ARL-CMS MCP Server
ARL-CMS MCP Server
AKIJ Resources 규정 준수 관리 시스템 지식 기반을 stdio JSON-RPC 2.0을 통해 MCP 클라이언트(opencode, Claude 등)에 노출합니다.
제공 데이터(자체 포함, data/에 번들됨)
데이터 | 내용 |
| 584개 규정 준수 요구사항 — 80개 도메인, 11개 카테고리, 각 13개 필드(정의, 이유, 최소 요구사항, 증거, 통과 기준, 비준수 트리거, 담당자) |
| 584개 빠른 인덱스 행(이름, 도메인, 카테고리, 적용 가능성, 담당자) |
| 2,612개 방글라데시 법적 리스크 (SBU, 영역, 시나리오, 법적 근거, 패널티, 수준: Critical 340 / High 1,016 / Medium 881 / Low 375) |
| 55개 ERP 문서 유형 → Tier1 내부 정책 / Tier2 BD 법률 / Tier3 글로벌 표준 + 담당자 |
| 42개 ERP 비즈니스 문서(스키마/테이블 + 프로세스 + 세금 플래그) |
| 20개 핵심 방글라데시 법률 + 공식 bdlaws.minlaw.gov.bd 링크 |
Related MCP server: bidda-mcp
해결 규칙(3계층, 엄격한 순서)
TIER 1 — 내부 ARL 정책/SOP/매뉴얼 라이브러리(기본 소스)
TIER 2 — 방글라데시 법률(리스크 레지스터 + bdlaws 포털) — 필수 최소 기준
TIER 3 — 글로벌 표준(584개 요구사항 카탈로그)
이전 계층에서 "찾을 수 없음"은 다음 단계로 이동하기 전에 적용 범위 공백으로 보고됩니다. 방글라데시 법률은 양보할 수 없으며 내부 문서가 침묵하거나 더 약하더라도 우선합니다. 증거는 판결보다 우선합니다. 증거가 없으면 NOT DEMONSTRATED(입증되지 않음)이지 COMPLIANT(준수)가 아닙니다.
도구
도구 | 목적 |
| 584개 요구사항 카탈로그 필터링(쿼리/도메인/카테고리/담당자/적용 가능성) |
| 한 요구사항의 전체 13개 필드 상세 정보 |
| 주제에 대한 오케스트레이션된 3계층 규정 준수 해결사 |
| Tier-1 라이브러리 검색(라이브 Drive 임베디드 보기) — 찾을 수 없으면 적용 범위 공백 보고 |
| SBU/영역/주제별 방글라데시 법적 리스크 + 법적 근거 + 패널티 + 수준 |
| 20개 핵심 법률에 대한 공식 bdlaws 링크 + 메타데이터 |
| 55개 ERP 문서 유형 → 3계층 규정 준수 매핑 + 담당자 |
| 42개 ERP 비즈니스 문서 인벤토리 |
| 도메인/카테고리별 카탈로그 적용 범위 + 등록된 자산 수 |
| 적용 범위 공백 행 + 리스크 레지스터 요약 |
| CMS 인벤토리 통계 |
실행
node server-arl-cms.js환경 변수:
ARL_CMS_DRIVE_FOLDER— Tier-1 정책 라이브러리 Drive 폴더 ID 재정의(기본값1F_OGk1yzP_nf_TD8NbInJOpS-MYLR3xX)ARL_CMS_DMS_TREE— ARL-DMStree.json경로(하이브리드 통합). 설정하면cms_search_policy/ Tier-1 해결이 공유된 14,535개 항목 DMS 인덱스를 검색하고 실제 문서(이름, 경로, drive id, url, 소스)를 반환합니다. 기본 조회 순서: 환경 변수 → 형제../arl-dms/data/tree.json→ 번들된data/dms-tree.json→ 스킬 라이브러리 경로.ARL_CMS_DRIVE_FOLDER— 공유 인덱스를 찾지 못한 경우 폴백 라이브 Drive 루트.
참고 사항
설계상 읽기 전용입니다. 카탈로그 데이터를 번들하며 외부 DB가 필요 없습니다.
