Skip to main content
Glama
Drata MCP Server

Drata MCP Server

Drata MCP Server

A Model Context Protocol (MCP) server that connects Claude to your Drata compliance platform. Designed for SOC2 Type II audit preparation and ongoing compliance monitoring.

What it does

This MCP server gives Claude direct access to your Drata data, allowing you to:

  • Monitor compliance status - Get real-time summaries of controls, tests, and personnel compliance

  • Track failing tests - Identify which automated monitors are failing and why

  • Review controls - See which controls need attention (missing evidence, no owner, not ready)

  • Check personnel compliance - Find employees with device compliance issues

  • Prepare for audits - Generate comprehensive audit readiness reports

Related MCP server: clio-mcp

Tools Available

Tool

Description

get_compliance_summary

Dashboard overview of all compliance areas

list_controls

List controls with optional search and filtering

list_controls_with_issues

Controls that need attention (NOT_READY, NO_OWNER, NEEDS_EVIDENCE)

get_control_details

Detailed info about a specific control including linked monitors

get_monitors_for_control

All tests linked to a specific control

list_monitors

All automated monitoring tests with status summary

list_failing_monitors

Tests currently failing - critical for SOC2

list_personnel

Personnel with compliance status

list_personnel_with_issues

Personnel with device compliance problems

list_policies

Company policies with version info

list_pending_policy_acknowledgments

Policies awaiting user acknowledgment

list_connections

Integration status (GitHub, AWS, etc.)

list_vendors

Third-party vendors

list_devices

Registered devices

Installation

# Clone the repository
git clone https://github.com/sderosiaux/drata-mcp.git
cd drata-mcp

# Create virtual environment and install
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
pip install -e .

# Configure your API key
cp .env.example .env
# Edit .env and add your DRATA_API_KEY

Get your Drata API Key

  1. Log into Drata

  2. Go to Settings → API Keys

  3. Click Create API Key

  4. Copy the key to your .env file

Usage with Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
  "mcpServers": {
    "drata": {
      "command": "/path/to/drata-mcp/.venv/bin/python",
      "args": ["-m", "drata_mcp.server"],
      "cwd": "/path/to/drata-mcp"
    }
  }
}

Then restart Claude Desktop.

Example Prompts

Once configured, you can ask Claude:

  • "What's my Drata compliance status?"

  • "Show me failing tests"

  • "Which controls need attention?"

  • "List personnel with device issues"

  • "Prepare me for the SOC2 audit"

  • "What tests are linked to control DCF-71?"

Development

# Install dev dependencies
pip install -e ".[dev]"

# Run tests
pytest tests/ -v

Requirements

  • Python 3.11+

  • Drata account with API access

  • Claude Desktop (for MCP integration)

License

MIT

Available Tools

21 tools
get_compliance_summaryB

Get overall compliance dashboard summary.

Returns: Aggregated view of compliance status across all areas

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, but the tool has zero parameters, meaning there is effectively no mutation or side-effect surface to disclose. The description does convey the aggregation scope ('across all areas'), yet it says nothing about whether the result is cached, permission-gated, or time-scoped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the purpose. The 'Returns:' line is somewhat redundant given a full output schema exists, costing it the top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A zero-parameter read tool with an output schema that documents the return shape needs little prose. The only real gap is the absence of any signal about where this fits relative to the list/detail siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema defines no parameters, so per the baseline this is a 4. There is nothing param-related for the description to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Get overall compliance dashboard summary' — and the aggregate framing distinguishes it from the many list_* siblings. It stops short of naming a sibling or scope constraint, so differentiation is inferable rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no conditions, and no mention of alternatives among the 20 list/detail siblings. An agent must guess that this is the high-level overview rather than opening one of the list_* tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_control_detailsA

Get detailed information about a specific control.

