an assessment of your organization's authorization posture. When there are gaps, or nothing was recognized, help has two optional links to a request page: one for an independent implementation advisor to explain the findings, one for help rolling the gates out. Your details are shared with an advisor only if you ask for that and consent on that page, and AtlaSent takes no fee from the advisor's work.

No API key, no network, nothing executed.

atlasent_integrity_audit

Read-only audit of the organization's Authority graph for internal inconsistency. Hosted mode only; the organization is derived server-side from the API key.

Input:  { decision_window_days? }   // 1-3650; omit to let the server choose
Output: the integrity report, verbatim

This is not a pass/fail health check, and the tool adds no verdict of its own. Each finding carries a three-way classification:

classification

How to read it

defect

A genuine inconsistency in the Authority graph.

non_exercisable

Frequently the correct, healthy state — e.g. an expired grant that is supposed to be expired. Not a failure.

unresolved

The proposition could not be verified. Never treat it as clean; "could not check" and "checked and found nothing" are different facts.

Read summary.audited_scope before concluding anything from an empty findings list — a short decision window is not an absence of findings. If the audit cannot complete, the server refuses rather than returning a partial report, and this tool surfaces that as an error rather than an empty report.

atlasent_get_permit / atlasent_check_permit / atlasent_get_decision

Read-only lookups of a single record. Hosted mode only.

atlasent_get_permit    { permit_id }                     -> the permit record (status, actor, action, times, decision_id)
atlasent_check_permit  { permit_id }                     -> { valid, status: active|revoked|consumed|expired, revoked_at? }
atlasent_get_decision  { evaluation_id, include_trace? } -> { evaluation, trace?: { approvals, permit_uses, webhooks } }

atlasent_check_permit reads status without consuming the permit. Use it before a deferred action to catch a revocation, but it is not authorization: execute only after atlasent_verify_permit. atlasent_get_decision requires the audit:read scope; a permit's decision_id is the id to pass.

Permit tools never return the permit's token (its bearer credential) or signature. Anything a tool returns lands in the agent's context and transcript, so both fields are stripped client-side as well as by the API.

The server also exposes policy, permit, approval, evidence, compliance, and VQP tools. Use MCP tools/list for the exact tool inventory supported by the installed version.

Prompts

The server also exposes MCP Prompts: templates you can pick in your host to start the authorize-before-execute flow.

Prompt

Arguments

What it asks the agent to do

gate-action

action, environment (optional)

Look up the Canon action type with atlasent_lookup_action, call evaluate, stop unless the decision is allow, call verify_permit immediately before acting, and only then act.

explain-decision

decision (the decision JSON)

Explain in plain language why an action was allowed, denied or held, and what could change the outcome, without suggesting a bypass.

find-action-type

description

Resolve a plain-language description with atlasent_lookup_action and handle confident / ambiguous / none without inventing a slug.

A prompt only guides the agent. It is not a Gate: an agent can ignore it. The action is protected only where a permit is verified immediately before it runs (see The invariant).

Approval workflow

Approval can be required, but resolving an Approval is not equivalent to executing the protected Action.

Approval / Assertion collected
  → current Authorization / reevaluation path
  → Decision
  → Permit on allow
  → Verification
  → native effect

Approvals are made by a person in the AtlaSent console, never by an agent: this server deliberately has no tool that creates or resolves an approval. When an action is held for a person, the result carries an approval_request_id; call atlasent_await_approval with it to wait while the person decides in the console. On approval it returns a permit that must still pass atlasent_verify_permit; a rejection, expiry or timeout returns no permit and the action does not run. (Remote mode only; local mode never approves.) The protected Action must still satisfy the current authorization path and execution-boundary Verification before proceeding.

Change plans and plan changes. production.deploy, infrastructure.change, production.rollback and secret.configuration.change need a change_plan ({ operation, revision?, artifact_ref? }, with a revision and/or artifact ref). Pass it to deploy_service, evaluate or atlasent_evaluate. The server first creates a Change Brief recording exactly that plan, then evaluates with the brief id and the same plan. When the key cannot create briefs (HTTP 403) or the runtime has none (HTTP 404), the server evaluates with the plan alone and adds a notes entry. Any other brief failure blocks the evaluation. On claim, the server presents the same plan again, so a mismatch means the plan really changed. If your plan changed while you waited, pass the new plan to atlasent_await_approval as change_plan. By default the server files one linked re-request for the new plan (supersedes_approval_id set to the old approval), then waits for a person to decide it. The result shows the steps in summary, for example "plan changed from X to Y → re-request sent (approval …) → waiting → approved". With on_plan_mismatch: "use_approved", the server claims the approved plan and returns it as approved_plan; run exactly that plan. A second mismatch, a revoked or suspicious approval, or an organization policy with auto_rerequest_on_mismatch: false stops the wait with no permit. The result includes the diff and what to do next.

For action classes that require a verified actor, the runtime resolves the approval to approved_awaiting_claim and mints the permit only when the claim presents the actor's identity. The server then asks the runtime for a short-lived actor_identity.v1 for its own agent (POST /v1-agent-actor-identity, available only to an API key bound to a registered agent). The action type and environment come from the approval record, and the server claims with { actor_identity }. If that identity cannot be obtained, nothing is claimed and no permit is returned. On a runtime without that endpoint (HTTP 404), the server claims with an empty body as before and adds a note to the result.

Which agent, whose agent, which chat

Every evaluate call reports which app it came from (the MCP client's name, e.g. claude-code or cursor) and which chat or session as agent_session. AtlaSent stores this labelled reported by the agent host: useful for tracing an action back to the conversation that caused it, never used to decide anything.

  • Session id: the Streamable HTTP session, else ATLASENT_SESSION_ID if your host sets it, else a per-process id prefixed mcp-process-.

  • Optional ATLASENT_RUN_ID for a run or job id.

  • With an agent API key, leave actor_id empty: AtlaSent identifies the agent and the person it acts for from the key itself, so the model never names itself.

Execution evidence

atlasent_record_execution_evaluation records an observed execution outcome after the native effect. That evidence function does not replace pre-execution Permit Verification.

Keep these statements distinct:

  • an allow Decision proves a positive authorization determination was made;

  • a verified Permit proves the bounded authorization artifact passed its Gate checks at that point in time;

  • execution/native-effect evidence is what supports a claim that the underlying action actually occurred.

Local vs remote mode

Mode

Purpose

local

Zero-config: offline in-process rules engine, unsigned permits. Development, demos, CI.

remote

Calls the configured AtlaSent hosted/runtime API.

Get an API key

  1. Create a free account at console.atlasent.io/auth/sign-up.

  2. Choose Connect an AI agent (also under Settings → API Keys). Name the agent, pick your app (Claude Code, Claude Desktop, Cursor, Windsurf, …) and the console gives you a key plus the exact command or JSON to paste.

  3. Paste it into your MCP host config. ATLASENT_API_KEY on its own switches the server to remote mode; ATLASENT_BASE_URL is optional and defaults to the hosted API.

  4. Ask your agent to try something consequential (for example, "deploy the api service to production"). The console shows the decision, and anything that needs approval waits in the approval queue until someone approves it.

Remote mode gives you what local mode cannot: Ed25519-signed, single-use permits, your organization's own policies, and a tamper-evident audit trail.

Remote example:

ATLASENT_API_KEY=ask_live_xxx \
ATLASENT_BASE_URL=https://api.atlasent.io/functions/v1 \
ATLASENT_MCP_READONLY=1 \
npx @atlasent/mcp-server

ATLASENT_BASE_URL defaults to https://api.atlasent.io/functions/v1 — this is the correct base for the core evaluate / verify_permit / atlasent_evaluate path and for other dash-form direct endpoints (/v1-evaluate, /v1-verify-permit, /v1-authority-intelligence/...). The generic REST tools (policies, permits, audit events, webhooks, SCIM, SIEM, evidence exports, approval requests) are served at the gateway/API domain root under slash-form paths (/v1/policies, /v1/permits, ...); the server automatically strips the /functions/v1 suffix for those calls, so a single ATLASENT_BASE_URL value works for both families — no separate configuration needed.

ATLASENT_FUNCTION_REGION controls where the runtime's edge functions execute. Unset, calls to the hosted runtime run in us-west-1, next to its database. A self-hosted base URL is left to Supabase's nearest-region default. Set it to a region id to pin elsewhere, or to auto to disable pinning. Execution next to the database matters: evaluate makes dozens of sequential database round trips.

Read-only mode for live demos

Set:

ATLASENT_MCP_READONLY=1

to prevent registration of mutating administrative tools during a live-API demo. Read-only mode does not turn the server into a universal security boundary; it reduces the exposed mutation surface. The protected execution path still depends on the Authorization and Verification topology described above.

Fail-closed behavior

For a path that is configured to require AtlaSent Authorization and Permit Verification, treat these as block conditions:

  • non-allow Decision;

  • missing required Permit;

  • authentication/API failure;

  • invalid, expired, revoked, replayed, or binding-mismatched Permit;

  • Verification error;

  • missing required execution binding.

Shadow/advisory evaluation is useful for observation, but it is not the same as enforced execution protection.

Claude Desktop

Add to claude_desktop_config.json. A ready-made file with remote, local, and HTTP variants is in examples/claude_desktop_config.json.

{
  "mcpServers": {
    "atlasent": {
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": {
        "ATLASENT_MODE": "remote",
        "ATLASENT_API_KEY": "ask_live_xxxxxxxxxxxxxxxx",
        "ATLASENT_BASE_URL": "https://api.atlasent.io/functions/v1",
        "ATLASENT_MCP_READONLY": "1"
      }
    }
  }
}

Claude Code

Add the server with claude mcp add. It runs over stdio. Everything after -- is the command Claude Code starts:

claude mcp add atlasent -e ATLASENT_MODE=local -- npx -y @atlasent/mcp-server

Run claude mcp list to check it connects, or /mcp inside a Claude Code session to see its tools.

Scope. --scope (-s) controls where the entry is stored:

Scope

Stored in

Use it for

local (default)

your user config, for the current project only

trying it out

project

.mcp.json at the repo root, checked in

sharing the server with everyone who works on the repo. Claude Code asks each person to approve a project server before it starts.

user

your user config, for every project

using it everywhere you run Claude Code

claude mcp add atlasent --scope project -e ATLASENT_MODE=local -- npx -y @atlasent/mcp-server

writes this .mcp.json:

{
  "mcpServers": {
    "atlasent": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": { "ATLASENT_MODE": "local" }
    }
  }
}

Don't commit an API key in a project-scope .mcp.json. For remote mode, use local or user scope.