하이브리드 통합(옵션 5): CMS MCP는 Tier-1 문서 검색을 위해 공유 ARL-DMS 인덱스를 읽습니다. 문서 텍스트/OCR은 ARL-DMS MCP(
dms_fetch)를 통해 가져옵니다. ARL-CMS 스킬과 ARL-DMS 스킬은 이 상호 참조를 문서화합니다.단일 npm 패키지(
.tgz)로npx -y <github-release-url>을 통해 공유할 수 있습니다.
Available Tools
11 toolscms_bdlaws_actA
Return the official Bangladesh law link and metadata for the 20 registered core business/corporate acts from bdlaws.minlaw.gov.bd (Tier 2 mandatory statutory floor).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional act name filter (e.g. Labour, Companies, VAT) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden. It discloses the tool is read-only ('Return'), the data source (bdlaws.minlaw.gov.bd), and the scope (20 acts). However, it omits behavioral details such as authentication requirements, rate limits, data freshness, or whether it returns a single result or multiple matches.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. The main action and key constraints are front-loaded, achieving maximum information density in minimal space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema), the description adequately covers what it returns and its scope. It could mention whether the return is a list or single object, but overall it provides enough context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the single optional parameter with a description. The description adds context by framing the filter within the '20 registered core business/corporate acts' and provides concrete examples, enhancing the semantic value beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Return' and the specific resource: 'official Bangladesh law link and metadata for the 20 registered core business/corporate acts'. It distinguishes from sibling tools by being uniquely focused on Bangladeshi statutory laws and a fixed set of 20 acts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Tier 2 mandatory statutory floor' implies a regulatory context, but the description does not explicitly state when to use this tool versus siblings like cms_search_policy or cms_risk_lookup. No when-not or alternative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_business_documentsB
Inventory of ERP business documents (42 types) with schema/table and ERP process mapping; filter by module, process, tax.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows (default 50) | |
| query | No | Free-text search across document type / table / process | |
| module | No | Module filter (e.g. "Order-to-Cash", "Tax", "Finance", "Warehouse") | |
| process | No | ERP process filter (e.g. "order-to-cash", "procure-to-pay") | |
| tax_only | No | Return only tax-related documents |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that it is an 'inventory' which suggests read-only behavior, and the four filter parameters (module, process, tax, query, limit) imply a query/listing operation. However, it does not disclose whether the tool is idempotent, whether results are paginated, or if there are rate limits. The description offers some context but lacks behavioral specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that conveys the core functionality and filtering options efficiently. It is front-loaded with the key purpose ('Inventory of ERP business documents') and lists the filters. It could be slightly more concise by removing parenthetical '(42 types)' or reframing, but overall it is well-structured and not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should explain what the tool returns. It mentions 'schema/table and ERP process mapping' but does not detail the structure of results (e.g., a list of document objects). The tool has 5 parameters but none are required, and the description doesn't clarify default behavior (e.g., what happens if no filters are provided). It is adequate for a simple filtered listing tool but leaves gaps in return value expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 5 parameters (limit, query, module, process, tax_only) already have descriptions in the input schema. The tool description adds value by providing context for the filters (e.g., 'free-text search across document type / table / process' for query, and example values like 'Order-to-Cash' for module), which enriches the schema's minimal descriptions. However, it could further clarify interactions between parameters (e.g., how query and module combine).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool is an inventory of ERP business documents with filtering capabilities by module, process, and tax. It specifies the resource (business documents) with details like 42 types, schema/table, and ERP process mapping, which distinguishes it from sibling tools like cms_list_requirements or cms_search_policy. However, it could be more explicit about the primary action (e.g., 'list' or 'search') as the verb is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided on when to use this tool versus alternatives. The sibling tools include similar list/search operations (e.g., cms_search_policy, cms_list_requirements), but the description does not explain how this tool is different or when to choose it. For example, it could clarify that this is for ERP document metadata, not compliance checks or risk lookup, but it doesn't.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_check_complianceA
3-tier compliance resolver: (1) internal policy/SOP library, (2) Bangladesh law (risk register + bdlaws), (3) global standard (584-requirement catalog). Reports coverage gaps explicitly. Tier 2 (Bangladesh law) is the mandatory floor.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | Activity/process/method to check, e.g. "are we compliant on AML training for Finance" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations were provided, so the description must fully carry behavioral transparency. It clearly discloses the multi-tier resolution strategy and explicitly states that it reports coverage gaps. This gives the agent good understanding of what to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and front-loads the key information about the three tiers. The first sentence is dense but clear. Every phrase earns its place. Could be slightly more concise by removing the parenthetical list details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter, no output schema, and no annotations, the description provides a complete picture of what this tool does and its output (coverage gaps). It explains the multi-tier approach sufficiently for an agent to decide when to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so baseline is 3. The description adds value by explaining the topic parameter as 'Activity/process/method to check' and provides an example, but does not add additional semantics about format or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as a '3-tier compliance resolver' with explicit coverage reporting. It distinguishes from sibling tools like cms_gap_report and cms_coverage_scan by specifying the specific three tiers of sources checked.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context on when to use (to check compliance against multiple sources) and which tier is mandatory (Tier 2). However, it does not clarify when one might prefer this over the specific single-source tools like cms_bdlaws_act or cms_risk_lookup, nor does it explain when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_coverage_scanB
