safe-mind-tools
Safe Mind Developer Tools
Official CLI and MCP server for Safe Mind - the platform for the legally required psychological risk assessment (Gefährdungsbeurteilung psychischer Belastung, GBU Psyche) in Germany.
Package | npm | Purpose |
Terminal client for the Safe Mind Public API v1 | ||
MCP server for AI assistants (Claude, ChatGPT, Gemini, Cursor, ...) |
Quick start
npm install -g safe-mind
safe-mind login --email you@example.com --password '...'
safe-mind surveys create --start 2026-10-01 --weeks 4 --employees 220 \
--department "Produktion" --department "Verwaltung"MCP (any MCP client):
{
"mcpServers": {
"safe-mind": {
"command": "npx",
"args": ["-y", "safe-mind-mcp"],
"env": { "SAFE_MIND_API_KEY": "sm_live_..." }
}
}
}Related MCP server: webmin-mcp-server
Documentation
API reference and examples: https://www.safe-mind.de/developers
Anonymity: analytics endpoints only return aggregated results; groups below the minimum group size are filtered server-side.
License
MIT
Available Tools
12 toolssafe_mind_create_departmentA
Create one department/area (Tätigkeitsbereich) of the company and return its id and name. Idempotent: if an area with exactly this name exists, that one is returned and nothing is duplicated. Not needed before safe_mind_create_survey, which creates missing areas by name itself. Areas cannot be renamed or deleted through the API. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name of the area as employees know it, e.g. "Produktion (Halle 1, 2)" or "Verwaltung". Matched exactly (case-sensitive) against existing areas. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so: idempotent on exact name match, areas are immutable (cannot be renamed or deleted), API-key requirement with two ways to satisfy it, and the account-scoped blast radius. It even discloses the return payload (id and name).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five short sentences, each doing distinct work: purpose, idempotency, sibling interaction, immutability, auth. The core purpose is front-loaded and nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter creation tool with no annotations and no output schema, the description covers the return value, auth, scope, idempotency, and immutability — everything an agent needs to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents the exact, case-sensitive matching and gives examples, so the baseline is 3. The description adds the idempotency consequence of that matching ('if an area with exactly this name exists, that one is returned and nothing is duplicated'), which is meaningful semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create one department/area ... and return its id and name'), and names the domain term Tätigkeitsbereich. It also implicitly separates itself from safe_mind_create_survey and safe_mind_list_departments by explaining the creation-and-return contract.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when this call is NOT needed ('Not needed before safe_mind_create_survey, which creates missing areas by name itself'), names the prerequisite for auth, and states the idempotency rule that determines whether the call is safe to repeat. Both the when and the when-not are present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_create_locationA
Create one location (Standort) of the company and return its id and name. Use it for companies with several sites whose results should be compared; single-site companies do not need locations. Idempotent: if a location with exactly this name exists, that one is returned and nothing is duplicated. Not needed before safe_mind_create_survey, which creates missing locations by name itself. Locations cannot be renamed or deleted through the API. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name of the site as employees know it, e.g. "Hamburg" or "Werk Süd". Matched exactly (case-sensitive) against existing locations. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so richly: idempotency semantics (exact-name match returns existing, no duplication), immutability (cannot be renamed or deleted via API), auth requirement (SAFE_MIND_API_KEY or safe_mind_get_api_key), and account scoping. This is far beyond what structured fields provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and return values, then layered with distinct functional facts (when to use, idempotency, constraint, auth). Every sentence contributes non-redundant information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no annotations and no output schema, the description covers return values, auth, idempotency, immutability, and usage conditions. An agent has everything needed to invoke it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema itself documents the exact case-sensitive matching of the name parameter, so the baseline is 3. The description reinforces the idempotency/matching semantics but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (create a location/Standort) and even names the return values (id and name). It clearly distinguishes the tool from the list/create siblings and defines its scope (company sites).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it (multi-site companies comparing results; single-site companies don't need it) and when it is unnecessary (not needed before safe_mind_create_survey, which auto-creates locations). This is textbook when/when-not guidance tied to named siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_create_surveyA