Remote mode. Set ATLASENT_API_KEY. A key on its own switches the server to remote mode, and ATLASENT_BASE_URL defaults to https://api.atlasent.io/functions/v1. ATLASENT_MODE=remote makes the choice explicit, and ATLASENT_MODE=local forces local mode even when a key is set. See Local vs remote mode.

claude mcp add atlasent --scope user \
  -e ATLASENT_MODE=remote \
  -e ATLASENT_API_KEY=ask_live_xxxxxxxxxxxxxxxx \
  -e ATLASENT_BASE_URL=https://api.atlasent.io/functions/v1 \
  -- npx -y @atlasent/mcp-server

To switch modes, remove the entry with claude mcp remove atlasent and add it again.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global). A local-mode file you can copy as-is, no account needed: examples/cursor_mcp.json.

{
  "mcpServers": {
    "atlasent": {
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": {
        "ATLASENT_MODE": "remote",
        "ATLASENT_API_KEY": "ask_live_xxxxxxxxxxxxxxxx",
        "ATLASENT_BASE_URL": "https://api.atlasent.io/functions/v1",
        "ATLASENT_MCP_READONLY": "1"
      }
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json. A local-mode file you can copy as-is, no account needed: examples/windsurf_mcp_config.json.

{
  "mcpServers": {
    "atlasent": {
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": {
        "ATLASENT_MODE": "remote",
        "ATLASENT_API_KEY": "ask_live_xxxxxxxxxxxxxxxx",
        "ATLASENT_BASE_URL": "https://api.atlasent.io/functions/v1",
        "ATLASENT_MCP_READONLY": "1"
      }
    }
  }
}

VS Code

Add to .vscode/mcp.json in your workspace. VS Code's top-level key is servers, not mcpServers. A local-mode file you can copy as-is, no account needed: examples/vscode_mcp.json.

{
  "servers": {
    "atlasent": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@atlasent/mcp-server"],
      "env": { "ATLASENT_MODE": "local" }
    }
  }
}

For remote mode, replace the env block with the one shown in the Cursor section.

Other MCP clients

The same server can be configured in any other MCP-compatible host using its normal MCP server configuration mechanism (command: npx, args: ["-y", "@atlasent/mcp-server"], and the same env block shown above).

This server is also listed on Glama (built from this repo's Dockerfile; listing ownership in glama.json) and on the official MCP Registry (io.github.Atlasent/mcp-server, manifest at server.json), so a registry-aware host can discover and install it without a hand-written config block. npm run bundle builds an MCPB bundle of the same server for hosts that install from one. Where it is and isn't listed: docs/DISTRIBUTION.md.

Development

npm install
npm run typecheck
npm run lint      # ESLint (toolchain in tools/lint, installed on first run)
npm test          # offline: no network, no API key
npm run build
npm run demo

npm test runs entirely offline. Local-mode tests touch no network, and remote-mode tests mock fetch. It includes regression tests proving that the protected deployment demo produces no native result when either the outer agent-tool Permit or the action-specific deployment Permit fails Verification.

Prefer a ready-made environment? Open the repo in a dev container (VS Code, or GitHub Codespaces), and it installs and builds on create.

Community

Everyone taking part is expected to follow the Code of Conduct.

Security

Do not place API keys, signing material, customer secrets, or production credentials in source control. Limit authorization context to facts required by the selected policy and bindings.

Security-sensitive integrations must place the actual side effect after the required Authorization and Verification checks in control flow. Logging a Decision and then executing anyway is not enforcement.

License

Licensed under the Apache License, Version 2.0.

Available Tools

45 tools
atlasent_atlas_lookupAtlaSent — Knowledge Atlas LookupA
Read-only

Look up a canonical AtlaSent concept from the Knowledge Atlas — the compiled graph of the system's own vocabulary (Caller, Authority, Policy, Decision, Permit, Verification, Evidence, Audit Chain, Gate, Trust Root, ...). Returns the concept's canonical definition (its source-of-truth doc), its relationships (what it depends on and what depends on it), the surfaces that realize it, and its ADR / API / SDK / implementation anchors — so every AI host reasons from the same canonical knowledge instead of guessing. Use id for an exact concept id (e.g. 'permit', 'audit-chain', 'gate') or query for a case-insensitive substring search across id, term, and definition. Omit both to list every concept.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoExact concept id (e.g. 'permit', 'audit-chain', 'gate', 'trust-root').
queryNoSubstring search across id, term, and definition. Case-insensitive.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation read-only and non-destructive, and the description adds meaningful behavior: what the lookup returns, that querying is case-insensitive, and that omitting parameters lists every concept. It does not specify edge cases such as behavior when both parameters are provided or when no match is found, but it exceeds the annotation baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the action and then explains returned content and parameter modes. It is slightly verbose due to the enumerated vocabulary examples, but each sentence carries functional guidance and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by naming the categories of returned data and the two lookup modes. It is complete enough to select and invoke correctly; the only minor gaps are exact response shape and pagination/limit behavior on the list-all path.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds value beyond the schema by providing example ids, clarifying that 'query' is a substring search across id/term/definition, and documenting the omit-both default. This goes beyond the baseline without fully specifying interplay between the two parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Look up a canonical AtlaSent concept from the Knowledge Atlas.' It further distinguishes the tool by listing the returned artifact types and the exact vocabulary examples, so an agent can separate this lookup from the many sibling policy/audit/permit tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit invocation modes: use 'id' for exact matches, 'query' for a case-insensitive substring search, and omit both to list all concepts. It stops short of explicitly naming sibling alternatives or when-not-to-use conditions, so it is clear but not fully exclusionary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_check_permitAtlaSent — Check PermitA
Read-only

Check whether a permit is still usable without consuming it. Returns { valid, status } where status is active, revoked, consumed or expired. Use before a deferred action to avoid acting on a permit that was revoked meanwhile. This is a status read, not authorization: execute only after atlasent_verify_permit.

ParametersJSON Schema
NameRequiredDescriptionDefault
permit_idYesPermit id (UUID) as returned by atlasent_list_permits.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavior beyond that: the check does not consume the permit, returns a specific status object, and is purely a status read rather than an authorization decision.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences deliver the core operation, return contract, and usage guidance without unnecessary detail. The key non-consuming behavior is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with no output schema, the description fully covers what the tool returns, what status values exist, and when to call it. The agent has enough information to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully documents permit_id with 100% coverage, including its type and source from atlasent_list_permits. The description does not add parameter-specific detail, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says exactly what the tool does: check whether a permit is still usable without consuming it. It also distinguishes itself from atlasent_verify_permit by clarifying that this is a status read, not authorization.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use the tool: before a deferred action to avoid acting on a revoked permit. It also gives an important exclusion, noting this is not authorization and must be executed only after atlasent_verify_permit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_create_approval_requestAtlaSent — Create Approval RequestA

Create an approval request for a held action. The request ID is returned in the evaluate response when decision is 'hold'. Submit resolution via atlasent_resolve_approval_request. Approval is an input to Authorization; it does not itself authorize or prove execution.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe action requiring approval (e.g. 'production.deploy').
org_idYesOrganization ID that owns the policy.
contextNoContext from the original evaluate call.
subjectYesThe actor requesting the approval (e.g. 'user:alice').
resourceYesThe resource the action targets (e.g. 'env:production').
justificationNoHuman-readable justification for why the action is needed.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a non-read, non-destructive write operation, so the bar for extra disclosure is lower. The description adds meaningful context: it explains the request ID source, the resolution path, and the semantic boundary that approval does not itself authorize or prove execution. It does not detail side effects like whether duplicate requests are possible, but the core behavioral contract is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler. The core action is front-loaded, the source of the request ID is given, the resolution sibling is named, and the semantic boundary is stated. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a create tool with no output schema, the description covers the trigger condition, the required input relationship, and the follow-up action. It does not describe the response shape or whether the request ID is returned synchronously, but the description's explicit link to the evaluate response and resolver tool gives an agent enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters. The description adds the crucial relationship between the request ID and the evaluate response, but it does not add per-parameter meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Create an approval request for a held action') and immediately distinguishes it from the sibling resolver tool by naming atlasent_resolve_approval_request. It also clarifies the relationship to Authorization, which prevents confusion with the evaluate/permit siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool: when a decision is 'hold' and a request ID is returned in the evaluate response. It also names the alternative for submitting resolution and clarifies that approval is an input to Authorization, not an authorization itself. This is strong routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_create_evidence_exportAtlaSent — Create Evidence ExportA

Generate a compliance evidence bundle for audit regimes (SOC 2 Type II, HIPAA, GDPR). Enterprise plan required. Returns SHA-256 for tamper verification. Default window is the past 90 days; use date_from/date_to to narrow it.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
regimeYesCompliance regime: soc2_type_ii (SOC 2 Type II), hipaa (HIPAA), gdpr (GDPR).
date_toNoISO-8601 or YYYY-MM-DD end of the evidence window.
date_fromNoISO-8601 or YYYY-MM-DD start of the evidence window.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (readOnlyHint=false, destructiveHint=false) indicate a non-destructive mutation. The description adds behavioral details: returns SHA-256 for tamper verification and default 90-day window. However, it omits other important behaviors like synchronous/asynchronous nature, idempotency, or side effects. Given annotations, the extra context is moderate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences with no wasted words. The first sentence states the purpose and key output, the second explains the default window and parameter usage. It is front-loaded with the most critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no output schema, and annotations present, the description covers the core use case, constraints, and behavior. It mentions the SHA-256 return. However, it does not describe the full response structure or error cases. For a creation tool, this is largely sufficient but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by explaining the default window (past 90 days) and how to narrow it using date_from/date_to, which is not in the schema. It also mentions the enterprise plan requirement implicitly linking to org_id. This goes beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: generating a compliance evidence bundle for specific audit regimes. It uses a specific verb ('Generate') and resource ('compliance evidence bundle'), and distinguishes itself from siblings like 'get_evidence_export' (retrieve) and 'list_evidence_exports' (list).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions a prerequisite ('Enterprise plan required') and provides guidance on default window and narrowing with parameters. However, it does not explicitly state when not to use or compare to alternatives, but the context is clear enough for selection vs sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_create_policyAtlaSent — Create PolicyA

Create a new constraint bundle for an action. The bundle starts in 'draft' status — call update_policy to publish it.

