Skip to main content
Glama
privacyscrubber-mcp

privacyscrubber-mcp

generate_procurement_memo

Read-onlyIdempotent

Generate an executive-ready procurement and ROI memo comparing cloud DLP costs with PrivacyScrubber Teams/SDK tiers and citing GDPR, HIPAA, SOC 2, PCI DSS, NIST, and EU AI Act requirements.

Instructions

Zero-Trust Enterprise Procurement: Generates an executive-ready Procurement & ROI Memorandum for Chief Information Security Officers (CISO), Data Protection Officers (DPO), and VP of Engineering. Compares TCO of traditional Cloud DLP ($1.5k–$4k/mo) vs PrivacyScrubber TEAMS ($99/mo flat) or Developer SDK ($299/mo flat), citing statutory frameworks (GDPR Art. 4/28, HIPAA §164.514, SOC 2 Type II, PCI DSS v4.0, NIST SP 800-53, EU AI Act Art. 50).

Input Schema

NameRequiredDescriptionDefault
formatNoOutput format: 'markdown' (default) or 'text'.
app_nameNoTarget project, repository, or system name (e.g. 'Engineering AI Toolchain & Autonomous Agents'). Defaults to 'Internal AI IDE Toolchain & Workflows'.
developerNoRequester name, role, or team (e.g. 'Engineering Platform Team'). Defaults to 'Engineering / AI Platform Team'.
team_sizeNoSize of engineering team / seats. Defaults to 10.
target_tierNoTarget license tier: 'teams' ($99/mo flat, for Cursor/Claude/Windsurf/IDE agents), 'sdk' ($299/mo flat, for backend microservices/RAG pipelines), or 'both'. Defaults to 'teams'.
estimated_volumeNoProjected prompt or token volume. Defaults to '50M - 500M characters/month'.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv1.0.3

TDQS

C2.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=false and destructiveHint=false, so safety is covered. The description adds what the artifact contains (TCO comparison vs. Cloud DLP pricing, statutory citations such as GDPR Art. 4/28 and HIPAA §164.514), which is genuinely useful behavioral context. It does not say how the memo is returned (inline text vs. file) or how long it will be.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two long sentences, with the most actionable clause (what is generated) preceded by an unneeded marketing label. The pricing figures and statutory list are defensible as memo content but crowd out operational information such as return format and output shape.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and six optional parameters, the description should at minimum indicate what the agent gets back and whether defaults make a zero-argument call sensible. It conveys the memo's subject matter well but leaves the return value and output delivery mechanism unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six optional parameters (format, app_name, developer, team_size, target_tier, estimated_volume) are already documented with defaults and enums. The description mentions the tier pricing ($99 teams vs. $299 sdk) but adds no call-level parameter guidance beyond what the schema states, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The core verb+resource ('Generates an executive-ready Procurement & ROI Memorandum') is identifiable, but it is front-loaded behind promotional framing ('Zero-Trust Enterprise Procurement') and pricing/statute lists. It never distinguishes itself from the sibling generate_compliance_report, which an agent could easily confuse with this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description names an audience (CISO, DPO, VP of Engineering) but gives no when-to-use vs. when-not guidance and no alternatives. An agent has to infer that this tool is for procurement/budget justification rather than technical compliance documentation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.