Create a survey draft for the psychological risk assessment and return its id, status "draft", dates, participation link and an edit link. Departments and locations are passed by name; missing ones are created, existing ones reused. The draft is not visible to employees yet: the account owner reviews it and starts it in the Safe Mind app via the edit link (payment happens there). Drafts cannot be edited or deleted through the API, so confirm the inputs with the user first. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Survey title shown to employees. Default: "<company> - Psychische Gefährdungsbeurteilung <year>". | |
| locations | No | Optional location names for multi-site companies, e.g. ["Hamburg", "Bielefeld"]. | |
| startDate | Yes | First day of the survey as YYYY-MM-DD, e.g. "2026-11-02". | |
| departments | Yes | Names of the departments/areas employees choose from, e.g. ["Produktion", "Verwaltung"]. At least one. Use the exact names from safe_mind_list_departments to reuse existing areas. | |
| durationWeeks | Yes | Runtime in weeks. Allowed: 2 weeks up to the template maximum (currently 6). The template recommends at least 4 weeks; 2-3 weeks are accepted but not recommended (lower response rate, more groups below the anonymity threshold). | |
| employeeCount | Yes | Number of employees invited to take part; also the participant limit of the survey. | |
| analyticsMinThreshold | No | Anonymity threshold: smallest group whose results are shown in segmented analytics. Minimum 5, default 7. Higher protects small teams better. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses return fields (id, status, dates, participation and edit links), side effects (missing departments/locations are created, existing ones reused), lifecycle state (draft not visible to employees, immutable via API), auth requirement, and account/company scoping.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose, then side effects, lifecycle constraints, and prerequisites in order of importance. Every sentence adds actionable information with no repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description enumerates the return payload. Combined with side-effect disclosure, immutability warning, and auth instructions, an agent has everything needed to call this 7-parameter mutation tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so 3 is the baseline, but the description adds semantics beyond it: departments and locations are passed by name and missing names are auto-created while existing ones are reused. That resolves the ambiguity of whether these parameters create or reference entities, which the schema only partly implies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Create a survey draft") scoped to the psychological risk assessment, and the sibling names (list_surveys, get_survey) make the create vs. read distinction obvious. An agent can identify the tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operational context: the draft is invisible to employees, the owner starts it in-app via the edit link, and inputs should be confirmed with the user first because drafts cannot be edited or deleted via the API. It also states the API-key prerequisite and points to safe_mind_get_api_key. It stops short of explicitly naming sibling alternatives for creating departments/locations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_get_analyticsA
Aggregated results of one survey: respondent count, anonymity threshold and the average score per category (scale -1 to +1, higher is better; the Safe Mind app shows the same values times 10). With groupBy the averages are split by department, location, age group or gender. Groups below the anonymity threshold are never returned, only counted in suppressedGroupCount, and individual answers are never exposed. resultsAvailable is false until the survey is paid. Read-only. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
| groupBy | No | Optional split of the results. Omit for the overall result of the whole survey. | |
| surveyId | Yes | Survey id (UUID) as returned by safe_mind_list_surveys or safe_mind_create_survey. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the anonymity-threshold suppression rule (suppressedGroupCount), that individual answers are never exposed, the paid-survey gate on resultsAvailable, that it is read-only, that it requires an API key (SAFE_MIND_API_KEY or safe_mind_get_api_key), and that it scopes to the company behind the key. These are exactly the constraints an agent needs before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with what is returned and every sentence carries information (scale, suppression, payment gate, auth, scope). It is a single dense paragraph, though, and could be split for easier scanning, so it is not maximally structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by enumerating the returned fields (respondent count, threshold, per-category averages, suppressedGroupCount, resultsAvailable) plus auth and scoping requirements. Nothing an agent needs to invoke this correctly or interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning by explaining what groupBy does to the output (averages split by department, location, age group, or gender) rather than just repeating the enum. surveyId semantics remain entirely in the schema, so it is not a full 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (retrieve aggregated results of one survey) and enumerates exactly what is returned: respondent count, anonymity threshold, and average score per category with scale semantics. An agent can immediately distinguish it from safe_mind_get_survey, which would return the survey definition rather than aggregated analytics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly explains the condition that changes behavior (groupBy splits averages; omit for overall) and the precondition for resultsAvailable being true (survey must be paid). It does not, however, explicitly name a sibling alternative or state when NOT to use this tool versus safe_mind_get_survey, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_get_api_keyA