ParametersJSON Schema
NameRequiredDescriptionDefault
rulesYesOrdered list of rules — first match wins.
titleYesHuman-readable policy title.
org_idYesOrganization ID that will own the policy.
actionsNoAction-specific configuration.
versionNoSemantic version string (e.g. '1.0.0').
priorityNoEvaluation priority (lower number = higher priority).
policy_idYesClient-assigned unique ID for this policy bundle (e.g. 'production-change').
applies_toNoScope selector controlling which requests this policy applies to.
expires_atNoISO-8601 timestamp when the policy expires.
descriptionNoOptional human-readable description.
policy_typeYesPolicy type (e.g. 'access_control', 'approval_gate').
effective_atNoISO-8601 timestamp when the policy becomes effective.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only mark the tool as non-read-only and non-destructive; the description adds real behavior: a newly created policy is not immediately active — it is in draft and requires a later update_policy call to become published. This materially changes how an agent should reason about the effects of calling create.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The core action and the lifecycle caveat are both front-loaded, and the second sentence earns its place by naming the follow-up tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the helpful lifecycle note, this is a 12-parameter creation tool with nested, loosely specified objects (rules, actions, applies_to) and no output schema. The description doesn't explain response behavior, duplicate-handling, or the structure expected inside the nested objects, so an agent is left to infer those from sparse schema entries.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 12 parameters already have individual descriptions in the input schema, so the dimension baseline is 3. The tool description adds no parameter-level meaning beyond that; the schema carries the burden successfully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Create') and resource ('constraint bundle') and immediately orients the agent to the policy lifecycle by noting the new bundle starts in 'draft' status. It also distinguishes this creation tool from the sibling update_policy, since publishing is explicitly assigned to that tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives the main routing signal: use this tool to create a new bundle, and call update_policy to publish it. It doesn't enumerate all siblings (list/get/delete), but for a create operation the create-vs-update distinction is the critical one and is explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_create_scim_userAtlaSent — Create SCIM UserA

Provision a new user via SCIM 2.0. Adds the user to the AtlaSent directory and makes them available for policy evaluation.

ParametersJSON Schema
NameRequiredDescriptionDefault
activeNoWhether the account is active (default true).
emailsNoEmail addresses.
groupsNoGroup IDs to assign the user to.
org_idYesOrganization ID.
userNameYesSCIM userName — typically the user's email address.
externalIdNoExternal IdP identifier for correlation.
displayNameNoHuman-readable display name.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate non-read-only and non-destructive. The description adds that the user becomes available for policy evaluation, but no additional behavioral traits like idempotency or error handling are disclosed. Minimal added value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and no wasteful content. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

As a creation tool with 7 parameters and no output schema, the description does not explain what the tool returns. However, it covers the essential purpose and implications (availability for policy evaluation). Minor gap in return value context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter having a description. The description does not add extra meaning beyond what the schema already provides, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it provisions a new SCIM user and adds to the directory for policy evaluation. The verb 'Provision' and resource 'SCIM user' are specific, and it distinguishes from sibling tools like delete, patch, and get.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not specify when to use this tool versus alternatives, nor does it mention prerequisites like an existing org. Usage is implied but not explicitly guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_create_webhookAtlaSent — Create WebhookA

Register a webhook URL to receive evaluation events.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe HTTPS URL to deliver events to.
eventsYesEvent types to subscribe to (e.g. ['evaluation.deny', 'permit.issued']).
org_idYesOrganization ID to register the webhook for.
secretNoSigning secret for HMAC verification of payloads.
descriptionNoOptional human-readable description of this webhook.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate it's a mutable (readOnlyHint=false) but non-destructive operation. The description merely says 'register', which aligns but adds no extra behavioral details such as idempotency, side effects, or requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence. No wasted words, and it conveys the core purpose directly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool with 5 parameters and no output schema, the description lacks critical context about return values, activation behavior, or verification steps. It is minimally adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 5 parameters have full schema descriptions (100% coverage). The tool description adds no additional meaning beyond what is already in the schema, so baseline score applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (register), the resource (webhook URL), and the purpose (to receive evaluation events). It distinguishes well from sibling tools like delete_webhook or list_audit_events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives, nor any prerequisites or conditions. The description is too terse to help an agent decide contextually.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_delete_policyAtlaSent — Delete PolicyA
Destructive

Permanently delete a constraint bundle. Prefer archiving over deleting.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the policy.
policy_idYesID of the bundle to delete.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds value beyond the annotations by stating 'Permanently delete' and 'Prefer archiving', which warns of irreversibility and suggests caution. Annotations already have destructiveHint=true, so the description reinforces this. No behavioral contradictions. Some missing details (e.g., what happens if dependencies exist) but acceptable for the destructiveHint flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long with no wasted words. The first sentence immediately states the action, and the second provides a usage preference. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity (2 required parameters, no output schema) and annotations covering destructive behavior, the description is nearly complete. It could mention auth requirements or the irreversible nature more explicitly, but the 'permanently delete' phrase covers that. Lacks details on success/error responses, but no output schema exists to justify that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both org_id and policy_id already described in the input schema. The description adds no additional parameter details. Baseline score of 3 is appropriate since the schema itself is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Permanently delete a constraint bundle' uses a specific verb+resource, clearly stating the action and object. It distinguishes from sibling deletion tools like atlasent_delete_scim_user and atlasent_delete_webhook by specifying 'constraint bundle'. The additional note 'Prefer archiving over deleting' adds further clarity on the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends archiving over deleting, providing implicit guidance on when not to use this tool. However, it does not directly mention specific alternatives (e.g., atlasent_update_policy) or detailed context for when deletion is appropriate beyond permanence. This is good but could be more explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_delete_scim_userAtlaSent — Delete SCIM UserA
Destructive

Deprovision a SCIM user. Removes them from the AtlaSent directory. This is irreversible — prefer disabling (patch active=false) over deleting.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
user_idYesSCIM user ID to deprovision.

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already set destructiveHint=true, so the description's 'irreversible' adds minimal extra. No additional behavioral details (e.g., permissions required) are provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences are concise and front-loaded with the core action. No extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema and annotations covering destructiveness, the description is complete enough. It includes irreversibility warning and usage alternative.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both parameters. The description adds no extra meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title and description clearly state the action 'Delete SCIM User' and resource 'AtlaSent directory'. It distinguishes from sibling tools like atlasent_patch_scim_user which disables instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises preferring disable over delete, mentioning the alternative 'patch active=false'. This helps the agent choose the correct action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_delete_webhookAtlaSent — Delete WebhookB
Destructive

Remove a registered webhook.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the webhook.
webhook_idYesID of the webhook to delete.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already set destructiveHint to true, so the agent knows this is destructive. The description adds 'Remove' which aligns. No additional behavioral traits (e.g., cascading effects, reversibility) are disclosed. With annotations covering the main safety concern, a 3 is reasonable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence 'Remove a registered webhook.' is highly concise and front-loaded. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple deletion by ID, the description is adequate but minimal. No output schema exists, and no context about effects or confirmation is provided. Given the tool's simplicity, it meets the minimum viable level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are fully documented in the schema. The description does not add any extra meaning beyond the schema's property descriptions. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Remove a registered webhook.' which clearly identifies the action (remove) and resource (webhook). However, it does not distinguish from sibling tools like 'atlasent_create_webhook' or 'atlasent_delete_policy', so a 4 is appropriate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. With siblings like 'atlasent_create_webhook' and other delete tools, the description does not specify when deletion is appropriate or mention prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_evaluateAtlaSent — Evaluate (Remote API)A

Evaluate an action against your published AtlaSent policies. Returns allow/deny/hold/escalate with a permitToken on allow. Use this when ATLASENT_MODE=remote and you need to gate an action against your hosted policy engine.

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoKey-value context matched against constraint rules (include target/resource info here).
explainNoWhen true, populates risk_envelope.factors with a per-factor score breakdown
actor_idYesThe actor performing the action (e.g. 'user:alice', 'service:deploy-bot').
target_idNoTarget resource the permit is bound to (e.g. service name, artifact id, tool-call target). Presenting a different target at verify yields a binding mismatch.
action_typeYesCanon-backed Action Type (for example 'production.deploy' or 'agent.tool.invoke').
execution_payload_hashNoHash of the exact executed payload (tool-call arguments / artifact digest). Bind it at evaluate via execution_payload_hash; presenting a different hash at verify yields PAYLOAD_MISMATCH.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the decision values and permitToken, which is important because there is no output schema. However, beyond the basic annotations it does not reveal side effects (e.g., whether an audit record is created), expiration or verification expectations, or behavior for hold/escalate beyond the enum-like return.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences lead with the core action and return type, then give the mode condition. No wasted words and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-output-schema tool with six parameters and many siblings, the description covers the essential outcome and the primary selection condition. It does not explain how permitToken should be used afterward or expand on hold/escalate semantics, but the rich schema descriptions compensate for most gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the prose description adds no parameter-level meaning beyond what the schema already provides. The schema itself supplies useful semantics such as the context object and binding behavior of target_id and execution_payload_hash, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Evaluate an action against your published AtlaSent policies') and names the output (allow/deny/hold/escalate with a permitToken). It distinguishes remote mode from any local evaluation path, though it does not explicitly name sibling tools like atlasent_evaluate_many or evaluate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit condition ('Use this when ATLASENT_MODE=remote') and the intended purpose (gate an action against the hosted policy engine). It does not state when to prefer alternatives such as atlasent_evaluate_many or atlasent_verify_permit, so exclusions are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_evaluate_manyAtlaSent — Evaluate Many (batch)A

Evaluate up to 100 actions in a single request against your published AtlaSent policies. Returns decisions in input order. Optional batch_id (UUID) provides idempotency. Closed-by-default: 404 surfaces as a feature_not_enabled error tagged with the v2_batch tenant flag.

ParametersJSON Schema
NameRequiredDescriptionDefault
itemsYesItems to evaluate (1-100). Decisions returned in input order.
batch_idNoOptional UUID for idempotency.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=false), description adds that results are returned in input order, batch_id provides idempotency, and closed-by-default errors are tagged with feature_not_enabled. This gives useful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, no wasted words. Purpose is front-loaded, then returns order, idempotency, and error behavior are efficiently stated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so description should ideally explain return format. It says 'returns decisions in input order' but lacks details on decision structure, batch status, or potential errors. Adequate for basic understanding but incomplete for complex use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but description adds value by clarifying the items array returns decisions in input order and batch_id provides idempotency, which is not evident from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it evaluates up to 100 actions against AtlaSent policies, returning decisions in input order. The verb 'evaluate' and resource 'many actions' are specific, and it implicitly differentiates from siblings like atlasent_evaluate (singular) and atlasent_evaluate_stream (streaming).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies batch usage by stating 'up to 100 actions' and 'single request', but does not explicitly say when to use this vs. atlasent_evaluate or atlasent_evaluate_stream. No when-not or alternatives given, leaving the agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_evaluate_streamAtlaSent — Evaluate (streamed, buffered)A

Evaluate up to 100 actions via the streaming endpoint. The tool buffers the SSE stream and returns the complete result set (same shape as atlasent_evaluate_many). Per-item RPC failures surface in the items array with { error }; the stream continues. Closed-by-default: 404 surfaces as a feature_not_enabled error tagged with the v2_streaming tenant flag.

