Skip to main content
Glama

finos-mcp

Lets AI assistants look things up in three open financial-industry standards, accurately and without being able to change anything.

ci PyPI Python License tests coverage tools recall@5 hallucinated ids

Start with a question

What you want to do

Pick this server

See it work

Find AI governance risks and controls with traceable references

AIGF

Governance example

Understand a trade field or validate CDM JSON

CDM

CDM example

Find the right desktop intent for a financial instrument

FDC3

FDC3 example

Official MCP Registry (published v0.3.2): AIGF · CDM · FDC3. All three are local stdio packages, not public hosted endpoints.

Claude Code quick connect: With Claude Code and uv installed, run one of the following commands for the standard you need:

claude mcp add --scope user finos-aigf -- uvx --python 3.12 finos-mcp-aigf==0.3.2
claude mcp add --scope user finos-cdm -- uvx --python 3.12 finos-mcp-cdm==0.3.2
claude mcp add --scope user finos-fdc3 -- uvx --python 3.12 finos-mcp-fdc3==0.3.2

Run claude mcp list and then ask your assistant to use get_control (AIGF), describe_type (CDM), or suggest_intent (FDC3). The client setup guide also provides tested JSON configuration examples for Claude Desktop, VS Code and Copilot, with troubleshooting for Windows and macOS.

To see a real MCP call without a model or API key, clone this repository, run uv sync --all-packages, then try:

uv run --no-sync python examples/try_it.py aigf

Choose either of the other two servers in the tested example recipes. This is independent community software, not an official FINOS product.

Related MCP server: osdu-mcp

What is this?

Banks and other financial firms share a set of open standards published by FINOS, the Fintech Open Source Foundation. Three of them matter here:

  • the AI Governance Framework, a catalogue of the risks of using AI in finance and the controls that reduce them;

  • the Common Domain Model (CDM), a shared way to describe trades and what happens to them;

  • FDC3, the standard that lets desktop finance applications talk to each other.

An AI assistant asked about these standards will often answer from memory and get details wrong: an id that does not exist, a field that is not in the schema. This project gives the assistant the real thing to look up instead. It packages each standard as a small server that speaks the Model Context Protocol (MCP), the open protocol that Claude and other assistants use to call external tools.

With the servers connected, an assistant can answer questions like:

  • "Which controls reduce the risk of prompt injection, and what do they map to in the EU AI Act?"

  • "Is this trade JSON valid CDM? If not, where exactly is it wrong?"

  • "My app has a stock ticker selected. Which FDC3 actions can I offer the user?"

Each answer comes with an identifier or link the reader can check against the standard itself.

The three servers

Server

Standard

What an assistant can do with it

finos-mcp-aigf

AI Governance Framework

Look up 24 risks and 25 controls by their published ids, see which controls address which risks, cross-reference 13 outside frameworks (NIST, ISO 42001, EU AI Act, OWASP), and search in plain language

finos-mcp-cdm

Common Domain Model

Explore 767 CDM types and 1,143 JSON schemas, browse products and trade events, and validate trade documents with exact error paths

finos-mcp-fdc3

FDC3

Look up 19 standard actions ("intents") and 28 data types, check a data object, and suggest which actions fit it

All three are built on finos-mcp-core, a shared package that holds the safety rules described below. The full list of 29 tools is in docs/tools.md, and docs/demo.md shows a real session, including the CDM server finding three deliberate mistakes in a trade document.

Quick start

You need uv and nothing else. There is no account, API key or database to set up.

First-time setup: Follow the MCP client setup guide for copy-paste, version-pinned configurations for Claude Desktop, Claude Code, VS Code and GitHub Copilot. It also covers Windows and macOS setup, verifying a real tool call, and troubleshooting. The quick-start examples below pin the published, end-to-end-tested v0.3.2 packages.

Claude Desktop or Claude Code. Add this to your MCP configuration (full example) and restart:

{
  "mcpServers": {
    "finos-aigf": { "command": "uvx", "args": ["--python", "3.12", "finos-mcp-aigf==0.3.2"] }
  }
}

From the command line.

# talk over stdin/stdout, the way desktop assistants connect
uvx --python 3.12 finos-mcp-aigf==0.3.2

# or serve HTTP on localhost (self-hosted, not a public hosted service)
uvx --python 3.12 finos-mcp-aigf==0.3.2 --transport streamable-http --port 8000

As a container. It needs no writable disk and no extra privileges:

docker run --rm -p 8000:8000 --read-only --cap-drop ALL \
  -e FINOS_MCP_ALLOWED_HOSTS='localhost:*,127.0.0.1:*' \
  ghcr.io/vardhjain/finos-mcp:v0.3.2

The allowed-hosts setting makes the server refuse requests that arrive under any other host name, which stops a web page in your browser from reaching the port.