Log in with email and password of a verified Safe Mind account and create an API key. Call this before any company, survey or analytics tool unless SAFE_MIND_API_KEY is already set. The key is kept in memory for this session only and also returned, so the user can store it as SAFE_MIND_API_KEY for later sessions. Fails if the email is not verified yet (use safe_mind_verify_email) or the credentials are wrong.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | Email address of the verified Safe Mind account. | ||
| password | Yes | Password of that account. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does well: it discloses that the key lives in memory for the session only, is also returned for persistence as SAFE_MIND_API_KEY, and that it fails on unverified email or bad credentials. It doesn't cover rate limits, key expiry/rotation, or account-lockout behavior after bad credentials, which are relevant for a credential-based mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, all load-bearing, front-loaded with the action and followed by the ordering rule, side effects, and failure modes. No redundancy with the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-param auth tool with no output schema, the description covers what is returned (the key), its session lifetime, and failure conditions. It omits the lifetime/validity of the issued key and whether repeated calls invalidate prior keys, which an agent managing sessions would benefit from knowing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both email and password are already documented in the schema. The description adds the semantics of 'verified' account and credential correctness but no format or source details beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States specific actions (log in with email/password, create an API key) on an identifiable resource, and explicitly scopes the tool ahead of company, survey and analytics tools. It also names the sibling safe_mind_verify_email as the prerequisite path, so the agent can distinguish it from registration/verification tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-to-use rule ('call this before any company, survey or analytics tool'), an exclusion ('unless SAFE_MIND_API_KEY is already set'), and routes the failure case to safe_mind_verify_email. Nothing about invocation timing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_get_surveyA
Show one survey of the company: title, status (draft, active, closed, archived), start and end date, participant limit, anonymity threshold, the participation link for employees and the edit link for the account owner. Read-only. Use it to check a single survey or fetch its links; for an overview of all surveys use safe_mind_list_surveys, for results use safe_mind_get_analytics. Returns a not-found error for ids that do not exist or belong to another company. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
| surveyId | Yes | Survey id (UUID) as returned by safe_mind_list_surveys or safe_mind_create_survey. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so: it declares the operation read-only, documents the not-found error for nonexistent or cross-company ids, states the tenancy scope ('acts on the company of the account behind the key'), and covers authentication. This is the behavioral context an agent needs before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the returned-field list, which is valuable given there is no output schema. It runs long as a single dense paragraph of clauses, but nearly every clause (routing, auth, error, tenancy) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema and no annotations, the description supplies the returned fields, safety profile, error behavior, auth requirement, and sibling routing. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single surveyId parameter is already documented in the schema as a UUID sourced from list/create tools. The description adds no extra syntax, format, or constraint detail for the parameter, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Show one survey of the company') and enumerates exactly what is returned (title, status, dates, participant limit, anonymity threshold, participation and edit links). It is unmistakably distinct from safe_mind_list_surveys and safe_mind_get_analytics, which it names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it ('check a single survey or fetch its links') and routes the agent to the correct alternatives for other intents ('for an overview of all surveys use safe_mind_list_surveys, for results use safe_mind_get_analytics'). It also states the prerequisite (API key via env var or safe_mind_get_api_key).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_list_departmentsA