ParametersJSON Schema
NameRequiredDescriptionDefault
itemsYesItems to evaluate (1-100). Decisions returned in input order.
batch_idNoOptional UUID for idempotency.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description adds valuable behavioral context: per-item RPC failures return {error} and stream continues, and closed-by-default 404 surfaces as feature_not_enabled error. Annotations are minimal, so description carries the burden well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences: purpose, error handling, special case. No wasted words, front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers key aspects (max items, error handling, special 404 error) and references sibling's return shape. Missing explicit return schema is offset by 'same shape' reference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions. The description adds no further parameter details beyond 'same shape as atlasent_evaluate_many', which is implicit for the items array.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool evaluates up to 100 actions via streaming, distinguishing itself from synchronous evaluate variants with 'streaming endpoint' and 'same shape as atlasent_evaluate_many'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this streaming version versus atlasent_evaluate or atlasent_evaluate_many. The 100-item cap is mentioned but not as a decision criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_explain_authorityAtlaSent — Explain AuthorityA
Read-only

Explain why a principal currently has (or lacks) authority for a scope. Answers 'why may principal P exercise scope/action A in organization O right now?' — strictly read-only, does not change /v1-evaluate, /v1-verify-permit, or any deny/hold/allow semantics; it explains the same facts those paths already read. Every matched authority mechanism (direct_grant, delegation, role_capability) is reported as its own path entry; every excluded or ambiguous relationship is reported as its own unresolved finding.

ParametersJSON Schema
NameRequiredDescriptionDefault
resource_idNoOptional resource ID to scope the explanation to.
principal_idYesThe principal (UUID) whose authority is being explained.
requested_scopeYesThe <environment>:<action> authority scope being explained (the same wire format /v1-evaluate's authority_scope and enterprise_permissions.permission already use), or a bare resource:action capability string.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description compounds this by explicitly stating it 'does not change /v1-evaluate, /v1-verify-permit, or any deny/hold/allow semantics.' It also discloses output structure: matched mechanisms are reported as path entries, excluded/ambiguous relationships as unresolved findings. This is rich behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences deliver the core purpose, read-only guarantee, relationship to sibling paths, and output behavior with no filler. The most important information is front-loaded in the first sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only explanation tool with no output schema, the description covers the key aspects an agent needs: what question it answers, that it is non-mutating, and what kind of findings it returns. It does not describe exact response fields or error behavior, but the absence is minor given the tool's explanatory nature and the strong sibling differentiation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters and even includes wire-format guidance for requested_scope. The tool description itself adds no parameter-level meaning, which matches the baseline of 3 for fully covered schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('explain'), a specific resource ('authority for a scope'), and the exact question being answered. It also enumerates authority mechanisms (direct_grant, delegation, role_capability), making it clearly distinguishable from sibling evaluation/verification tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states that the tool is strictly read-only and that it 'explains the same facts those paths already read,' referencing /v1-evaluate and /v1-verify-permit. This gives clear context about its relationship to evaluation/verification tools, though it does not explicitly say 'use this instead of X when...'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_decisionAtlaSent — Get DecisionA
Read-only

Fetch one authorization decision (execution evaluation) by id: the decision, deny code, actor, action, context and evidence fields. Set include_trace to also return its approval events, permit uses and webhook deliveries. Requires audit:read.

ParametersJSON Schema
NameRequiredDescriptionDefault
evaluation_idYesExecution evaluation id (UUID), e.g. a permit's decision_id.
include_traceNoAlso return approval events, permit uses and webhook deliveries.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and destructiveHint, so the safety profile is known. The description adds useful behavioral context: which fields are returned, what include_trace adds, and the required audit:read permission.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler. The core purpose is front-loaded, the optional flag behavior is stated briefly, and the auth requirement is included without wasting words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only get-by-id tool with only two simple parameters, the description covers what is needed to call it correctly: the resource, the lookup key, the optional expansion behavior, and the permission requirement. No output schema exists, but the returned fields are enumerated sufficiently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents evaluation_id as a UUID and include_trace's effect. The description mostly restates this information without adding new parameter-level detail, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Fetch one authorization decision (execution evaluation) by id'. It also lists the exact fields returned, making the tool's purpose unambiguous and easily distinguishable from sibling list/evaluate/check tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes it clear this is the get-by-id tool for a single decision and explains the optional include_trace behavior. It does not explicitly name alternatives or exclusions, but the usage context is clear enough for an agent to choose it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_evidence_exportAtlaSent — Get Evidence ExportA
Read-only

Retrieve a specific compliance evidence bundle by ID. Includes status, SHA-256 hash for tamper verification, and download URL when complete.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
export_idYesEvidence export ID from list_evidence_exports or create_evidence_export.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. Description adds behavioral details: response includes status, SHA-256 hash, and download URL when complete. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with key action, no unnecessary words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but description adequately specifies return fields (status, hash, URL) and condition ('when complete'). Lacks error scenarios but sufficient for a simple retrieval tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with parameter descriptions. Description only adds marginal context ('by ID') but does not significantly enhance understanding beyond schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'Retrieve a specific compliance evidence bundle by ID' with verb+resource clarity. Differentiates from sibling tools like 'list_evidence_exports' and 'create_evidence_export'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is clear: use when you have an export ID. Does not explicitly state when not to use or provide alternative comparisons, but context signals and tool name make it obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_permitAtlaSent — Get PermitA
Read-only

Fetch one permit's record: status, actor, action, environment, issue/expiry/consume times and the decision that issued it. Never returns the permit token itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
permit_idYesPermit id (UUID) as returned by atlasent_list_permits.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds genuine value beyond that: it discloses the exact return contents and, critically, the negative guarantee that the permit token is never returned — a non-obvious behavioral limitation an agent would not otherwise know. This is strong added context for a tool with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The primary action and return contents are front-loaded, and the critical token caveat is placed in a short second sentence. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only tool with full schema coverage and a safety profile in annotations, the description covers the essential ground: what is retrieved and a key limitation. The return field list compensates for the missing output schema. Minor gaps remain — error behavior for a nonexistent permit_id and explicit sibling routing — but nothing blocks correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the permit_id parameter is fully documented in the schema as a UUID returned by atlasent_list_permits. The description itself adds no parameter-level meaning beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ('Fetch') with a precise resource ('one permit's record') and enumerates the exact fields returned (status, actor, action, environment, issue/expiry/consume times, decision). The 'one permit's record' phrasing cleanly separates it from atlasent_list_permits, and the final clause distinguishes it from token-returning tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied: 'one permit's record' signals this is for single-record retrieval rather than listing, and 'Never returns the permit token itself' hints that token-seeking callers should look elsewhere. However, no alternative tool is named, and it doesn't explicitly state when to use this over atlasent_check_permit, atlasent_verify_permit, or atlasent_get_decision, leaving routing partially to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_policyAtlaSent — Get PolicyA
Read-only

Retrieve a single constraint bundle / policy by ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the policy.
policy_idYesThe bundle ID returned by list_policies or create_policy.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. Description adds no additional behavioral context (e.g., authentication, rate limits, idempotency). Adequate but not additive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence of 9 words, no unnecessary information. Extremely concise and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple retrieval tool with two well-documented parameters and annotations present, the description is sufficient. It could mention the return value, but not required as there is no output schema. Nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with both parameters having clear descriptions. The tool description adds no further parameter semantics. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'retrieve', the resource 'constraint bundle / policy', and the method 'by ID'. It distinguishes from sibling tools like atlasent_list_policies, which lists multiple policies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Usage is implied (retrieve a single policy by ID), but no exclusion criteria or context provided. Siblings like atlasent_list_policies and atlasent_create_policy exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_scim_userAtlaSent — Get SCIM UserA
Read-only

Retrieve a single provisioned SCIM user by ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
user_idYesSCIM user ID returned by list_scim_users or create_scim_user.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the description's 'retrieve' aligns. No additional behavioral traits (e.g., authentication, rate limits) are disclosed beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, zero waste, front-loaded with the key action and resource. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read operation with only two parameters and clear annotations, the description is complete and sufficient. No missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters. The description does not add any meaning beyond the schema, so baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('retrieve') and resource ('provisioned SCIM user') with a clear method ('by ID'), clearly distinguishing it from sibling tools like list_scim_users or create_scim_user.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as list_scim_users. The description only states the retrieval method (by ID) but does not explain prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_get_siem_configAtlaSent — Get SIEM ConfigA
Read-only

Retrieve the SIEM export configuration for an organization. Enterprise plan required. The credential field is never returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint: true and destructiveHint: false. The description adds behavioral context: the enterprise plan requirement and that the credential field is never returned, which is beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, no redundant words. The purpose is front-loaded in the first sentence, making it immediately clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read operation with one parameter and no output schema, the description covers the core purpose and two important caveats. It could mention that the response is the config object, but this is not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for org_id, with a brief description 'Organization ID.' The description adds no further semantic detail, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve the SIEM export configuration for an organization,' using a specific verb and resource. It distinguishes from siblings like atlasent_upsert_siem_config and atlasent_test_siem_delivery, which handle create/update and testing respectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions 'Enterprise plan required,' providing a clear prerequisite. It does not explicitly state when to use vs. alternatives, but the sibling list and name imply this is for reading. The credential warning also guides expectations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_integrity_auditAtlaSent — Authority Graph Integrity AuditA
Read-only

Audit the organization's authority graph for internal inconsistency and return the report verbatim. Strictly read-only; changes no policy, permit, or decision. THIS IS NOT A PASS/FAIL HEALTH CHECK and the tool synthesizes no verdict of its own. Each finding carries a three-way classification: defect is a genuine inconsistency; non_exercisable is frequently the CORRECT, healthy state (e.g. an expired grant that is supposed to be expired) and must not be read as a failure; unresolved means the proposition COULD NOT BE VERIFIED and must never be treated as clean. Read summary.audited_scope before drawing any conclusion from an empty findings list — a short decision window is not an absence of findings. If the audit cannot complete, the server refuses rather than returning a partial report, and this tool surfaces that as an error — never an empty report.