Running a stdio command directly starts a server waiting for a client; it does not display a chat prompt. To verify installation in a terminal, add --help instead. Swap finos-mcp-aigf for finos-mcp-cdm or finos-mcp-fdc3 to run the other servers. examples/ includes a low-memory, reproducible live demo, a short Python client, and a LangGraph agent.

Why it is safe to connect

Giving an assistant new tools is a risk, so the servers are deliberately limited:

  • They can only read. No tool writes a file, sends a message or changes any system. The server refuses to serve any tool if one of them is not marked read-only.

  • They work offline. The standards are copied into the packages at build time, with the exact upstream version recorded. Nothing is fetched while the server runs.

  • They cannot be flooded. Every tool has a rate limit and a cap on input and output size.

  • Mistakes are explained. A bad request gets a structured error that says what was wrong and what to try, so the assistant can correct itself instead of guessing.

  • Everything is logged. Each call is written to an audit log, with a fingerprint of its arguments in place of the raw content.

The details, including every setting, are in docs/safety.md.

One optional feature does use the network. Installing the semantic extra adds meaning-based search, which downloads a small open model on first use. Without it, search is keyword-based and fully offline.

How well it works

These numbers are measured by automated checks and published to the metrics branch. The badges above read that file directly, so they show measurements from a specific commit.

Check

Result

Automated tests

Over 200 passing, with more than 90% of the code exercised. The exact figures are on the badges above

Finding the right record for a plain-language question (50 questions)

Correct answer in the top five 91.5% of the time

An AI model answering 20 governance questions through the server

0 invented ids; 95% of answers cited a valid id

Response time per tool call

A few milliseconds on the benchmarked tools

The offline metrics update on every push to main; the search result in this table is from October 2026. The agent test uses Claude Haiku 4.5 and requires paid Anthropic API credits. To prevent surprise costs, it only runs through an explicit manual opt-in in GitHub Actions, never on a timer or PR label. Its published figures are from the last successful evaluation on 14 September 2026 and are not live data. Deterministic tests and retrieval evaluations continue to run in CI without LLM API calls.

Building this also turned up 15 defects in the upstream standards, recorded in docs/upstream-findings.md. The first was reported to FINOS, and its YAML fix merged upstream in PR #380 on October 21, 2026.

Project layout

Path

Contents

core/

Shared safety layer: read-only enforcement, rate limits, size caps, audit log, search

servers/

One package per standard, each with its copy of the upstream content

evals/

Golden tests, AIGF retrieval, offline CDM/FDC3 workflows, latency and optional agent evaluation

examples/

Configuration and sample clients

docs/

Documentation, also published at https://vardhjain.github.io/finos-mcp/

Development

uv sync --all-packages --all-extras
uv run pytest
uv run pytest evals/offline/test_workflows.py -v  # 16 multi-tool scenarios, no paid APIs
uv run ruff check . && uv run mypy core/src servers/*/src

See CONTRIBUTING.md for the ground rules, CHANGELOG.md for what changed in each release, RELEASING.md for how releases are made, and PLAN.md for the original design record.

Status

For maintainers, MCP directory and Registry status records the three already-published official Registry entries and the pending Glama listing correction. Future third-party directory submissions require separate approval.

The latest published release is available on PyPI as finos-mcp-core, finos-mcp-aigf, finos-mcp-cdm and finos-mcp-fdc3, for Python 3.12 and later, and as a container image for x86 and ARM.

Not affiliated with or endorsed by FINOS. These are independent community packages. Some official FINOS packages on PyPI also start with finos-; nothing here is one of them.

Licenses

The code is Apache-2.0. The copied standards keep their own licenses: the AI Governance Framework is CC-BY-4.0, and CDM and FDC3 are under the Community Specification License 1.0. See NOTICE.

Available Tools

11 tools
find_by_external_referenceA
Read-onlyIdempotent

Reverse crosswalk: find the AIGF risks and controls that cite an external reference, e.g. key='sa-9' (NIST SP 800-53), 'llm01-2025' (OWASP LLM Top 10), 'c3-s2-a15' (EU AI Act), 'A-6-2-6' (ISO 42001). Matching is case-insensitive and ignores punctuation; optionally restrict to one framework name from list_reference_frameworks.