List the departments/areas (Tätigkeitsbereiche) of the company as id and name. Surveys segment results by these areas. Read-only. Call it before safe_mind_create_department or safe_mind_create_survey to reuse existing names exactly. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses read-only semantics, the API-key requirement (SAFE_MIND_API_KEY or safe_mind_get_api_key), and the account-scoped company boundary. It does not mention pagination or list-size limits, which is the only notable gap for a list tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five short sentences, each carrying distinct information (purpose, return shape, relation to surveys, when to call, auth, scope) with the core action front-loaded. Nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no annotations and no output schema, the description covers what the tool returns, how authentication works, what scope it operates on, and when to call it. An agent has everything needed to invoke it correctly on the first attempt.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain and the baseline is 4. The description correctly implies no filtering is possible and that the scope is fixed by the account key.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the departments/areas (Tätigkeitsbereiche) of the company as id and name') and even gives the return shape. It is clearly separable from siblings like safe_mind_create_department and safe_mind_list_surveys.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs 'Call it before safe_mind_create_department or safe_mind_create_survey to reuse existing names exactly', naming the alternatives and the condition that selects them. This is the strongest possible routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_list_locationsA
List the locations (Standorte) of the company as id and name. Locations are an optional second segmentation next to departments, useful for companies with several sites. Read-only. Call it before safe_mind_create_location to reuse existing names exactly. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it declares 'Read-only,' discloses the authentication requirement (SAFE_MIND_API_KEY or safe_mind_get_api_key), and states the scoping ('Acts on the company of the account behind the key'). It also sketches the return shape (id and name). Only a note on pagination or result-size limits is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but well front-loaded: purpose first, then segmentation context, safety, usage routing, and auth. Every sentence carries a distinct payload, though the six-sentence block could be tightened slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 0-param, read-only list tool with no output schema or annotations, the description covers everything an agent needs: what it returns, how it scopes, how it authenticates, and how it fits with the create sibling. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so there are no parameter semantics to document. Baseline 4 is appropriate; the description sensibly adds no redundant parameter prose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (list) and resource (locations, id and name) and immediately distinguishes the resource from its sibling: locations are 'an optional second segmentation next to departments.' An agent can tell it apart from safe_mind_list_departments without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('Call it before safe_mind_create_location to reuse existing names exactly') and names the sibling it pairs with, plus the domain condition ('useful for companies with several sites'). Routing is fully specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_list_surveysA
List all surveys of the company, newest first, each with id, title, status (draft, active, closed, archived), start and end date, participant limit, anonymity threshold, participation link and edit link. Read-only. Use it to find the surveyId needed by safe_mind_get_survey and safe_mind_get_analytics. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does most of it: it declares 'Read-only', discloses the auth requirement and the account/company scoping ('Acts on the company of the account behind the key'), and lists the result fields. The only meaningful gap is that it says nothing about result size, pagination, or whether closed/archived surveys are always included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and scoping, then each following sentence adds distinct value (field list, read-only, routing, auth, scope). The enumerated field list is long, but it is justified because there is no output schema; it could still be trimmed or bulleted for scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Absent an output schema, the description compensates by enumerating the returned fields (id, title, status enum values, dates, limits, anonymity threshold, links). Combined with auth, scope, ordering, and downstream routing, an agent has everything needed to call this zero-parameter tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters (empty object schema), so the baseline is 4 and there is nothing for the description to clarify about parameter meaning. It correctly avoids describing nonexistent inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List all surveys of the company') and immediately narrows scope with ordering ('newest first') and the exact fields returned. It also differentiates itself from siblings by naming safe_mind_get_survey and safe_mind_get_analytics as consumers, so an agent can place it without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: 'Use it to find the surveyId needed by safe_mind_get_survey and safe_mind_get_analytics' tells the agent exactly when this tool is the right first step versus the detail/analytics tools. The prerequisite (API key via SAFE_MIND_API_KEY or safe_mind_get_api_key) is stated rather than inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_meA