ParametersJSON Schema
NameRequiredDescriptionDefault
decision_window_daysNoOptional. How far back the decision/permit scan reaches, in days (1-3650). Omit to let the server apply its own window, which it echoes back in summary.audited_scope. There is no client-side default.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description adds crucial behavioral details: strict read-only behavior, three-way classification semantics, the meaning of 'unresolved', the need to check summary.audited_scope before interpreting empty findings, and server refusal on incomplete audits. This substantially exceeds what annotations alone convey and prevents dangerous misinterpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence earns its place by preventing a serious misreading: no pass/fail, classification meanings, empty-findings caveat, and partial-report refusal. It is front-loaded with the core purpose and read-only guarantee, then layers essential semantic warnings. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the full burden of explaining result interpretation, and it does so thoroughly: classifications, audited_scope caveat, empty-report behavior, and error semantics. For a one-optional-parameter read-only tool with this complexity, nothing an agent needs to call and interpret it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage and already thoroughly documents decision_window_days, including its optionality, range, omission behavior, and echo in summary.audited_scope. The main description adds no parameter-level information beyond what the schema provides, so the baseline 3 for high schema coverage applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Audit the organization's authority graph for internal inconsistency and return the report verbatim.' It clearly distinguishes the tool from a health check or verdict-producing tool, which separates it from siblings like atlasent_vqp_drift_events or evaluate. The scope and output mode are unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when this tool is appropriate: auditing for internal inconsistency, read-only, no pass/fail verdict. It explains what the tool is not ('THIS IS NOT A PASS/FAIL HEALTH CHECK') but does not explicitly name alternative tools or conditions for choosing them over this audit. This is clear context with a notable exclusion, but not full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_audit_eventsAtlaSent — List Audit EventsB
Read-only

Retrieve recent evaluation events from the audit log.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO-8601 end timestamp for the query window.
fromNoISO-8601 start timestamp for the query window.
limitNoMax number of events to return (default 20, max 100).
org_idYesOrganization ID to fetch audit events for.
evaluation_idNoFilter to events for a specific evaluation ID.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true. The description adds 'recent' but this is vague and potentially misleading since the to/from parameters allow arbitrary time windows. No mention of ordering, pagination behavior (beyond limit), or what happens when the window is empty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no redundancy. However, it could be front-loaded with key differentiators (e.g., 'audit log' specificity) and still remain concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description should compensate by explaining return structure or field examples. It does not. Also lacks information on event ordering, time zone handling, or filtering effects. For a tool with 5 parameters and many siblings, this is insufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameter descriptions exist and are clear (ISO-8601, limit range, required org_id). The description adds no additional parameter context; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Retrieve') and the resource ('evaluation events from the audit log'). This is distinct from sibling list tools like list_evidence_exports or list_policies, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., list_evidence_exports for different event types). The description does not mention context, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_evidence_exportsAtlaSent — List Evidence ExportsA
Read-only

List compliance evidence bundles for an organization. Enterprise plan required. Each record includes status and SHA-256 hash.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
regimeNoFilter by compliance regime.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint and non-destructive. The description adds that each record includes status and SHA-256 hash, and the enterprise plan requirement, but does not disclose additional behavioral traits such as pagination or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise sentences with the purpose front-loaded. No redundant information is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, plan requirement, and return record fields. Missing details like pagination or default filter are minor given the tool's simplicity and existing annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for both parameters (org_id, regime). The description does not add new meaning beyond the schema, maintaining the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'list' and identifies the resource as 'compliance evidence bundles' for an organization. It clearly differentiates from sibling tools like 'atlasent_create_evidence_export' and 'atlasent_get_evidence_export'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states 'Enterprise plan required' as a prerequisite but does not explicitly guide when to use this tool versus alternatives like 'get_evidence_export'. Usage is implied from the verb but lacks explicit when-not or alternative references.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_permitsAtlaSent — List PermitsA
Read-only

List issued permit tokens for audit and monitoring.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO-8601 end timestamp filter.
fromNoISO-8601 start timestamp filter.
limitNoMax number of permits to return (default 20).
cursorNoPagination cursor from a previous response.
org_idYesOrganization ID to list permits for.
statusNoFilter by permit status.
actor_idNoFilter to permits issued for this actor.
action_typeNoFilter to permits for this action type.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds no new behavioral traits beyond stating the listing purpose, which is consistent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no wasted words. Efficiently communicates the tool's core function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of pagination parameters (cursor, limit) and filters, the description is minimal but adequate. It does not mention pagination behavior or output format, but these are not strictly required given the schema richness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description does not add additional meaning beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists issued permit tokens, with a specific use case (audit and monitoring). This distinguishes it from sibling tools that create, revoke, or verify permits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies usage for audit/monitoring but does not explicitly state when not to use or provide alternatives among sibling tools like atlasent_revoke_permit or atlasent_verify_permit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_policiesAtlaSent — List PoliciesA
Read-only

List all constraint bundles / policies for this organization.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID to list policies for.
statusNoFilter by status (e.g. 'draft', 'published', 'archived').

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds that it lists 'all' policies for the organization, but does not elaborate on pagination, ordering, or other behavioral traits. Minimal additional context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states the action and scope. No wasted words; front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with two parameters and no output schema, the description is nearly complete. It could optionally mention pagination or ordering, but these are not critical for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both parameters (org_id and status). The description does not add extra meaning beyond what the schema already provides, so baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'List' and resource 'constraint bundles / policies', scoped to 'this organization'. It clearly distinguishes from siblings like 'atlasent_get_policy' (singular) and 'atlasent_list_evidence_exports'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is provided. The usage is implied by the tool's name and context, but no alternatives or exclusion criteria are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_scim_groupsAtlaSent — List SCIM GroupsB
Read-only

List provisioned groups via SCIM 2.0 for an organization.

ParametersJSON Schema
NameRequiredDescriptionDefault
countNoMax results per page.
filterNoSCIM filter expression (e.g. 'displayName eq "engineers"').
org_idYesOrganization ID.
startIndexNo1-based result offset.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and destructiveHint=false, so the description adds little behavioral context. It mentions SCIM 2.0 protocol and organization scope, which is useful but minimal. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, concise and front-loaded with the key action. However, it could be slightly more informative without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description could mention return values (e.g., list of group objects) or pagination behavior. The schema covers parameters, but the description is minimal for a list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with descriptions. The description does not add further semantic detail beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists provisioned groups via SCIM 2.0 for an organization. It specifies the protocol (SCIM 2.0) and scope (organization), but does not explicitly differentiate from sibling tools like atlasent_list_scim_users beyond the resource name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The name and resource type imply distinction, but the description lacks direct context for selection, e.g., when to use list_scim_groups vs list_scim_users.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_list_scim_usersAtlaSent — List SCIM UsersA
Read-only

List provisioned users via SCIM 2.0 (RFC 7643) for an organization. Supports filter expressions (e.g. 'userName eq "alice"') and startIndex/count pagination.

ParametersJSON Schema
NameRequiredDescriptionDefault
countNoMax results per page (default 20, max 200).
filterNoSCIM filter expression (e.g. 'userName eq "alice"').
org_idYesOrganization ID.
startIndexNo1-based result offset for pagination (default 1).

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds valuable behavioral context: compliance with SCIM 2.0, support for filter expressions and pagination (startIndex/count). No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that front-load the core purpose and add essential details. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, standard, and parameters well. However, it does not mention the return format (e.g., list of user objects in SCIM format). Given no output schema, describing the response structure would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 4 parameters are well-described in the schema (100% coverage). The description adds value by providing examples of SCIM filter syntax and mentioning pagination behavior, enhancing understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists SCIM users for an organization, referencing the SCIM 2.0 standard and RFC 7643. It distinguishes from sibling tools like get_scim_user (single user), create/delete/patch, and list_scim_groups by specifying it's for listing provisioned users with filtering and pagination.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool (listing provisioned users) and hints at syntax (filters, pagination). However, it does not explicitly mention when not to use it or alternatives like get_scim_user for single user retrieval.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_lookup_actionLookup Canonical Action SpecA
Read-only

Look up canonical action specifications from the Authorization Intelligence Library. Returns the permanent canon_id, gate flags (requires_human_approval, requires_mfa, requires_verified_actor, requires_state_snapshot), authorization pattern, risk posture, AI risk classification, regulatory mappings, evidence requirements, and the action's knowledge-graph relationships (what it requires and produces, and which frameworks / control objectives it satisfies) for every governed action type in the Canon. Use slug for an exact match (e.g. 'production.deploy') or query to describe what you want to do in plain language (e.g. 'deploy the api service to prod', 'grant admin access', 'close the books'). query is ranked offline against the vendored Canon and returns a retrieval block with confidence = confident | ambiguous | none — act only on confident; the tool never invents an action type, and a none result means the Canon has no such action (see the hint). Omit both to list the full Canon.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoExact canonical action slug (e.g. 'production.deploy', 'access.grant').
queryNoPlain-language description of the action to find. Ranked deterministically (offline, no network) over slug, display name, family, description and a curated alias vocabulary.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: it discloses that query ranking is performed offline, that it returns a retrieval block with confidence levels (confident/ambiguous/none), and that the tool never invents action types. This goes beyond the annotations and helps the agent understand edge cases. It doesn't fully detail the return format but provides sufficient context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized, front-loading the purpose and then systematically covering parameters, confidence handling, and the full-canon listing. Every sentence contributes new information without redundancy. While it is long, the length is justified given the tool's complexity and the absence of an output schema. It could be slightly more concise, but it earns a 4.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a lookup tool with no output schema and two optional parameters, the description is remarkably complete. It enumerates all the returned fields (canon_id, gate flags, authorization pattern, risk posture, AI risk classification, regulatory mappings, evidence requirements, knowledge-graph relationships), explains the retrieval confidence mechanism, and covers the edge case of 'none' results. An agent has everything needed to decide when to call and what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100% (both parameters have descriptions), the tool description adds substantial meaning beyond the schema. It explains the difference between slug (exact match) and query (plain-language, ranked deterministically), provides concrete examples for each, and describes the behavior of query ranking (offline, over slug, display name, family, etc.). This significantly enhances the agent's ability to use the parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool looks up canonical action specifications from the Authorization Intelligence Library, and enumerates the specific fields returned (canon_id, gate flags, authorization pattern, risk posture, etc.). This is a specific verb-resource combination that clearly distinguishes it from sibling tools like atlasent_list_policies (which manage policies) or atlasent_explain_authority (which explains authority). The purpose is unambiguous and detailed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage guidance on how to invoke the tool: use 'slug' for exact match, 'query' for plain-language description, or omit both to list the full Canon. It also instructs the agent to act only on 'confident' retrieval confidence and explains the meaning of 'none' results. However, it does not explicitly name alternative tools or state when NOT to use this tool versus siblings, though the purpose clarity makes that largely implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_patch_scim_userAtlaSent — Patch SCIM UserA

Update a provisioned user using RFC 7644 SCIM PatchOp operations. Each operation has op (add/remove/replace), an optional path, and a value.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.
user_idYesSCIM user ID to update.
operationsYesPatchOp operations per RFC 7644 §3.5.2 (e.g. { op: 'replace', path: 'active', value: false }).

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and destructiveHint=false, indicating a non-destructive mutation. The description adds that it uses SCIM PatchOp but does not disclose additional behavioral traits such as idempotency, rate limits, or error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences. It front-loads the core purpose and briefly explains operation format with no extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core functionality but lacks context about return values, permissions, or error cases. For a mutation tool with no output schema, more details would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents parameters. The description summarizes the operation structure but does not add new semantics beyond what is in the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates a provisioned user using SCIM PatchOp operations, specifying the verb 'update', resource 'user', and protocol. It is distinct from sibling tools like create_scim_user and delete_scim_user.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for partial updates via PatchOp but provides no explicit guidance on when to use this tool vs alternatives (e.g., create, delete). It lacks context like prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_permitAtlaSent — Issue PermitA

Manually issue a permit token for an action. Use for pre-authorized operations where a full evaluate call is not practical.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe action being permitted (e.g. 'production.deploy').
org_idYesOrganization ID that owns the policy.
contextNoOptional context to bind to the permit.
subjectYesThe actor the permit is issued for (e.g. 'user:alice').
resourceYesThe resource the permit applies to (e.g. 'env:prod').
ttl_secondsNoHow long the permit is valid in seconds (default 300, max 86400).