NameRequiredDescriptionDefault
keyYes
frameworkNo

Output Schema

NameRequiredDescription
keyYes
matchesYes
frameworkNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds valuable behavioral detail beyond annotations: matching is case-insensitive, ignores punctuation, and the framework filter is optional. This meaningfully helps an agent predict results without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then provides concrete examples and behavioral caveats. Every sentence adds value: the examples disambiguate key formats, and the matching rules prevent incorrect expectations. It is appropriately sized for a tool with two parameters and nuanced matching behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema already covers return shape, the description does not need to explain return values. It covers the tool's purpose, supported key formats, normalization behavior, optional framework restriction, and points to the authoritative list. For this complexity level, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema offers only generic titles ('Key', 'Framework') with 0% schema description coverage, so the description must carry the semantic burden. It fully compensates by explaining that 'key' is an external reference identifier with concrete examples and that 'framework' restricts results to a framework name from list_reference_frameworks. Both parameters are meaningfully clarified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Reverse crosswalk' and immediately states the exact resource ('AIGF risks and controls') and action ('find ... that cite an external reference'). The examples clarify the input format and the phrase 'reverse crosswalk' distinguishes it from mapping tools like map_control_to_external.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: when you need to find risks/controls by an external reference. It also directs the user to list_reference_frameworks for valid framework names. However, it does not explicitly mention exclusions or contrast itself with search_framework or map_control_to_external, so it stops short of a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_controlA
Read-onlyIdempotent

Get one AIGF control by id (AIR-PREV-020, mi-20, 20, or its title), with the risks it mitigates, related controls, and crosswalk references (NIST SP 800-53, ISO 42001, ...). Set include_sections=false for a compact record.

NameRequiredDescriptionDefault
idYes
include_sectionsNo

Output Schema

NameRequiredDescription
idYes
typeYes
titleYes
statusYes
summaryYes
sectionsNo
sequenceYes
short_idYes
mitigatesNo
referencesNo
type_labelYes
source_pathYes
citation_uriYes
related_controlsNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful behavioral context about what the response contains (risks, related controls, crosswalk references) and that include_sections=false yields a compact record, which is meaningful beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise, information-dense sentences. The main purpose and id formats are front-loaded, followed by the optional flag guidance. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich annotations, an output schema, and only two parameters, the description covers everything an agent needs to select and invoke the tool correctly. It explains the lookup key, the response contents, and the compaction option.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates: it explains the id parameter with concrete accepted formats and explains the behavior of include_sections. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: get one AIGF control by id, and enumerates the included related data (risks, related controls, crosswalk references). The accepted id examples also help distinguish this from sibling list/map tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly implies use when retrieving a single control by id, and gives guidance on include_sections for compactness. However, it does not explicitly contrast with sibling tools like list_controls or find_by_external_reference, so the when-not-to-use context is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_riskA
Read-onlyIdempotent

Get one AIGF risk by id (AIR-SEC-010, ri-10, 10, or its title), with the controls that mitigate it, related risks, and external references. Set include_sections=false for a compact record without the full text.

NameRequiredDescriptionDefault
idYes
include_sectionsNo

Output Schema

NameRequiredDescription
idYes
typeYes
titleYes
statusYes
summaryYes
sectionsNo
sequenceYes
short_idYes
referencesNo
type_labelYes
source_pathYes
citation_uriYes
mitigated_byNo
related_risksNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the operation read-only, idempotent, and non-destructive. The description adds useful behavioral context by explaining that the response includes mitigating controls, related risks, and external references, and that include_sections=false returns a compact record without full text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the first covers the core action and output contents, the second covers the optional flag. No filler, and the most important usage detail is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema present, annotations covering safety/idempotence, and clear explanation of id formats and the include_sections toggle, nothing essential is missing for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions are absent (0% coverage), but the description compensates fully by documenting the id parameter's accepted forms (AIR-SEC-010, ri-10, 10, title) and the effect of include_sections. This gives an agent concrete grounding for both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Get') and resource ('one AIGF risk by id'), and it clarifies the identifier formats accepted. This differentiates it from siblings like list_risks (which returns many) and get_control (which targets controls rather than risks).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'by id' wording makes clear this is for retrieving a single known risk, and the mention of title/ID formats helps an agent know when it has a valid lookup key. It does not explicitly name alternatives or list when-not-to-use conditions, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_controlsA
Read-onlyIdempotent

List AIGF controls (the framework calls them mitigations). Filter by type (PREV = preventative, DET = detective) or status. Returns ids for get_control.