Show who is connected: name and email of the account and the company (id, name, employee count) that all other tools act on. Use it to check the API key works or to confirm the company before creating anything. Read-only. Requires an API key: set SAFE_MIND_API_KEY or call safe_mind_get_api_key first. Acts on the company of the account behind the key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose the important traits: it is read-only, requires an API key, gives the env var name (SAFE_MIND_API_KEY) and the fallback call to safe_mind_get_api_key, and states its scope (the company of the account behind the key). It stops short of describing failure behavior for an invalid key beyond implying the call is the key-validity check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the return payload, then usage, then prerequisites — a sensible ordering. There is mild redundancy: "the company ... that all other tools act on" and the closing sentence "Acts on the company of the account behind the key" restate the same scoping fact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema or annotation coverage, so the description must explain returns and prerequisites — and it does, listing the identity and company fields plus the auth setup. Only the error/behavior on an invalid key is left implicit, which keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4 and there is no schema semantics to add to. The description does document the shape of the returned identity/company fields, which is useful even though parameter semantics are moot here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: it shows who is connected, naming the exact payload (account name and email, company id, name, employee count). It is clearly distinguishable from siblings like safe_mind_list_surveys or safe_mind_list_departments because it describes identity/context retrieval rather than domain listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use: "check the API key works" and "confirm the company before creating anything." It also names the alternative path for obtaining credentials (safe_mind_get_api_key) and states the scoping rule that it acts on the company behind the key, so an agent knows exactly when this tool applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_registerA
Create a new Safe Mind account together with its company. Safe Mind runs the legally required psychological risk assessment (Gefährdungsbeurteilung psychischer Belastung, GBU Psyche) for German companies. Use this only when the user has no account yet; for an existing account go straight to safe_mind_get_api_key. No API key needed. Sends a 6-digit verification code to the email address and returns a confirmation message; the account is usable after safe_mind_verify_email. For privacy the answer is the same whether or not the address is already registered. Disposable (throwaway) email addresses are rejected with an error.
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | Work email address of the person creating the account; receives the verification code. | ||
| lastName | Yes | Last name of the account owner. | |
| password | Yes | Account password: at least 8 characters with an uppercase letter, a lowercase letter and a digit. | |
| firstName | Yes | First name of the account owner. | |
| companyName | Yes | Legal name of the company the assessment is for, e.g. "Muster GmbH". | |
| employeeCount | Yes | Number of employees of the company; used for pricing and the survey participant limit. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the 6-digit email verification step, the dependency on safe_mind_verify_email before the account is usable, the privacy-preserving identical response for registered vs unregistered emails, and the disposable-email rejection error. These are non-obvious behaviors an agent could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose in the first sentence, then domain context, routing rule, auth status, flow, and edge behavior. Every sentence adds operational value with no redundant restatement of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-required-parameter mutation tool with no annotations and no output schema, the description supplies the missing pieces: auth requirements, the multi-step verification flow, and the returned confirmation message. Nothing needed to call it correctly appears to be missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters including password complexity, companyName format, and employeeCount's pricing/participant-limit purpose. The description adds little parameter-level detail beyond reiterating that the email receives the verification code, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Create a new Safe Mind account together with its company') and distinguishes itself from sibling tools by naming safe_mind_get_api_key as the path for existing accounts. An agent can tell what this does and when it is not the right tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ('only when the user has no account yet') and an explicit alternative for the opposite case ('for an existing account go straight to safe_mind_get_api_key'). Also clarifies no API key is required, removing a common pre-call uncertainty.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