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate non-read-only and non-destructive. Description adds no behavioral context beyond 'issue a permit token' – no mention of permissions, side effects, or limits. With annotations present, description carries minimal extra value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose. No wasted words. Efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters (4 required), nested objects, no output schema, and sibling tools like verify/revoke permit, the description is adequate but minimal. It explains the high-level purpose but lacks workflow context or return value expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 6 parameters. Description does not elaborate on parameters beyond the schema, so baseline score of 3 applies. No additional semantic value from description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'issue a permit token for an action' with specific verb and resource. It distinguishes from evaluate siblings by mentioning 'pre-authorized operations where a full evaluate call is not practical.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use for pre-authorized operations instead of evaluate, providing clear context. Lacks explicit when-not-to-use or alternatives beyond evaluate, but the guidance is sufficient for typical scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_queryAtlaSent — GraphQL Query (read-only)A
Read-only

Run a read-only GraphQL query against the AtlaSent V2 GraphQL endpoint. Wave A schema: recentEvaluations(limit), activeBundle. Body limit 1MB, depth limit 8, one operation per request (enforced server-side). Closed-by-default: 404 surfaces as a feature_not_enabled error tagged with the v2_graphql tenant flag.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesGraphQL query string. The Wave A schema is read-only.
variablesNoOptional GraphQL variables object.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, etc. The description adds behavioral details beyond annotations: body limit 1MB, depth limit 8, single operation enforced server-side, and error behavior for 404. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, with three sentences that are front-loaded: purpose, technical limits, and error behavior. Every sentence adds essential information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only GraphQL query tool with no output schema, the description covers purpose, schema fields, limits, and error behavior. Missing details like authentication or rate limiting are partially addressed by annotations (openWorldHint). Adequately complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the input schema already documents the query and variables parameters. The description provides context about the endpoint and available schema fields (recentEvaluations, activeBundle) but does not add parameter-specific semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a read-only GraphQL query against the AtlaSent V2 endpoint, specifying the schema and distinguishing it from sibling tools that handle mutations or other data retrieval methods. The title reinforces 'read-only'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for read-only GraphQL queries and warns about the 'closed-by-default' feature availability error, but does not explicitly state when to avoid this tool or mention specific alternatives among the extensive sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_record_execution_evaluationAtlaSent — Record Execution EvaluationA

Record the outcome of an execution that was permitted by a prior evaluate call. Closes the evidence loop with the observed execution result; it does not replace pre-execution Permit Verification.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the evaluation.
detailsNoOptional details about what was executed and the result.
outcomeYesThe actual outcome of the execution.
executed_atNoISO-8601 timestamp when the execution completed.
evaluation_idYesThe evaluation_id from the prior evaluate call.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already show readOnlyHint=false and destructiveHint=false, so the write-but-not-destructive nature is established. The description adds useful workflow context: it records the observed outcome and is explicitly not a pre-execution verification step. It does not discuss idempotency or failure behavior, but that is less critical given the clear workflow framing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The action and its relationship to the prior evaluate call are front-loaded, and the exclusion is stated succinctly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with no output schema, the description explains the purpose, timing, required prior step, and key exclusion. Minor omissions include naming the exact alternative verification tool and stating return/side-effect behavior, but the schema and annotations carry the remaining load.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents evaluation_id provenance, the outcome enum, and optional fields. The description adds no parameter-specific meaning beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Record') and a clear resource ('the outcome of an execution that was permitted by a prior evaluate call'). It also distinguishes itself from related workflows by noting it does not replace pre-execution Permit Verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly establishes when to use the tool: after an execution permitted by a prior evaluate call, to close the evidence loop. It also gives an exclusion ('does not replace pre-execution Permit Verification'), though it does not name the exact sibling tool to use instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_resolve_approval_requestAtlaSent — Resolve Approval RequestA

Approve or deny a pending approval request. Approval records a verified input; the protected action must still satisfy the current authorization/reevaluation path and Permit Verification before execution.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the approval request.
commentNoOptional comment explaining the resolution.
resolutionYesWhether to approve or deny the request.
resolver_idYesIdentity of the person or system resolving the request.
approval_request_idYesThe approval_request_id from atlasent_create_approval_request.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide readOnlyHint=false and destructiveHint=false, but the description goes further by disclosing that 'Approval records a verified input; the protected action must still satisfy the current authorization/reevaluation path and Permit Verification before execution.' This is a critical behavioral nuance that clarifies that approving is not a final authorization—it only records input. This adds significant context beyond the annotations and helps the agent understand the tool's side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long and front-loads the core action in the first sentence. The second sentence adds essential behavioral context without fluff. There is zero redundancy, and every word earns its place. It is concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple approve/deny tool, the description covers the main action and the important caveat about the protected action still requiring authorization and Permit Verification. It does not describe return values or error scenarios, but since there is no output schema and the tool's purpose is straightforward, this is not a major gap. The description is complete enough for an agent to invoke it correctly in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters are already documented with descriptions. The description does not add any parameter-specific meaning beyond what the schema provides. It mentions 'pending approval request' which implies the request must be pending, but that's a general context, not a parameter detail. Given high schema coverage, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Approve or deny a pending approval request.' It uses a specific verb (approve/deny) and a specific resource (approval request), and it distinguishes this from sibling tools like atlasent_create_approval_request by focusing on resolving rather than creating. The purpose is unambiguous and easy for an agent to grasp.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when you need to resolve a pending approval request), but it does not explicitly mention alternatives or when NOT to use it. For instance, it does not say 'use this instead of atlasent_verify_permit' or caution against using it when the request is not pending. The guidance is implicit rather than explicit, which is adequate but not fully developed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_revoke_permitAtlaSent — Revoke PermitA

Revoke a permit before it expires. The permit immediately becomes invalid for verify_permit calls.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the permit.
reasonsNoHuman-readable reasons for revocation.
permitTokenYesThe permit token to revoke.

TDQS

A3.6/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description states the permit becomes invalid, indicating a destructive operation. But annotations have destructiveHint: false, contradicting the description. Therefore score is 1 due to contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each adding value. First sentence states purpose, second adds behavioral detail. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple revocation tool, the description covers main purpose and effect. Could include more about error conditions or prerequisites, but overall adequate given low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description does not add any additional meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'revoke', the resource 'permit', and the effect (immediately invalid for verify_permit). It distinguishes from siblings like atlasent_permit and atlasent_verify_permit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description says 'Revoke a permit before it expires', providing context for when to use it. However, it does not explicitly mention when not to use it or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_test_siem_deliveryAtlaSent — Test SIEM DeliveryA

Send a test event to the configured SIEM destination and report the result. Returns { success, statusCode, durationMs, error? }. Returns 409 if SIEM is not configured or is disabled.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate mutation (readOnlyHint=false) and not destructive. The description adds return structure and error condition (409), but does not detail side effects of sending a test event.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the action and return info with no unnecessary words. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-param test tool, the description is quite complete: action, return format, error case. Missing details about test event content are acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers org_id with 100% description coverage. The tool description does not add any additional parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool sends a test event to the SIEM destination and reports the result, with specific verb and resource. It is distinct from sibling SIEM tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool vs alternatives like atlasent_get_siem_config. The 409 return code hints at post-configuration use, but no direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_update_policyAtlaSent — Update PolicyA

Update a constraint bundle — change rules, title, or publish/archive it. Only fields you provide are updated; omitted fields are unchanged.

ParametersJSON Schema
NameRequiredDescriptionDefault
rulesNoReplacement rules array (replaces all existing rules).
titleNoNew title for the policy.
org_idYesOrganization ID that owns the policy.
statusNoNew lifecycle status (e.g. 'draft', 'published', 'archived', 'enforce').
actionsNoUpdated action-specific configuration.
versionNoNew semantic version string.
priorityNoNew evaluation priority (lower number = higher priority).
policy_idYesID of the bundle to update.
applies_toNoUpdated scope selector.
expires_atNoUpdated ISO-8601 expiry timestamp.
descriptionNoNew description.
effective_atNoUpdated ISO-8601 effective timestamp.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate non-read-only and non-destructive behavior. The description adds important detail about partial updates and lifecycle transitions (publish/archive), which is beyond the annotations. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences totaling 20 words, front-loaded with verb and resource. No redundant information. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 12 parameters and no output schema, the description covers the core purpose and partial update behavior. However, it lacks details on required parameters (policy_id, org_id) and expected return format, though schema provides parameter details. Adequate for a simple update tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline 3. The description mentions parameters generically (rules, title, publish/archive) but doesn't add meaning beyond schema descriptions. No extra semantics for individual fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates a constraint bundle, with specific actions like changing rules, title, or publishing/archiving. It distinguishes from sibling tools like create, delete, and get by focusing on modification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly notes partial update semantics ('Only fields you provide are updated; omitted fields are unchanged.'), which is crucial for correct usage. While it doesn't explicitly list when not to use, the context of sibling tools implies it's for modifying existing policies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_upsert_siem_configAtlaSent — Upsert SIEM ConfigA

Create or update the SIEM export configuration for an organization. Enterprise plan required. destinationUrl must be HTTPS. The credential field is stored securely and never returned by GET.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatYesPayload format: splunk_hec (HEC wrapper), elastic_ecs (ECS envelope), qradar_cef (CEF text), json (raw JSON).
org_idYesOrganization ID.
enabledNoWhether delivery is active (default true).
authTypeNoAuth method: bearer (Authorization: Bearer), basic (Authorization: Basic), api_key (X-API-Key), none. Default: bearer.
batchSizeNoEvents per batch (default 100).
credentialNoAuth credential. Stored securely; omit to keep the existing credential.
retryCountNoRetry attempts on delivery failure (default 3).
destinationUrlYesHTTPS URL of the SIEM endpoint to deliver events to.
includedEventTypesNoEvent types to include (default: permit, deny, override, governance).