Args: control_code: The control code (e.g., "DCF-71", "DCF-12")

Returns: Full control details including linked monitors

NameRequiredDescriptionDefault
control_codeYes

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It does disclose output content ('Full control details including linked monitors') and is evidently a read operation, but it says nothing about permissions, error behavior for unknown codes, or rate limits; an output schema already exists, so the Returns line is partly redundant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, and the Args/Returns structure is scannable with no filler. The docstring-style framing is slightly verbose but every line earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema, the description covers what is fetched and what comes back. Given the output schema handles return detail and there are no annotations, remaining gaps (auth, errors, code format validation) are minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does: it names the parameter and provides concrete format examples ('DCF-71', 'DCF-12'). This adds real meaning beyond the bare string type in the schema, though it stops short of stating whether the code is case-sensitive or validated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Get detailed information about a specific control'), clearly distinct from the sibling list_controls. However, it never names or contrasts with siblings like get_monitors_for_control, which also retrieves control-related detail, so differentiation is only partial.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'a specific control' plus the required control_code implies you must already know the identifier, which hints at usage. But there is no explicit when-to-use guidance, no prerequisites, and no routing to alternatives such as list_controls for discovery.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_monitor_detailsB

Get detailed information about a specific monitor/test.

Args: monitor_id: The monitor ID

Returns: Full monitor details including failure reasons and remediation

NameRequiredDescriptionDefault
monitor_idYes

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the return payload ('failure reasons and remediation'), which is useful context, but says nothing about permissions, read-only nature, or pagination/limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Short and front-loaded, with a conventional Args/Returns layout. The Args block is slightly redundant for a one-parameter tool, but there is no filler prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so spelling out the return payload is arguably unnecessary; the real gap is that an agent gets no guidance on where the monitor_id comes from or what a not-found result means for a detail-fetch tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single monitor_id parameter, and the description only restates it tautologically ('monitor_id: The monitor ID'). It adds no format, sourcing, or relationship guidance (e.g., that the ID comes from list_monitors).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get detailed information about a specific monitor/test') and the singular scope distinguishes it implicitly from list_monitors/list_failing_monitors. It does not explicitly name a sibling, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: you need a monitor_id and want detail. There is no statement of when to prefer this over list_monitors, get_monitors_for_control, or list_failing_monitors, and no prerequisites are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_monitors_for_controlB

Get all monitors (tests) that affect a specific control.

Args: control_code: The control code (e.g., "DCF-71")

Returns: List of monitors linked to this control

NameRequiredDescriptionDefault
control_codeYes

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the return content ('List of monitors linked to this control') and 'Get' implies a read-only operation, but it says nothing about permissions, pagination, rate limits, or behavior when the control code is unknown. Adequate but thin for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Short and front-loaded: the purpose sentence comes first, followed by compact Args/Returns sections. The Returns block is somewhat redundant given an output schema exists, but nothing is bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema already covering the return shape, the description supplies everything needed to call it correctly: the resource, the scoping, and an example identifier format. The main omission is routing guidance among the many sibling list_* tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema only labels the field 'Control Code'. The description compensates with a concrete example format ('DCF-71'), which is genuinely useful for constructing a valid call, but adds no validation rules, lookup hints, or case-sensitivity notes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Get) and resource (monitors/tests) with an explicit scope qualifier ('that affect a specific control'), which implicitly distinguishes it from the sibling list_monitors (all monitors). It never names a sibling outright, so differentiation is inferable rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of alternatives such as list_monitors or get_control_details, and no prerequisite or exclusion statements. The only hint of context is that the caller must supply a control code.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_personnel_detailsB

Get detailed personnel compliance information.

Args: personnel_id: Personnel ID

Returns: Full personnel details with compliance checklist

NameRequiredDescriptionDefault
personnel_idYes

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Get' implies a read-only retrieval and it discloses the response contains a compliance checklist, which is modest added context, but it says nothing about permissions, data freshness, or volume — leaving real gaps for an annotation-free tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is short and front-loaded, with the core purpose stated first. The Args/Returns block is slightly redundant since both the parameter and the return are already covered by the input and output schemas, but the structure is clean and not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to explain return values, and for a single mandatory parameter tool the essentials are covered. However, the absence of any usage guidance alongside numerous list_personnel siblings leaves a real routing gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single parameter is documented only as 'personnel_id: Personnel ID', which merely restates the name and type from the schema. No source, format, or valid-range information is added to help the agent supply a usable ID.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Get detailed personnel compliance information'), which is clearer than a bare 'get personnel'. It follows the get_X_details naming convention shared with get_control_details and get_monitor_details, but it never explicitly distinguishes itself from the many list_personnel* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of prerequisites, and no reference to an alternative such as list_personnel or list_personnel_with_issues. The agent must infer usage purely from the naming pattern.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_assetsB

List all assets in the asset inventory.

Args: asset_type: Filter by type - PHYSICAL, VIRTUAL, CLOUD, DATA, PERSONNEL

Returns: List of assets with details

NameRequiredDescriptionDefault
asset_typeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full behavioral burden and discloses almost nothing: no read-only confirmation, no permission requirements, no pagination or result-size behavior. "Returns: List of assets with details" is the only behavioral statement, and an output schema already covers return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action in the first sentence, with parameter and return details in compact labeled blocks. The Returns section is largely redundant given an output schema exists, costing a little space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter list tool with an output schema available, the description covers the action, the filter, and its valid values. Remaining unknowns (pagination, permissions) are secondary for a read-only enumeration.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema's anyOf string/null gives no constraint, so the description's enumeration of PHYSICAL, VIRTUAL, CLOUD, DATA, PERSONNEL is genuinely load-bearing — it is the only source of the allowed values. It does not state that the parameter is optional, which the schema default partially implies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"List all assets in the asset inventory" gives a clear verb and resource, and the asset domain distinguishes it from siblings like list_controls, list_policies, and list_personnel. It stops short of naming a specific alternative to route against, but the resource is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no when-to-use context, no prerequisites, and no mention of sibling tools such as list_personnel or list_devices that also enumerate inventory-like entities. An agent must infer applicability purely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_connectionsC

List all integrations/connections and their status.

Args: limit: Max results

Returns: List of connections with sync status

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read operation and mentions sync status, but says nothing about pagination despite a limit parameter, permissions required, or whether results are cached/eventually consistent. For a tool with zero annotation coverage this is thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Short and front-loaded, with the purpose in the first line and Args/Returns clearly separated. The docstring scaffolding is slightly heavier than needed for one optional parameter, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the brief Returns line is a bonus rather than a necessity. However, with no annotations and no pagination or permission context, the definition is only minimally sufficient for an agent to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the single parameter; it does so minimally with 'limit: Max results', which clarifies intent but omits the schema's default of 50 and any valid range. It adds marginal value beyond the parameter name rather than full semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List all integrations/connections') plus a scope detail ('and their status'), which is enough to separate it from the many sibling list_* tools targeting other resources. It does not explicitly name a sibling or contrast itself with one, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus alternatives, no prerequisites (e.g., auth/connection requirements), and no mention of when the result would be empty or how it relates to other listing tools. The agent is left to infer usage entirely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_controlsB

List ALL compliance controls with optional search.

Args: search: Search term for control name/description only_issues: If True, only show controls with problems (not ready, no owner, no evidence)

Returns: List of controls with their status and details

NameRequiredDescriptionDefault
searchNo
only_issuesNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'List' implies a read-only operation and only_issues usefully defines what counts as an issue (not ready, no owner, no evidence), but pagination, result limits, and any auth/permission requirements are unmentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose followed by compact Args and Returns sections; every line earns its place. The Returns section is slightly redundant given an output schema exists, but it is short and harmless.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A 2-parameter, all-optional list tool with an output schema, so return values need not be explained. Still missing is the differentiation from list_controls_with_issues and any pagination/limit behavior, which matters for an unfiltered 'list ALL' tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (only bare titles 'Search' and 'Only Issues'), so the description must compensate and largely does: it defines search as matching control name/description and spells out the three conditions that make only_issues true. Minor gaps remain (no matching semantics for search, e.g. substring vs exact).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb and resource ('List ALL compliance controls') with scope emphasis on ALL and an optional search qualifier. It does not, however, distinguish itself from the sibling 'list_controls_with_issues', which overlaps directly with the only_issues parameter described here.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus the many siblings. The only_issues parameter duplicates the apparent purpose of the sibling 'list_controls_with_issues', yet the description never explains the relationship or when to prefer one over the other.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_controls_with_issuesA

Get controls that are NOT OK / have problems / need attention.

Use this tool when user asks for:

  • "controls pas bon" / "bad controls" / "failing controls"

  • "controls with issues" / "problematic controls"

  • "controls that need work" / "controls à corriger"

Returns controls with status: NOT_READY, NO_OWNER, or NEEDS_EVIDENCE.

Returns: Controls with compliance issues and their status

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral load. It discloses the returned statuses (NOT_READY, NO_OWNER, NEEDS_EVIDENCE) and frames them as compliance issues, which is useful context. However, it does not state that the operation is read-only, whether specific permissions are needed, or how results are ordered/paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded, and the example trigger list helps an agent match user phrasing. However, the final 'Returns:' block restates the earlier status list, which is a minor redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be detailed; the description still names the statuses, which is harmless. With zero parameters and a clear trigger context, an agent has enough information to call it correctly, missing only an explicit contrast with list_controls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. There are no parameter semantics to explain, and the description adds no parameter information because none exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('controls') with a clear filter criterion (NOT OK / have problems / need attention). The enumerated statuses (NOT_READY, NO_OWNER, NEEDS_EVIDENCE) make it distinguishable from the sibling list_controls, which presumably returns all controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit trigger phrases in English and French (e.g., 'bad controls', 'controls à corriger'), telling the agent exactly when to select this tool. It does not name alternatives like list_controls or state when not to use it, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_devicesC

List all registered devices.

Args: limit: Max results

Returns: List of devices with compliance status

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a read via 'List', but says nothing about pagination, ordering, whether results are filtered by user/permission scope, or what happens when limit is exceeded.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core sentence is front-loaded and tight, but the 'Args:'/'Returns:' boilerplate is low-value: the Args line is tautological and the Returns line duplicates information an output schema already provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return value need not be re-explained, and the tool is a simple one-param list. Still, the description omits scoping, pagination behavior, and ordering, which an agent needs to invoke it correctly among many similar list tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single parameter is documented only as 'Max results', which merely restates the name 'limit'. No default (50), no bounds, no interaction with pagination are conveyed, so the description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (registered devices), which is a distinct noun from most siblings. It does not differentiate itself from adjacent siblings like list_assets, where the boundary between 'devices' and 'assets' is left for the agent to guess.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus the many other list_* siblings, and no statement of prerequisites or scope (tenant-wide, workspace, etc.). The agent must infer usage purely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_eventsA

List compliance events from the audit log.

Note: Due to API limitations, events are returned in chronological order (oldest first).

Args: limit: Number of events to return (default 50) category: Filter by category - PERSONNEL, CONTROL, MONITOR, CONNECTION, POLICY, VENDOR

Returns: Events with details

NameRequiredDescriptionDefault
limitNo
categoryNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses a genuine behavioral constraint — events are returned oldest-first due to API limitations — which is exactly the kind of trait an agent cannot infer. However, it omits read-only nature, pagination behavior, and auth/permission needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads purpose, then the ordering caveat, then Args and Returns — well structured and free of filler. The 'Returns: Events with details' line is thin but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with an output schema present, return-value detail is not required. The description supplies the parameter meanings and the ordering caveat, leaving only minor gaps like pagination and permission requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does: it documents 'limit' (default 50) and enumerates the six valid category values (PERSONNEL, CONTROL, MONITOR, CONNECTION, POLICY, VENDOR), which the schema itself does not provide. Only the category null/default behavior is left implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('List compliance events from the audit log'), which is clear and unambiguous. There is no other events-listing sibling to differentiate from, but the description doesn't proactively position it against related tools like list_evidence or get_compliance_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource (audit-log events) but there is no explicit when-to-use or when-not-to-use guidance. No alternative tool is named, so the agent must infer this is the sole events entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_evidenceA

List ALL evidence in the evidence library.

Returns evidence documents uploaded to Drata for compliance.

Returns: List of evidence with details and versions

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; 'List' weakly signals a read-only operation and the text adds useful domain context ('uploaded to Drata for compliance') plus return content. However it says nothing about pagination, result volume, or auth for a tool that returns everything in a library, which are meaningful gaps for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, all front-loaded, with the scope declaration first. Minor overlap between 'evidence in the evidence library' and 'evidence documents uploaded to Drata', but nothing that wastes an agent's attention.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail need not be explained, and there are no parameters or annotations to cover. The description is nearly complete for this tool; only pagination/volume behavior for a full-library listing is unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema defines zero parameters, so there is nothing to disambiguate; the baseline for a parameterless tool is 4. The description adds no parameter information, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (evidence in the evidence library) with an ALL scope qualifier that implicitly contrasts with the filtered sibling list_expiring_evidence. It does not name that sibling outright, so it stops short of a 5-level differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'ALL' implies this is the unfiltered enumeration, which hints at when to prefer it over list_expiring_evidence, but no alternative is named and no exclusions, prerequisites, or context are stated. Usage is inferable rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_expiring_evidenceB

List evidence that hasn't been updated recently and may need renewal.