Library-to-standard coverage scan: maps the 584-requirement catalog domains/categories and reports counts and registered assets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavior. It mentions 'reports counts and registered assets' but doesn't state whether the scan is read-only or destructive, how long it might take (e.g., a large scan could be slow), or whether it modifies state. The lack of behavioral detail is a gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the tool's purpose. It could be slightly improved by breaking into two sentences or adding a comma after 'scan', but overall it is concise and direct.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description provides a reasonable overview. However, it doesn't mention return format (e.g., JSON structure of counts and assets) or behavior when the catalog is empty, which would help the agent understand what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100% (empty schema). The description explains the fixed scope (584-requirement catalog) and what the scan produces, adding sufficient context beyond the empty schema. There is nothing more to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it performs a coverage scan mapping 584-requirement catalog domains/categories and reporting counts/assets. This distinguishes it from sibling tools like cms_list_requirements and cms_check_compliance, though the exact output structure is vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings. For example, cms_gap_report and cms_stats might overlap; the description doesn't clarify when coverage_scan is preferred or what prerequisites exist (e.g., scanning requires pre-loaded data).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_document_complianceB
Compliance mapping for ERP document types (55 types) in 3-tier order - T1 internal policy/SOP/manual, T2 Bangladesh law, T3 global standard, plus indicative owner.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | No | Search within a compliance tier value (e.g. "Labour Act", "ISO 9001") | |
| limit | No | Max rows (default 100) | |
| owner | No | Filter by Indicative Owner (e.g. "Head of Tax", "Chief HR Officer") | |
| document_type | No | Document type filter (e.g. "Trade License", "BIN", "NID", "Employment Contract") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully convey behavioral traits. It mentions data structure (55 types, 3 tiers) but does not disclose whether the operation is read-only, what side effects occur, authentication requirements, or return format. For a tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that packs significant information (55 types, 3-tier hierarchy, owner) without redundancy. It is efficiently front-loaded, though splitting into two sentences might improve readability slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 optional parameters, no output schema, and no annotations, the description is too brief. It does not explain what the tool returns (list or single mapping), how the tiers are ordered, or what 'indicative owner' means in practice. For a compliance mapping tool, more context about output structure is essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% via parameter descriptions, providing good examples for each parameter. The tool description adds extra value by explaining the tier structure (T1 internal policy, T2 Bangladesh law, T3 global standard) and the 'indicative owner' concept, which is not present in the schema. This enriches understanding beyond the basic parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'compliance mapping for ERP document types (55 types) in 3-tier order', specifying the resource (document types), verb (mapping), and unique context (three-tier hierarchy including T1, T2, T3). This distinguishes it from sibling tools like cms_check_compliance or cms_list_requirements, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. While the description implies it's for finding which compliance tier a document type belongs to, it does not clarify when to prefer this over cms_check_compliance or cms_search_policy, nor does it provide exclusion criteria or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_gap_reportC
Coverage gap report: requirements whose domain has no candidate internal document match, plus Bangladesh risk-register summary.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows (default 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description is the sole source of behavioral context. It reveals it produces a report combining two data sources, but omits crucial details: read-only or mutating? Pagination behavior? Does it require prior calls to other tools? The lack of side-effect, auth, or response-format disclosure limits the agent's ability to predict usage consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence—efficient and to the point. It could be slightly restructured to separate the two report components, but overall it avoids wordiness. No wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having only one simple parameter, the tool's purpose is compound (gap analysis + risk register) and there is no output schema. The description does not explain what the returned data looks like, how rows are organized, or how the two parts interrelate. For a report-generating tool that seems to combine two distinct outputs, a more detailed description is warranted for correct invocation and interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'limit' parameter is fully described in the schema ('Max rows (default 50)'), so schema coverage is 100%. The description adds no additional meaning—it doesn't clarify which part of the report the limit applies to (gap rows, risk rows, or combined). Baseline of 3 is appropriate since the schema already documents the parameter adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool produces a 'coverage gap report' combining requirements with no candidate document match and a Bangladesh risk-register summary. This distinguishes it from simpler listing tools (cms_list_requirements) and single-purpose tools (cms_risk_lookup), though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus sibling tools like cms_coverage_scan or cms_risk_lookup. The description does not mention prerequisites, ordering, or scenarios where the gap report is appropriate/inappropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_get_requirementA
Get full 13-field detail of a single compliance requirement by name (what it is, why, how it should work, minimum requirements, evidence, pass criteria, non-compliance triggers, owner).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Requirement name (e.g. "Companies Act Compliance") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. It describes the tool as a 'Get' operation (read-only), which is consistent with its purpose. However, it does not disclose any behavioral traits such as whether the requirement must exist, error handling (e.g., if name not found), permissions required, or performance implications. The description is adequate but not rich beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of moderate length. It is front-loaded with the action and resource, then lists the fields concisely. No wasted words. However, it could be slightly shorter by omitting the field list (which is implied by 'full detail') or moving to a structured format, but this is not a significant issue.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 simple parameter, no output schema, no nested objects), the description is complete enough. It tells the agent what the tool does, what it returns (13 fields with examples), and how to use it (by name). While no output schema exists, the description compensates by listing the field categories. Siblings provide context for differentiation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with only one parameter ('name'). The schema already describes it as 'Requirement name (e.g. "Companies Act Compliance")'. The description adds no additional meaning beyond the schema—it only reiterates that the tool gets details 'by name'. For a single parameter with full schema coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and a clear resource ('full 13-field detail of a single compliance requirement by name'). It also enumerates the fields included (what it is, why, how it should work, minimum requirements, evidence, pass criteria, non-compliance triggers, owner), which distinguishes it from sibling tools like cms_list_requirements (which likely returns a list) and cms_check_compliance (which likely checks status).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly states when to use this tool: to retrieve full detail of a single requirement by name. It does not explicitly say when not to use it or name alternatives, but the context of sibling tools (e.g., cms_list_requirements for a list, cms_check_compliance for a compliance check) provides implicit differentiation. The 'by name' constraint is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_list_requirementsA
List/filter compliance requirements from the CMS catalog (584 requirements / 80 domains / 11 categories). Filters: query, domain, category, owner, applicability. Returns up to 200 rows.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows (default 50, max 200) | |
| owner | No | Filter by Indicative Process Owner (e.g. "Company Secretary") | |
| query | No | Free-text search across name, domain, category, applicability, owner | |
| domain | No | Filter by Domain Name (e.g. "Corporate Governance Compliance") | |
| category | No | Filter by Category (e.g. "Governance, Legal & Integrity") | |
| applicability | No | Filter by Typical Applicability / SBU |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description must fully disclose behavioral traits. It reveals the max return limit (200 rows) and the free-text search behavior ('across name, domain, category, applicability, owner'), which gives the agent a good understanding of the tool's scope and constraints. It does not mention pagination or ordering, but given the complexity (filtering tool with no destructive impact), the disclosure is strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences. The first sentence defines the action, resource, and catalog scope. The second sentence lists the filters and the max return. Every piece of information earns its place—there is no redundant or filler content. Perfectly front-loaded and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the parameter count (6, all optional), no output schema, and the straightforward nature of a filtering/list tool, the description provides sufficient context. It tells the agent what the tool does, what filters are available, and the max result count. A 5 would require additional details like default sorting, behavior when limit is exceeded, or whether filters are case-sensitive, but overall the description is complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning all 6 parameters are already documented in the input schema. The description adds minimal value beyond the schema—it lists the filter parameters but provides no additional semantic context (e.g., how filters combine—AND or OR? can multiple owners be specified?). Since schema coverage is high, baseline is 3, and the description does not earn a higher score by adding meaningful extra detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List/filter') and the resource ('compliance requirements from the CMS catalog'), and provides specific scope details (584 requirements / 80 domains / 11 categories). It distinguishes itself from siblings by explicitly naming all filterable fields and the max return limit, making it clear this is a general listing tool, unlike sibling tools like 'cms_get_requirement' (single item) or 'cms_gap_report' (analysis).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists the available filters (query, domain, category, owner, applicability), which implies when to use this tool (e.g., when you need to browse or filter requirements). However, it does not provide explicit guidance on when NOT to use this tool (e.g., when you need a single specific requirement by ID—that would be cms_get_requirement) or when alternatives like cms_search_policy or cms_risk_lookup might be more appropriate. Implied usage is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_risk_lookupB
Look up Bangladesh legal risks from the risk register (2,612 rows) by SBU, area, or topic, with specific legal basis, possible liability/penalty, and risk level.
| Name | Required | Description | Default |
|---|---|---|---|
| sbu | No | Business activity / SBU category (e.g. "A. CORPORATE, TAXATION & FINANCE") | |
| area | No | Functional / business area (e.g. "Tax (VAT)") | |
| limit | No | Max rows (default 20) | |
| topic | No | Risk scenario keyword (e.g. "cheque dishonor" or "sanctions screening") | |
| minLevel | No | Minimum risk level to return: Critical, High, Medium, Low |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It mentions the data source and output fields but omits critical details: whether filters are AND/OR, what happens when no filter is given (return all 2,612 rows?), and default pagination behavior (limit defaults to 20 per schema but not stated). This ambiguity hinders safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the core action and resource. It wastes no words, but it could be improved by structuring into distinct purpose and usage sections. Still, it is efficient and immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 optional parameters, no output schema, 10 siblings, no annotations), the description is incomplete. It lacks explanation of default behavior with no filters, output format, and whether filters are inclusive or exclusive. The mention of output fields is vague. A more complete description would cover these aspects to ensure correct agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with each parameter's purpose already clear. The description adds minimal value beyond the schema, only restating that filtering is by 'SBU, area, or topic' and listing output fields. It does not clarify parameter interactions (e.g., can they be combined?) or provide additional syntax context. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Look up Bangladesh legal risks from the risk register (2,612 rows) by SBU, area, or topic, with specific legal basis, possible liability/penalty, and risk level.' It uses a specific verb ('look up'), identifies the resource ('risk register'), and distinguishes the tool from siblings like 'cms_search_policy' or 'cms_check_compliance' by focusing on a risk register with legal details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. It does not mention prerequisites, when to avoid, or alternative tools. The use case is implied but not explicitly compared to other cms tools, leaving the agent to infer context from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_search_policyA
Search the internal ARL policy/SOP/manual library (Tier 1) for a topic. Hybrid integration: resolves real documents from the shared ARL-DMS index (14,535 entries) first, falls back to live Drive. Returns matched documents with name, path, drive id, url, source. For document text/OCR use ARL-DMS MCP dms_fetch.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max documents (default 5) | |
| topic | Yes | Topic to search, e.g. "anti bribery" or "food safety" or "leave policy" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully carries the burden of behavioral disclosure. It clearly explains the hybrid integration (tries index first, falls back to Drive) and the return format (name, path, drive id, url, source). While it doesn't explicitly state that this is a read-only operation, the search nature and fallback mechanism strongly imply no destructive side effects. A minimal score deduction for not explicitly stating read-only or potential delays from fallback.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (3 sentences) and front-loaded with the core purpose. The key instruction about document text/OCR is placed at the end, which is logical context but could be more prominent to prevent misuse. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 2 simple params and no output schema. Given the complexity, the description adequately covers the search behavior, source, and output fields. It might benefit from noting any rate limits or document count expectations, but this is a minor gap for a relatively straightforward search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by providing context for the 'topic' parameter ('e.g. "anti bribery" or "food safety" or "leave policy"'), clarifying its semantics beyond the schema's minimal description. For 'limit', it adds a default value ('5') not present in the schema. This elevates the score to 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('search', 'resolves', 'returns') and identifies the resource precisely: 'internal ARL policy/SOP/manual library (Tier 1)'. It clearly distinguishes itself from sibling tools like cms_bdlaws_act or cms_business_documents by specifying the source (ARL-DMS index) and fallback (Drive).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states the tool's scope ('internal ARL policy/SOP/manual library'), the hybrid search mechanism, and crucially tells the agent when NOT to use it: 'For document text/OCR use ARL-DMS MCP dms_fetch'. This clear redirection provides excellent decision guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cms_statsA
Return CMS inventory statistics: total requirements, domains, categories, risk register rows, document types, business documents, BD laws.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full burden. It clearly indicates this is a read-only operation returning statistics, which is appropriate. However, it does not disclose any potential limitations such as caching, data freshness, or whether the statistics reflect real-time or snapshot data. The description is straightforward but lacks depth on behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that clearly lists the output categories. It is concise and front-loaded with the tool's purpose. However, the list of categories is somewhat packed together without separators (commas or bullets), which slightly reduces readability. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has zero parameters and no output schema, so the description is the sole source of behavioral information. It adequately explains the return content, but it does not describe output format, pagination, or potential errors. Given the tool's simplicity, the description is minimally complete but could be improved by adding a note about the data being aggregated or representative.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the description does not need to explain parameter behavior. The description adds value by specifying what statistics are returned, which is meaningful context beyond the schema. With 100% schema coverage (effectively no params), a baseline of 4 is appropriate, and the description provides relevant detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns CMS inventory statistics, listing specific categories like requirements, domains, categories, risk register rows, etc. This is a specific verb ('Return') and resource ('CMS inventory statistics'), and while it doesn't explicitly differentiate from siblings, the list of statistics distinguishes it well.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the tool to use for aggregated counts or summaries rather than detailed lists. However, it provides no explicit guidance on when to use this tool versus, e.g., cms_list_requirements for a list of all requirements or cms_gap_report for a report. No alternative tools are mentioned, and no prerequisites or constraints are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v1.1.0- First observed
cms_bdlaws_act - First observed
cms_business_documents - First observed
cms_check_compliance - First observed
cms_coverage_scan - First observed
cms_document_compliance - First observed
cms_gap_report - First observed
cms_get_requirement - First observed
cms_list_requirements - First observed
cms_risk_lookup - First observed
cms_search_policy - First observed
cms_stats
TDQS
Scored across 11 tools
Most tools have distinct purposes (listing requirements, getting detail, checking compliance, searching policy, etc.). However, cms_list_requirements and cms_coverage_scan both deal with the 584-requirement catalog and domains, which could cause some confusion—cms_coverage_scan specifically reports domain/category counts and assets, but the distinction may not be immediately clear to an agent.
All tools follow a consistent and informative prefix pattern: cms_ followed by a verb_underscore_noun (e.g., cms_list_requirements, cms_check_compliance, cms_get_requirement). This makes it easy to predict tool behavior from the name alone.
With 11 tools, the server is well-scoped. Each tool addresses a specific compliance-related task or query, and the number feels appropriate for the domain—neither too sparse nor overwhelming. The tool count supports effective navigation without redundancy.
The tool surface covers the main compliance workflow: listing/fetching requirements, checking compliance against multiple tiers, searching internal policies, looking up risks, and mapping documents. Minor gaps exist—for example, there is no tool to add or update requirements or internal policies, and no direct way to fetch full document content (but that is handled by another MCP server).
Maintenance
Related MCP Connectors
The Compliance Knowledge Marketplace. Accessible to people and AI. Find it on Complyzard.
10,065 source-verified compliance nodes, 39 pillars, 25 MCP tools (EU AI Act, GDPR, NIST, MITRE).
Company-specific regulatory assessments for concrete business questions, as structured data or PDF.
Cited EU & global law, regulations & security frameworks via Ansvar Gateway. OAuth, free + paid.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables querying US compliance regulations including HIPAA, CCPA, SOX, and more directly from AI assistants and MCP-compatible clients.81 npmApache 2.0
- AlicenseAqualityDmaintenanceSource-verified regulatory and compliance intelligence: 10,000+ obligations across 39 pillars, each grounded in a primary legal source with a content hash. Covers the EU AI Act, GDPR, DORA, NIS2, HIPAA, Basel III and the MITRE ATT&CK/ATLAS families.251MIT
- AlicenseNot gradedqualityBmaintenanceProvides AI assistants with verified regulatory data from 850+ official sources across 50+ jurisdictions, enabling accurate compliance research.MIT
- AlicenseAqualityAmaintenanceProvides retrieval-grounded, citation-verified access to Philippine law and compliance, including statutes, jurisprudence, and government issuances across 15 compliance domains.191Apache 2.0