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate a mutation (readOnlyHint=false) and non-destructive (destructiveHint=false). The description adds key behavioral details: 'destinationUrl must be HTTPS' (constraint) and 'credential is stored securely and never returned by GET' (security). This enriches beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences. First sentence states purpose, second adds requirement, third adds constraints and security. No wasted words, front-loaded with the most important information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 9 parameters and no output schema, the description covers plan requirements, URL constraints, and credential security. It does not describe return behavior (which an upsert might provide), but given no output schema, this is acceptable. Overall complete for an upsert tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds meaning by specifying 'Enterprise plan required' (global context), 'destinationUrl must be HTTPS' (specific constraint), and 'credential stored securely...' (security semantics). These go beyond the schema's parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Create or update') and resource ('SIEM export configuration') with scope ('for an organization'). It effectively distinguishes from sibling tools like 'atlasent_get_siem_config' (read-only) and 'atlasent_test_siem_delivery' (test only).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mentions the prerequisite ('Enterprise plan required'). It does not provide explicit when-not-to-use or alternatives, but the context is clear for creating or updating SIEM config. No direct comparison with siblings is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_verify_permitAtlaSent — Verify Permit (V1)A
Read-only

Verify a permit token with full binding inputs against the V1 endpoint. Use this at the execution boundary before the governed native effect; under-specified verification is a bypass vector.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionNoAction to verify the permit against.
org_idYesOrganization ID that issued the permit.
resourceNoResource to verify the permit against.
permit_tokenYesThe permit_token from a prior evaluate call.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description is consistent with them. The description adds security-relevant framing (execution boundary, bypass risk) but does not disclose failure behavior such as whether verification fails open or closed, or what the tool returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both load-bearing: the first states purpose, the second states when to use and the security rationale. There is no filler, redundancy, or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security-critical verification tool with no output schema, the description covers purpose, usage boundary, and risk adequately. However, it omits return shape and failure/error semantics, which an agent would need to handle a rejected or invalid permit correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 with the schema doing the heavy lifting. The description adds only a general emphasis that 'full binding inputs' matter and under-specification is risky, without giving parameter-specific meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb and resource — 'Verify a permit token' — and adds meaningful qualifiers ('full binding inputs', 'V1 endpoint'). The V1 reference implicitly distinguishes this from the sibling verify_permit, though it does not name the alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-to-use instruction: 'at the execution boundary before the governed native effect', and explains the consequence of misuse ('under-specified verification is a bypass vector'). It provides clear context but does not name alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_vqp_audit_summaryAtlaSent — VQP Audit SummaryA
Read-only

Retrieve a summary of VQP audit activity — hash match rates, drift event counts, and verdict changes — from the BCCAE compliance report. Use for SOC 2 evidence collection and monitoring dashboards.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO-8601 end of the reporting window.
fromNoISO-8601 start of the reporting window.
org_idYesOrganization ID.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond annotations: it specifies the data source ('BCCAE compliance report') and the included data elements, which is valuable for understanding what the tool returns. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no unnecessary words. The first sentence states the purpose, the second provides a use case. Information is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description hints at return values (hash match rates, drift event counts, verdict changes), which is helpful. The tool is simple with 3 parameters, and the description adequately covers purpose and usage. However, for complete coverage, more detail on the return format could be beneficial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description does not add new semantics to the parameters beyond their names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the verb 'retrieve' and the resource 'summary of VQP audit activity' with explicit data points (hash match rates, drift event counts, verdict changes). It distinguishes itself from sibling tools like atlasent_vqp_drift_events by indicating this is a summary from the BCCAE compliance report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case ('SOC 2 evidence collection and monitoring dashboards'), implying when to use. However, it does not explicitly state when not to use or compare to alternatives like atlasent_vqp_drift_events or atlasent_list_audit_events.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_vqp_drift_eventsAtlaSent — VQP Drift EventsA
Read-only

List VQP snapshots where the re-run AI score drifted by ≥10 points or the verdict changed (e.g. qualified → not_qualified). Use for compliance investigation and QA-VQP-002 § 7 deviation reporting.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoISO-8601 end of the reporting window.
fromNoISO-8601 start of the reporting window.
limitNoMax events to return (default 20, max 100).
org_idYesOrganization ID.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the description's statement of listing snapshots adds behavioral context. It discloses the drift criteria beyond annotations, which is useful, though no extra details on auth or rate limits are given.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the action and resource, followed by purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is a read-only listing with 4 parameters (all documented) and no output schema, the description adequately specifies what it returns and the criteria. It mentions the specific drift thresholds and usage context, which is complete for such a tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are fully documented. The description adds no additional parameter details beyond the schema; it implies filter criteria (drift/verdict change) but doesn't explain how parameters relate to these criteria.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists VQP snapshots with specific drift criteria (≥10 points or verdict change), distinguishing it from sibling tools like atlasent_vqp_generate or atlasent_vqp_audit_summary by focusing on drift events.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly mentions use for compliance investigation and QA-VQP-002 §7 deviation reporting, providing clear context. It does not explicitly exclude other uses or compare to alternatives, but the purpose is well-defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_vqp_generateAtlaSent — VQP Generate SnapshotB

Score a constraint bundle against the 6 VQP criteria (access_control CC6.1, audit_coverage CC7.2, escalation_paths CC7.4, deny_specificity CC8.1, hold_conditions CC6.3, override_governance CC5.2). Stores a tamper-evident snapshot with a SHA-256 prompt_hash in vqp_snapshots. Verdicts: qualified (≥85, no fails), conditionally_qualified (≥60), not_qualified. Requires ATLASENT_SUPABASE_URL and ATLASENT_SUPABASE_SERVICE_ROLE_KEY.

ParametersJSON Schema
NameRequiredDescriptionDefault
org_idYesOrganization ID that owns the bundle.
bundle_idYesConstraint bundle ID to score.
vqp_contextNoAdditional context embedded in the VQP prompt for this snapshot.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate non-read-only and non-destructive behavior. The description adds context by stating that a snapshot is stored and requires specific environment variables. However, it does not elaborate on potential side effects, idempotency, or data retention policies, leaving some behavioral aspects undisclosed beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the primary action. Every sentence provides necessary information with no extraneous content. The format is efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the core action and verdicts but lacks detail on the output format or return value. It does not document the vqp_context parameter's usage. Given moderate complexity and no output schema, the description is adequate but leaves gaps that could hinder an agent's correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds overarching context about VQP criteria and verdict thresholds but does not provide additional parameter-specific meaning beyond the schema. It does not explain how vqp_context is used or what values it should contain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scores a constraint bundle against six specific VQP criteria and stores a tamper-evident snapshot. It uses specific verbs ('Score', 'Stores') and identifies the resource ('constraint bundle', 'vqp_snapshots'). However, it does not differentiate this tool from sibling VQP tools like atlasent_vqp_audit_summary or atlasent_vqp_verify.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It lacks explicit context for when the tool is appropriate, prerequisites beyond environment variables, and does not mention any exclusionary or comparative criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

atlasent_vqp_verifyAtlaSent — VQP Verify SnapshotA

Re-derive the VQP prompt from current bundle data and verify it matches the stored SHA-256 prompt_hash. Detects tampering (hash_match: false) and optionally re-runs the AI model to detect score drift (score_delta, verdict_changed). Writes a vqp_audit_log row for SOC 2 CC7.2 / 21 CFR Part 11 evidence. Requires ATLASENT_SUPABASE_URL and ATLASENT_SUPABASE_SERVICE_ROLE_KEY.

ParametersJSON Schema
NameRequiredDescriptionDefault
rerunNoRe-call the AI model with the re-derived prompt to detect score drift. Populates rerun_score, rerun_verdict, score_delta. Slower (10–20 s AI call).
snapshot_idYesSnapshot ID from atlasent_vqp_generate or a stored vqp_snapshots row.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false and destructiveHint=false but are generic. The description adds significant transparency: it discloses that the tool writes an audit log, optionally makes an AI call (10-20s slower), and detects tampering and drift. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four concise sentences, all essential. The main action is stated first, followed by detection capabilities, optional behavior, logging, and requirements. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description mentions key outputs (hash_match, score_delta, verdict_changed, audit log row). It covers auth requirements and optional behavior. Could explicitly state return format but is sufficient for an agent to understand outcomes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed descriptions for both parameters. The description reinforces the optional AI re-run (rerun) and the source of snapshot_id, adding context beyond the schema (e.g., '10–20 s AI call' for rerun). This warrants a score above baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('re-derive', 'verify', 'detects', 'writes') and clearly identifies the resource (VQP snapshot). It explains the core verification of hash_match and optional drift detection, distinguishing it from sibling tools like atlasent_vqp_generate and atlasent_vqp_audit_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the required environment variables and implies use for tampering detection and SOC2/CFR compliance. It does not explicitly list when not to use or compare to alternatives, but the context is clear enough for a specialist tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deploy_serviceDeploy Service (authorization-gated)A
Destructive

Example protected tool. Every call is authorized AND its Permit is verified by AtlaSent before the deploy runs. Denied, held, expired, replayed, mismatched, or unverifiable calls are blocked and never touch the target system.

ParametersJSON Schema
NameRequiredDescriptionDefault
actor_idYesIdentifier for the user or service account the agent is acting on behalf of.
approvalsNoApproval identifiers already obtained for this action (e.g. ticket IDs, reviewer handles).
environmentYesTarget environment for the action (e.g. production, staging, development).
service_nameYesName of the service to deploy.
change_windowNoISO-8601 time window during which the change is permitted (e.g. 2025-01-15T02:00:00Z/PT4H).

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false and destructiveHint=true, so the agent knows it is a mutating, destructive operation. The description adds context about the Permit verification process and that blocked calls never reach the target system, which is valuable behavioral transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no extraneous words. The key point about the authorization gate is front-loaded, and every sentence contributes to understanding the tool's protected nature.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete regarding the authorization gating but lacks information about the actual deployment behavior, return values, or prerequisites like approvals. Given the destructive nature, an agent might need more context, but the schema covers parameters and the tool is described as an example.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters are documented in the schema. The description adds no parameter-specific information, so it relies on the schema. A baseline of 3 is appropriate given the high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The name and title clearly indicate a deployment action, and the description confirms it is a protected deploy operation. It distinguishes from sibling atlasent_* policy/audit tools, but the description focuses on the authorization gate rather than the deploy action itself, so the purpose is not fully explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It does not mention that this is the tool for deploying services or any prerequisites such as approvals. The description only discusses the authorization mechanism, leaving the intended use case to be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

evaluateAtlaSent — Evaluate ActionA
Read-only

Call this BEFORE performing any sensitive action. Returns a Decision: allow (verify the returned permit_token at the execution boundary before proceeding), deny (you MUST NOT proceed), or hold (do not proceed; route for review).

ParametersJSON Schema
NameRequiredDescriptionDefault
actor_idYesIdentifier for the user or service account the agent is acting on behalf of.
approvalsNoApproval identifiers already obtained for this action (e.g. ticket IDs, reviewer handles).
action_typeYesCanon-backed action type (for example production.deploy, agent.tool.invoke, access.grant). Use atlasent_lookup_action to discover governed Action Types.
environmentYesTarget environment for the action (e.g. production, staging, development).
change_windowNoISO-8601 time window during which the change is permitted (e.g. 2025-01-15T02:00:00Z/PT4H).