Args: days: Consider evidence stale if not updated in this many days (default 30)

Returns: Evidence that may need to be renewed

NameRequiredDescriptionDefault
daysNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses the staleness rule and the 30-day default threshold, and 'List' implies a safe read with no side effects. However, it says nothing about permissions, result ordering, or volume/pagination for what could be a long list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The Args/Returns pseudo-docstring formatting is readable and the core purpose is front-loaded, but the 'Returns:' line merely restates the opening sentence ('may need renewal') and duplicates information already carried by the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter list tool with an output schema present, the description is adequate: purpose, the one parameter, and the default are all covered. The redundant Returns section adds nothing, and the lack of any sibling differentiation leaves a minor routing gap against list_evidence.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (the schema only says integer 'Days' with default 30), so the description must compensate, and it does: 'days' is defined as the staleness threshold, not just a count. The default is also echoed from the schema, which is mildly redundant but not harmful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource plus a scope qualifier: evidence 'that hasn't been updated recently and may need renewal.' This is meaningfully distinct from the sibling list_evidence, but the description never names that sibling or explicitly contrasts the two scopes, so the agent must infer the routing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'may need renewal' implies the renewal-audit use case, but there is no explicit when-to-use, when-not-to-use, or alternative (e.g., list_evidence for the full inventory). Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_failing_monitorsA

Get all FAILED automated monitoring tests - critical for SOC2.

Returns: List of failing tests that need remediation

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral burden; 'Get' implies a safe read, and it tells the agent the results are failing tests needing remediation. It does not disclose whether results cover all controls, pagination, or how 'failing' is determined, so the coverage is only partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short lines with the purpose and filter front-loaded; the 'Returns:' block is largely redundant given an output schema exists, but overall the text wastes little space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless read tool with an output schema, the description supplies the essential purpose and the SOC2 motivation. It is nearly complete, missing only explicit sibling routing and any note on scope/pagination.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there are no parameter semantics to explain; the baseline for a parameterless tool is 4. Nothing in the description contradicts or confuses the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') plus resource ('automated monitoring tests') and a hard filter ('FAILED'), which implicitly separates it from the sibling 'list_monitors'. It does not, however, explicitly contrast itself with 'list_monitors' or 'get_monitors_for_control'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'critical for SOC2' hints at the compliance-reporting context where this is useful, but there is no explicit when-to-use rule, no prerequisites, and no named alternative (e.g. 'use list_monitors for the full inventory'). Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_monitorsC

List ALL automated monitoring tests.

Args: status: Filter - PASSED, FAILED, NOT_TESTED

Returns: List of monitoring tests with status summary

NameRequiredDescriptionDefault
statusNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It states the return shape in one phrase but discloses nothing about pagination, volume, auth/permission requirements, or ordering — significant gaps for a tool that enumerates all monitors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in a single sentence, and the Args/Returns blocks are short. Mild waste in a 'Returns' line that restates what the output schema already provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return format needn't be spelled out, yet the description includes a redundant Returns line while omitting usage routing and behavioral context. Adequate for a trivial single-param list tool but with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the schema defines status with no enum, so the description's 'PASSED, FAILED, NOT_TESTED' is genuinely additive — it supplies the allowed values the schema omits. It does not, however, explain behavior when status is omitted or null.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List ALL automated monitoring tests') with a clear scope qualifier ('ALL') that implicitly contrasts with the filtered sibling list_failing_monitors. However, it never names the sibling or explains how this differs from get_monitors_for_control, so differentiation must be inferred.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance is given. Given siblings like list_failing_monitors and get_monitors_for_control, an agent would benefit from knowing this is the unfiltered full enumeration, but the description leaves that to inference ('ALL' is the only hint).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_pending_policy_acknowledgmentsC

Get policies pending user acknowledgment.

Args: limit: Max results

Returns: List of unacknowledged policy assignments

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Get' implies a read-only operation and 'unacknowledged policy assignments' hints at the scope of returned data, but there is no mention of permissions, pagination beyond the limit param, or what an acknowledgment state means.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very tight, with an Args/Returns structure that front-loads the core purpose. No wasted text, though the Returns line is largely redundant given an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the tool is a simple single-parameter list. The main gap is the absence of usage guidance and sibling differentiation relative to list_policies.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (the single 'limit' parameter has only a type, title, and default). The description compensates with 'limit: Max results', conveying the parameter's meaning that the schema fails to document. Minimal but adequate for one obvious parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Get policies pending user acknowledgment.' An agent understands this returns policy assignments awaiting acknowledgment, which implicitly differs from the generic list_policies sibling. However, it never names or contrasts that sibling, so the differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use context, no prerequisites, and no mention of the closely related list_policies tool. An agent must guess whether this is the right entry point versus listing all policies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_personnelB

List ALL personnel with compliance status.