safe_mind_verify_emailA
Confirm a newly registered account with the 6-digit code from the verification email sent by safe_mind_register. No API key needed. Returns a confirmation message; afterwards call safe_mind_get_api_key. A wrong or expired code returns an error without revealing whether the account exists.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The 6-digit verification code from the email, e.g. "123456". | |
| Yes | The email address used in safe_mind_register. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present the description carries the full burden, and it delivers real behavioral detail: no auth needed, a confirmation message is returned, and a wrong/expired code errors out without disclosing whether the account exists (anti-enumeration). It stops short of covering retry limits, code reuse/idempotency, or how long the code stays valid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and its input, followed by the auth note and the next-step handoff. No filler; each sentence carries a distinct fact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations, yet the description still covers the return value (a confirmation message), the auth posture, the failure mode, and the follow-up tool. Nothing an agent needs in order to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both property descriptions already state that 'code' is the 6-digit verification code and 'email' is the address used in safe_mind_register. The prose merely restates that linkage, so it adds no meaning beyond the schema baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (confirm) plus resource (a newly registered account) plus the mechanism (the 6-digit code emailed by safe_mind_register). It is immediately distinguishable from siblings because it anchors itself to the register step in the account-creation sequence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequencing: use this after safe_mind_register produced the verification email, and call safe_mind_get_api_key afterwards. It also tells the agent no API key is required for this specific call, so it won't stall on missing credentials.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
- Changed
safe_mind_create_department1 field changed- added
Input schema / properties / name / descriptionAdded value: +"Name of the area as employees know it, e.g. \"Produktion (Halle 1, 2)\" or \"Verwaltung\". Matched exactly (case-sensitive) against existing areas."
- Changed
safe_mind_create_location1 field changed- added
Input schema / properties / name / descriptionAdded value: +"Name of the site as employees know it, e.g. \"Hamburg\" or \"Werk Süd\". Matched exactly (case-sensitive) against existing locations."
- Changed
safe_mind_create_survey7 fields changed- changed
Input schema / properties / analyticsMinThreshold / descriptionPrevious value: -"Minimum group size for segmented analytics (default 7)"New value: +"Anonymity threshold: smallest group whose results are shown in segmented analytics. Minimum 5, default 7. Higher protects small teams better." - added
Input schema / properties / departments / descriptionAdded value: +"Names of the departments/areas employees choose from, e.g. [\"Produktion\", \"Verwaltung\"]. At least one. Use the exact names from safe_mind_list_departments to reuse existing areas." - added
Input schema / properties / durationWeeks / descriptionAdded value: +"Runtime in weeks. Allowed: 2 weeks up to the template maximum (currently 6). The template recommends at least 4 weeks; 2-3 weeks are accepted but not recommended (lower response rate, more groups below the anonymity threshold)." - added
Input schema / properties / employeeCount / descriptionAdded value: +"Number of employees invited to take part; also the participant limit of the survey." - added
Input schema / properties / locations / descriptionAdded value: +"Optional location names for multi-site companies, e.g. [\"Hamburg\", \"Bielefeld\"]." - changed
Input schema / properties / startDate / descriptionPrevious value: -"YYYY-MM-DD, first day of the survey"New value: +"First day of the survey as YYYY-MM-DD, e.g. \"2026-11-02\"." - added
Input schema / properties / title / descriptionAdded value: +"Survey title shown to employees. Default: \"<company> - Psychische Gefährdungsbeurteilung <year>\"."
- Changed
safe_mind_get_analytics2 fields changed- added
Input schema / properties / groupBy / descriptionAdded value: +"Optional split of the results. Omit for the overall result of the whole survey." - added
Input schema / properties / surveyId / descriptionAdded value: +"Survey id (UUID) as returned by safe_mind_list_surveys or safe_mind_create_survey."
- Changed
safe_mind_get_api_key2 fields changed- added
Input schema / properties / email / descriptionAdded value: +"Email address of the verified Safe Mind account." - added
Input schema / properties / password / descriptionAdded value: +"Password of that account."