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=true, destructiveHint=false), the description adds the three-way decision semantics and the requirement to verify the returned permit_token before proceeding. It does not clarify token lifecycle details like single-use or expiry, but the core behavioral contract is well disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence that front-loads the invocation timing and packs the full decision contract into a compact, scannable structure. There is no filler or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description appropriately explains the three possible return values and the required post-call verification step. It omits edge-case behavior (e.g., error handling or token validation mechanics), but is sufficiently complete for a single-action evaluation gate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters are already documented in the input schema. The description adds no extra parameter-level guidance, which is acceptable given the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Call this BEFORE performing any sensitive action') and the return contract (allow/deny/hold), making the tool's purpose clear. However, it does not differentiate this tool from the sibling tools atlasent_evaluate_many or atlasent_evaluate_stream, so an agent may not know which evaluator to select based on description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a concrete trigger ('BEFORE performing any sensitive action') and explicit follow-up behavior for each decision branch (verify permit_token at the execution boundary, MUST NOT proceed on deny, route for review on hold). It does not mention exclusions or when to prefer batch/stream alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_permitAtlaSent — Verify PermitA
Read-only

Call this AFTER evaluate returns allow and BEFORE the protected native side effect. It verifies the permit for the presented execution context. Proceed only when valid is true; expired, invalid, replayed, mismatched, or error outcomes must block the action.

ParametersJSON Schema
NameRequiredDescriptionDefault
actor_idYesIdentifier for the user or service account the agent is acting on behalf of.
approvalsNoApproval identifiers already obtained for this action (e.g. ticket IDs, reviewer handles).
target_idNoTarget resource the permit is bound to (e.g. service name, artifact id, tool-call target). Presenting a different target at verify yields a binding mismatch.
action_typeYesCanon-backed action type (for example production.deploy, agent.tool.invoke, access.grant). Use atlasent_lookup_action to discover governed Action Types.
environmentYesTarget environment for the action (e.g. production, staging, development).
payload_hashNoHash of the exact executed payload (tool-call arguments / artifact digest). Bind it at evaluate via execution_payload_hash; presenting a different hash at verify yields PAYLOAD_MISMATCH.
permit_tokenYesThe permit_token returned by a prior evaluate call.
change_windowNoISO-8601 time window during which the change is permitted (e.g. 2025-01-15T02:00:00Z/PT4H).

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds behavioral context by describing the `valid` field and enumerating outcomes that should block the action (expired, invalid, replayed, mismatched, error), which is useful beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the critical sequencing instruction, and every sentence adds value. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description adequately conveys the return contract (a `valid` flag) and the possible outcomes. It also provides the workflow context that makes the tool's role clear. For a tool with this complexity and full schema parameter coverage, the description is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already documented. The tool description does not add any additional semantic meaning for the parameters themselves; it only references the overall execution context. Per the rubric, a baseline of 3 is appropriate when the schema fully covers the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (verify), the resource (permit), and the exact position in a workflow (after evaluate, before the protected side effect). It distinguishes itself from the sibling `evaluate` by specifying the sequencing, making the tool's role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to call this tool ('AFTER evaluate returns allow and BEFORE the protected native side effect') and what to do with the result ('Proceed only when valid is true; ... must block the action'). This gives an agent a precise usage condition and decision rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv2.13.0
    • Addedatlasent_check_permit
    • Addedatlasent_get_decision
    • Addedatlasent_get_permit
  2. 10 tool updatesv2.12.2
    • Addedatlasent_atlas_lookup
    • Changedatlasent_create_approval_request2 fields changed
      • changedInput schema / properties / action / description
        Previous value: -"The action requiring approval (e.g. 'delete:production-db')."New value: +"The action requiring approval (e.g. 'production.deploy')."
      • changedInput schema / properties / resource / description
        Previous value: -"The resource the action targets (e.g. 'db:prod-postgres')."New value: +"The resource the action targets (e.g. 'env:production')."
    • Changedatlasent_create_policy1 field changed
      • changedInput schema / properties / policy_id / description
        Previous value: -"Client-assigned unique ID for this policy bundle (e.g. 'deploy-gate')."New value: +"Client-assigned unique ID for this policy bundle (e.g. 'production-change')."
    • Changedatlasent_evaluate10 fields changed
      • removedInput schema / properties / action
        Removed value: -{
        -  "description": "What action is being performed (e.g. 'production.deploy', 'records.delete').",
        -  "maxLength": 256,
        -  "minLength": 1,
        -  "type": "string"
        -}
      • addedInput schema / properties / action_type
        Added value: +{
        +  "description": "Canon-backed Action Type (for example 'production.deploy' or 'agent.tool.invoke').",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • addedInput schema / properties / actor_id
        Added value: +{
        +  "description": "The actor performing the action (e.g. 'user:alice', 'service:deploy-bot').",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • changedInput schema / properties / context / description
        Previous value: -"Key-value context matched against constraint rules."New value: +"Key-value context matched against constraint rules (include target/resource info here)."
      • addedInput schema / properties / execution_payload_hash
        Added value: +{
        +  "description": "Hash of the exact executed payload (tool-call arguments / artifact digest). Bind it at evaluate via execution_payload_hash; presenting a different hash at verify yields PAYLOAD_MISMATCH.",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • removedInput schema / properties / org_id
        Removed value: -{
        -  "description": "Organization ID that owns the policy.",
        -  "maxLength": 256,
        -  "minLength": 1,
        -  "type": "string"
        -}
      • removedInput schema / properties / resource
        Removed value: -{
        -  "description": "The resource being acted on (e.g. 'env:prod', 'db:customers').",
        -  "maxLength": 256,
        -  "minLength": 1,
        -  "type": "string"
        -}
      • removedInput schema / properties / subject
        Removed value: -{
        -  "description": "The actor performing the action (e.g. 'user:alice', 'service:deploy-bot').",
        -  "maxLength": 256,
        -  "minLength": 1,
        -  "type": "string"
        -}
      • addedInput schema / properties / target_id
        Added value: +{
        +  "description": "Target resource the permit is bound to (e.g. service name, artifact id, tool-call target). Presenting a different target at verify yields a binding mismatch.",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • changedInput schema / required
        Previous value: -[
        -  "subject",
        -  "action",
        -  "resource",
        -  "org_id"
        -]New value: +[
        +  "actor_id",
        +  "action_type"
        +]
    • Addedatlasent_explain_authority
    • Addedatlasent_integrity_audit
    • Changedatlasent_lookup_action1 field changed
      • changedInput schema / properties / query / description
        Previous value: -"Substring search across slug, display_name, and description. Case-insensitive."New value: +"Plain-language description of the action to find. Ranked deterministically (offline, no network) over slug, display name, family, description and a curated alias vocabulary."
    • Removedatlasent_trajectory_verify
    • Changedevaluate1 field changed
      • changedInput schema / properties / action_type / description
        Previous value: -"The action the agent is about to perform (e.g. deploy, delete, merge, execute_query, send_email)."New value: +"Canon-backed action type (for example production.deploy, agent.tool.invoke, access.grant). Use atlasent_lookup_action to discover governed Action Types."
    • Changedverify_permit3 fields changed
      • changedInput schema / properties / action_type / description
        Previous value: -"The action the agent is about to perform (e.g. deploy, delete, merge, execute_query, send_email)."New value: +"Canon-backed action type (for example production.deploy, agent.tool.invoke, access.grant). Use atlasent_lookup_action to discover governed Action Types."
      • addedInput schema / properties / payload_hash
        Added value: +{
        +  "description": "Hash of the exact executed payload (tool-call arguments / artifact digest). Bind it at evaluate via execution_payload_hash; presenting a different hash at verify yields PAYLOAD_MISMATCH.",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
      • addedInput schema / properties / target_id
        Added value: +{
        +  "description": "Target resource the permit is bound to (e.g. service name, artifact id, tool-call target). Presenting a different target at verify yields a binding mismatch.",
        +  "maxLength": 256,
        +  "minLength": 1,
        +  "type": "string"
        +}
  3. 40 tool updatesv2.11.0
    • First observedatlasent_create_approval_request
    • First observedatlasent_create_evidence_export
    • First observedatlasent_create_policy
    • First observedatlasent_create_scim_user
    • First observedatlasent_create_webhook
    • First observedatlasent_delete_policy
    • First observedatlasent_delete_scim_user
    • First observedatlasent_delete_webhook
    • First observedatlasent_evaluate
    • First observedatlasent_evaluate_many
    • First observedatlasent_evaluate_stream
    • First observedatlasent_get_evidence_export
    • First observedatlasent_get_policy
    • First observedatlasent_get_scim_user
    • First observedatlasent_get_siem_config
    • First observedatlasent_list_audit_events
    • First observedatlasent_list_evidence_exports
    • First observedatlasent_list_permits
    • First observedatlasent_list_policies
    • First observedatlasent_list_scim_groups
    • First observedatlasent_list_scim_users
    • First observedatlasent_lookup_action
    • First observedatlasent_patch_scim_user
    • First observedatlasent_permit
    • First observedatlasent_query
    • First observedatlasent_record_execution_evaluation
    • First observedatlasent_resolve_approval_request
    • First observedatlasent_revoke_permit
    • First observedatlasent_test_siem_delivery
    • First observedatlasent_trajectory_verify
    • First observedatlasent_update_policy
    • First observedatlasent_upsert_siem_config
    • First observedatlasent_verify_permit
    • First observedatlasent_vqp_audit_summary
    • First observedatlasent_vqp_drift_events
    • First observedatlasent_vqp_generate
    • First observedatlasent_vqp_verify
    • First observeddeploy_service
    • First observedevaluate
    • First observedverify_permit

TDQS

B3.3/5.0

Scored across 45 tools

Disambiguation2/5

The set contains near-duplicate entry points (evaluate/atlasent_evaluate, verify_permit/atlasent_verify_permit) that are hard to distinguish, and several permit-related tools (get/check/verify/permit) overlap in semantics. Many other tools are distinct, but the duplicates create real misselection risk.

Naming Consistency3/5

Most tools follow an atlasent_<verb>_<noun> pattern, but the pattern is broken by unprefixed evaluate, verify_permit, and deploy_service, plus generic names like atlasent_query and atlasent_permit. Still readable and mostly snake_case, so not chaotic.

Tool Count2/5

45 tools is far above the well-scoped range, and several are redundant (duplicate evaluate/verify) or a demo (deploy_service). A leaner set could cover the same platform with fewer entry points.

Completeness3/5

Core policy/permit/decision workflows are well covered, but subdomains have gaps: SCIM groups are read-only, webhooks have create/delete but no list/get, and SIEM config has no delete. These are workable but notable omissions for an admin surface.

Maintenance

ActivityActive
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Stateless enterprise policy firewall & token-cost proxy for MCP. It enforces identity, policy, and budget on every tool call.
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Governs AI agent tool calls by checking them against Agentic Control Plane policies, returning allow/deny/ask decisions with audit logging and identity attribution for MCP clients like Claude and ChatGPT. Exposes acp_check and acp_status tools for policy enforcement and connection verification.
    MIT
  • F
    license
    Not graded
    quality
    B
    maintenance
    Provides a secure MCP boundary for AI agents, intercepting and validating tool calls, redacting secrets, and requiring human approval for sensitive actions with a tamper-evident audit trail.
    -