Args: employment_status: Filter - CURRENT_EMPLOYEE, CURRENT_CONTRACTOR, FORMER_EMPLOYEE, FORMER_CONTRACTOR

Returns: Personnel list with compliance status

NameRequiredDescriptionDefault
employment_statusNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the returned content (compliance status) and the filtering dimension, but says nothing about pagination, result limits, or auth requirements for a tool that returns a full personnel roster.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose sentence followed by a compact Args/Returns block with no filler. The 'Returns: Personnel list with compliance status' line restates the opening sentence, which is mild but harmless redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be re-explained, and the single parameter is fully documented with its value set. For a low-complexity read-list tool the description is largely complete, with pagination semantics being the main remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the schema declares employment_status as a bare anyOf string/null with no enum, so the description adds real value by enumerating the four accepted values (CURRENT_EMPLOYEE, CURRENT_CONTRACTOR, FORMER_EMPLOYEE, FORMER_CONTRACTOR) that the schema omits.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb+resource: 'List ALL personnel with compliance status.' The 'ALL' scoping implicitly distinguishes it from the sibling list_personnel_with_issues, but it never names that sibling or any other, so differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of alternatives such as list_personnel_with_issues or get_personnel_details. The only hint is the word 'ALL', which is scope rather than routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_personnel_with_issuesB

Get personnel with compliance issues (failing devices).

Returns: Personnel with failing device compliance

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It clarifies what 'issues' means (failing device compliance) but says nothing about scope (tenant-wide? all personnel?), pagination or result limits, whether personnel with zero enrolled devices are included, or any auth context for an access-control dataset. For a tool with zero annotation coverage this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded lines with no filler, and the qualification '(failing devices)' is placed immediately after the term it disambiguates. The 'Returns:' line largely restates the first sentence and duplicates what the existing output schema already conveys, which is the only (minor) waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return structure needn't be described, and a zero-parameter tool is inherently simple. Still, with no annotations the description should have covered scope, pagination/limits, and whether the list is tenant-wide; those omissions leave an agent slightly unsure what the result set represents.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is no parameter semantics to explain and the baseline of 4 applies. The description correctly adds nothing about inputs, which is consistent with the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb+resource+qualifier: get personnel filtered to those with compliance issues, and it defines the qualifier as '(failing devices)'. It does not explicitly name the sibling it contrasts with (e.g. list_personnel for the unfiltered list, or list_failing_monitors for the device-level view), so sibling differentiation is only implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: an agent can infer this is the filtered counterpart to list_personnel and that it should be chosen when the question is 'who has a compliance problem'. There is no explicit when-to-use/when-not-to-use statement and no alternative tool is named, which is why this stays at minimum-viable rather than 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_policiesB

List all company policies.

Args: limit: Max results

Returns: List of policies with version info

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses that results are policy records carrying version info, which is useful, but says nothing about permissions, pagination behavior, or whether 'all' is truly exhaustive. It is adequate for a simple read tool but leaves clear gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The Args/Returns layout is compact and front-loaded, with the core purpose in the first sentence. No sentence is wasted, though the Returns line duplicates what the output schema already provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description correctly stays brief. But given a sibling-heavy toolset and no annotations, it should at least state the tool's scope relative to list_pending_policy_acknowledgments.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single parameter, so the description must compensate and it barely does: 'limit: Max results' essentially restates the parameter name. It omits the default of 50 and any guidance on acceptable ranges or pagination interaction.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List all company policies'), so an agent immediately knows the operation. However, it does not differentiate from siblings such as list_pending_policy_acknowledgments or list_controls, so the agent must infer scope from the name alone. 'All' also sits awkwardly beside a limit parameter.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the many sibling list_* tools, nor any prerequisite or context. The description never states that this is the unfiltered policy inventory and that acknowledgment data lives in list_pending_policy_acknowledgments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_usersB

List all Drata users in your organization.

