Skip to main content
Glama
Sign In
Threat Modeling MCP Server

Threat Modeling MCP Server

by residentevilrenz
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

manage_asset_flows

Create, update, list, retrieve, and delete assets and the data flows that connect them for threat modeling, with batch operations and filtering.

Instructions

Manage assets and the flows that carry them.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "action": "<action>"
    },
    "name": "manage_asset_flows"
  }
}

Input Schema

NameRequiredDescriptionDefault
itemsNoBatch records for add or update
actionYesOperation: describe, add, update, list, get, delete, or clear
valuesNoFields for one record or optional list filters
item_idNoAsset or flow ID for one get, update, or delete
sectionNoAsset-flow section: assets, flows, or allall
item_idsNoAsset or flow IDs for batch delete

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

C2.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full behavioral burden, and it discloses nothing. It never mentions that the tool can delete or clear records (irreversible operations present in the action enum), what permissions are needed, or what side effects add/update have on related flows.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no wasted words, but the brevity comes from under-specification rather than discipline. Nothing is front-loaded because there is essentially nothing to front-load.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters, seven distinct actions, and destructive operations like delete and clear, the description says nothing about mode behavior, required field combinations per action, or safety. An output schema exists, so return values need not be explained, but the action model remains entirely undisclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter including the action enum, section, items, values, item_id, and item_ids is already documented in the schema. The description adds no semantics beyond that, which is the baseline 3 case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Manage assets and the flows that carry them" restates the tool name (manage_asset_flows) with only a modest domain gloss. "Manage" is a catch-all verb that could mean any of the seven actions in the schema, and nothing distinguishes this tool from siblings like manage_architecture or manage_workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of prerequisites, and no routing to or away from alternatives. An agent must infer entirely from the enum of actions that this is the CRUD entry point for the asset/flow section.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools