Skip to main content
Glama

get_threat_model

Retrieve a specific threat model by its ID to analyze security risks and implement appropriate mitigations.

Instructions

Get a specific threat model by ID

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
threat_model_idYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Implementation Reference

  • MCP tool handler for get_threat_model. Retrieves a specific threat model by ID using the API client and returns the result as a string.
    @mcp.tool()
    async def get_threat_model(threat_model_id: str) -> str:
        """Get a specific threat model by ID"""
        async with create_client_from_env() as client:
            result = await client.get_threat_model(threat_model_id)
            return str(result)
  • API client helper function that performs the HTTP GET request to the Devici API endpoint for retrieving a specific threat model.
    async def get_threat_model(self, threat_model_id: str) -> Dict[str, Any]:
        """Get specific threat model by ID."""
        return await self._make_request("GET", f"/threat-models/{threat_model_id}")
  • Factory function to create the authenticated DeviciAPIClient from environment variables, used by the tool handler.
    def create_client_from_env() -> DeviciAPIClient:
        """Create API client from environment variables."""
        config = DeviciConfig(
            api_base_url=os.getenv("DEVICI_API_BASE_URL", "https://api.devici.com/api/v1"),
            client_id=os.getenv("DEVICI_CLIENT_ID", ""),
            client_secret=os.getenv("DEVICI_CLIENT_SECRET", ""),
            debug=os.getenv("DEBUG", "false").lower() == "true"
        )
        
        if not config.client_id or not config.client_secret:
            raise ValueError("DEVICI_CLIENT_ID and DEVICI_CLIENT_SECRET must be set")
            
        return DeviciAPIClient(config) 
  • Initialization of the FastMCP server instance where all tools, including get_threat_model, are registered via decorators.
    mcp = FastMCP("devici-mcp-server")
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states a read operation ('Get'), which implies it's likely safe and non-destructive, but doesn't confirm this or detail other traits like authentication needs, rate limits, error handling, or response format. For a tool with zero annotation coverage, this leaves significant gaps in understanding its behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core action and resource. There is no wasted wording, and it directly communicates the tool's function without unnecessary elaboration, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (single parameter, no nested objects) and the presence of an output schema (which handles return values), the description is somewhat complete. However, with no annotations and minimal parameter details, it lacks depth on behavioral aspects and usage context, making it adequate but with clear room for improvement.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description mentions 'by ID', which adds context that the single parameter 'threat_model_id' is an identifier for retrieval. However, with 0% schema description coverage, the schema provides no details about the parameter, and the description doesn't compensate by explaining the ID's format, source, or constraints. This meets the baseline for minimal parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'a specific threat model by ID', making the purpose immediately understandable. It distinguishes this tool from sibling tools like 'get_threat_models' (plural) by specifying retrieval of a single item. However, it doesn't explicitly contrast with other get_* tools that might also retrieve specific items by ID, keeping it from a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'get_threat_models' for listing multiple models or 'get_threat_models_by_collection' for filtered retrieval, nor does it specify prerequisites such as needing a valid threat_model_id. Usage is implied but not explicitly defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/sdelements/devici-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server