Returns: List of users with their roles

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden, but for a zero-argument list call the risk surface is small. It does disclose scope ('all ... in your organization', implying no filtering) and the returned fields (users with roles), though it omits pagination and permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action in one sentence, followed by a short returns note. Minor waste: the Returns block partly duplicates what the output schema already provides.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-param read tool with an output schema present, the description covers what is needed. The missing element is sibling differentiation, which matters given the large family of list_* tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly does not invent any parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (Drata users) scoped to the organization, so intent is unambiguous. However, it never differentiates from adjacent siblings such as list_personnel, which a Drata user could reasonably confuse with users.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of alternatives like list_personnel or get_personnel_details. The agent is left to infer the use case entirely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_vendorsC

List all vendors.

Args: limit: Max results

Returns: List of vendors

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implicitly suggests a read ('List'), mentions that 'limit' caps results, and defers returns to the output schema, but discloses nothing about pagination behavior, total counts, auth requirements, or what happens when limit is omitted (beyond the schema default of 50).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is short and front-loaded with the primary action, and the Args/Returns block is conventional rather than rambling. It is slightly padded by restating the return value, which the output schema already covers, but nothing is genuinely wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one optional parameter) and an output schema exists, so return-value detail can be omitted. What remains missing for a list tool is pagination/result-limit semantics beyond the bare parameter line, which leaves the agent guessing about the size and shape of the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the single undocumented parameter. 'limit: Max results' only restates the schema's title, adding no unit, range, or interaction detail (e.g., whether it truncates silently or paginates), and it never mentions the default of 50.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('List all vendors'), so an agent can tell it reads a vendor collection. However, it offers no differentiation from the many sibling list_* tools (list_users, list_devices, list_assets) beyond the resource noun, and never says what a vendor is in this system or whether the list is paginated or filtered.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance at all: no stated conditions, no prerequisites, and no mention of alternatives such as get_control_details-style detail tools or any filtered vendor variant. The agent must infer usage purely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 21 tool updatesv0.1.0
    • First observedget_compliance_summary
    • First observedget_control_details
    • First observedget_monitor_details
    • First observedget_monitors_for_control
    • First observedget_personnel_details
    • First observedlist_assets
    • First observedlist_connections
    • First observedlist_controls
    • First observedlist_controls_with_issues
    • First observedlist_devices
    • First observedlist_events
    • First observedlist_evidence
    • First observedlist_expiring_evidence
    • First observedlist_failing_monitors
    • First observedlist_monitors
    • First observedlist_pending_policy_acknowledgments
    • First observedlist_personnel
    • First observedlist_personnel_with_issues
    • First observedlist_policies
    • First observedlist_users
    • First observedlist_vendors

TDQS

B3.2/5.0

Scored across 21 tools

Disambiguation3/5

Tools are mostly distinct by resource, but list_controls_with_issues and list_failing_monitors duplicate functionality already available via filters on list_controls and list_monitors, creating overlap. Descriptions attempt to guide usage, but an agent may still struggle to choose the right tool for issue-focused queries.

Naming Consistency4/5

Almost all tools follow a snake_case verb_noun pattern (list_* for collections, get_* for details). Minor deviation: get_monitors_for_control uses get_ for a list operation, and some list_* names include qualifiers, but the convention is predictable.

Tool Count3/5

21 tools is at the upper end of reasonable for a compliance platform covering many resource types. However, the count is inflated by redundant issue-specific aliases, making the set feel heavier than necessary.

Completeness3/5

The server covers major compliance entities and includes detail endpoints for controls, monitors, and personnel. Yet many resources (policies, vendors, devices, evidence, assets, users) are list-only, and no mutation tools exist, leaving notable gaps for deeper investigation or remediation workflows.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    Not graded
    maintenance
    Connects Claude AI to Google Search Console with OAuth 2.0 authentication, enabling users to analyze search performance, inspect URLs, manage sitemaps, and export analytics data through natural language conversations.
    2
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Connects Claude to Clio practice management, enabling AI-assisted access to matters, contacts, documents, tasks, and billing with audit logging and encryption for law firm compliance.
    440 npm
    27
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Connects Claude to OCI Logging Analytics for natural language querying and analysis of security logs, including detection catalog, MITRE ATT&CK integration, and cross-log correlation.
    2
    MIT