- Changed
safe_mind_get_survey1 field changed- added
Input schema / properties / surveyId / descriptionAdded value: +"Survey id (UUID) as returned by safe_mind_list_surveys or safe_mind_create_survey."
- Changed
safe_mind_register6 fields changed- added
Input schema / properties / companyName / descriptionAdded value: +"Legal name of the company the assessment is for, e.g. \"Muster GmbH\"." - added
Input schema / properties / email / descriptionAdded value: +"Work email address of the person creating the account; receives the verification code." - added
Input schema / properties / employeeCount / descriptionAdded value: +"Number of employees of the company; used for pricing and the survey participant limit." - added
Input schema / properties / firstName / descriptionAdded value: +"First name of the account owner." - added
Input schema / properties / lastName / descriptionAdded value: +"Last name of the account owner." - added
Input schema / properties / password / descriptionAdded value: +"Account password: at least 8 characters with an uppercase letter, a lowercase letter and a digit."
- Changed
safe_mind_verify_email2 fields changed- added
Input schema / properties / code / descriptionAdded value: +"The 6-digit verification code from the email, e.g. \"123456\"." - added
Input schema / properties / email / descriptionAdded value: +"The email address used in safe_mind_register."
12 tool updates
v0.1.1- First observed
safe_mind_create_department - First observed
safe_mind_create_location - First observed
safe_mind_create_survey - First observed
safe_mind_get_analytics - First observed
safe_mind_get_api_key - First observed
safe_mind_get_survey - First observed
safe_mind_list_departments - First observed
safe_mind_list_locations - First observed
safe_mind_list_surveys - First observed
safe_mind_me - First observed
safe_mind_register - First observed
safe_mind_verify_email
TDQS
Scored across 12 tools
Each tool targets a distinct resource+action: auth lifecycle (register, verify_email, get_api_key, me), read-only listings (surveys, departments, locations), creation (department, location, survey), and result retrieval (get_survey, get_analytics). Descriptions even cross-reference the right sibling tools (e.g. list_surveys points to get_survey and get_analytics). No two tools can be reasonably confused.
Nearly all tools follow a predictable safe_mind_<verb>_<noun> pattern (list_surveys, create_department, get_analytics), and the shared prefix is applied uniformly. The only deviation is safe_mind_me, which lacks a verb and breaks the pattern slightly, plus register/verify_email omit an explicit noun.
12 tools is well within the ideal 3-15 range and each tool earns its place, covering auth, segmentation setup, survey lifecycle, and analytics without redundancy. Nothing feels padded or missing for the stated scope.
The surface covers the full intended workflow: onboarding/auth, department and location setup, survey creation and retrieval, and aggregated analytics, with idempotent creates. There is no update or delete for surveys, departments, or locations, but the descriptions explicitly note these are intentionally unavailable via the API, so the gaps are documented rather than dead ends.
Maintenance
Related MCP Connectors
MCP server for the Seline Analytics API
An MCP server for deep research or task groups
MCP server for progressive tool usage at any scale (see https://klavis.ai)
Official MCP server for Certifier to issue, manage, and track certificates and badges.
Related MCP Servers
- -
- AlicenseAqualityCmaintenanceMCP server for Webmin system administration. 61 tools across 12 modules covering system monitoring, services, users, cron, packages, files, storage (SMART + LVM), security (Fail2ban), MySQL databases, Webmin ACL, and disk quotas. Four-tier safety framework with safe mode on by default. Python, MIT license, Docker and local deployment supported.617MIT
- AlicenseNot gradedqualityCmaintenanceMCP server for Dashform (getaiform.com) - create and manage AI-powered forms, quizzes, and surveys. Supports form creation, response collection, analytics, and AI-driven form building with 15 tools across form management, response handling, and AI operations.MIT
- AlicenseNot gradedqualityBmaintenancePublic MCP server for agent-created, human-friendly, short-lived surveys. Enables agents to ask structured questions and retrieve answers.2MIT