NameRequiredDescriptionDefault
pageNo
typeNo
statusNo
page_sizeNo

Output Schema

NameRequiredDescription
pageYes
itemsYes
totalYes
page_sizeYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the call as read-only, idempotent, and non-destructive. The description adds useful behavioral context: it returns IDs intended as input for get_control and explains that 'mitigations' is AIGF's name for controls, which helps an agent interpret downstream data. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences provide the action, alternate vocabulary, filter semantics, and the return/next-step hint with no filler. All information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with an output schema and safe annotations, the description covers purpose, filters, and downstream usage. It does not enumerate possible status values, but the schema leaves status as an open string and the search_status sibling can handle discovery; this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry parameter meaning. It does for the two significant filters: it defines PREV and DET and says status is a filter. Page and page_size are left to their self-explanatory names/defaults, which is acceptable for a list endpoint.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description begins with a specific action and resource ('List AIGF controls') and clarifies the framework's alternate terminology ('the framework calls them mitigations'), so there is no ambiguity about what is being listed. It also distinguishes itself from siblings like get_control (single item) and list_risks (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys when to use the tool: to list/filter controls by type or status, and to obtain IDs for a follow-up get_control call. It does not explicitly contrast with alternative list/search sibling tools, but the workflow hint is clear enough to route an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_reference_frameworksA
Read-onlyIdempotent

List the external reference frameworks the AIGF crosswalks to, with entry counts and how many risks and controls cite each.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
frameworksYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds meaningful behavioral context by specifying the scope ('crosswalks to') and the aggregation details (entry counts, risk/control citations), which is useful beyond the annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence states the verb, resource, and output details with no wasted words. Every part of the description contributes to an agent's understanding of the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter list operation with rich annotations and an output schema, the description is complete: it says what is listed and what summary information is returned. Nothing essential is missing for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics to document. The baseline for zero-parameter tools is 4, and the description appropriately adds scope and output granularity without needing to explain any arguments.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a clear resource ('external reference frameworks the AIGF crosswalks to'), and it specifies the output shape: entry counts plus risk/control citation counts. This clearly distinguishes it from siblings like search_framework, find_by_external_reference, and list_risks/list_controls.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for enumerating reference frameworks and their citation counts, rather than searching or mapping. However, it does not explicitly state when to prefer this tool over siblings like search_framework or find_by_external_reference, leaving the routing decision mostly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_risksA
Read-onlyIdempotent

List AIGF risks. Filter by type (RC = regulatory and compliance, OP = operational, SEC = security) or document status. Returns ids you can pass to get_risk.

NameRequiredDescriptionDefault
pageNo
typeNo
statusNo
page_sizeNo

Output Schema

NameRequiredDescription
pageYes
itemsYes
totalYes
page_sizeYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds value by explaining the return shape ('Returns ids you can pass to get_risk') and the filter behavior, which goes beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, and the core purpose is front-loaded. Every sentence adds useful information, and the tool is immediately understandable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering side-effect safety, the description provides the key missing context: how to filter and how to chain results into get_risk. Minor gaps remain around pagination and status values, but defaults and output schema cover part of that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the meaningful values for 'type' (RC, OP, SEC) and mentions 'document status', but it does not clarify page/page_size behavior or enumerate possible status values. Partial compensation, not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('List'), a clear resource ('AIGF risks'), and the available filters. It also distinguishes itself from get_risk by explicitly noting that it returns ids to pass to get_risk, making the tool's role in a workflow clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context by explaining this tool is for listing/filtering risks and that its ids feed into get_risk. It does not explicitly exclude alternatives like list_controls, but the resource and filter details make the intended use reasonably unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

map_control_to_externalA
Read-onlyIdempotent

Crosswalk one control to external frameworks: NIST SP 800-53 r5, NIST AI 600-1, ISO 42001, EU AI Act, OWASP LLM/ML/ASI, FFIEC, IOSCO, SR 11-7 and others. Optionally restrict to the named frameworks (see list_reference_frameworks).

NameRequiredDescriptionDefault
idYes
frameworksNo

Output Schema

NameRequiredDescription
refsYes
titleYes
control_idYes
frameworksYes
citation_uriYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish that this is read-only, idempotent, and non-destructive, so the description does not need to restate safety. It adds useful scope context (supported frameworks and optional restriction), but it does not disclose behavior around unknown control IDs or empty mapping results; the output schema helps cover return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences front-load the verb and object, then give the framework list and the optional restriction in a single clause. There is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema, annotations, and sibling context, the description is nearly complete for tool selection and invocation. It names the framework set, explains the optional filter, and points to the relevant sibling for framework discovery; the only notable gap is the under-specified id parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the frameworks parameter well by tying it to named frameworks and list_reference_frameworks, but the required id parameter is only implied as 'one control' with no stated source or format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Crosswalk') and resource ('one control') and enumerates the target external frameworks, making the tool's scope immediately clear. It is easily distinguished from siblings like map_risks_to_controls and find_by_external_reference, which address different mapping directions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly communicates the intended use case—mapping a single control to external frameworks—and points to list_reference_frameworks for valid framework names. It does not explicitly state when to prefer alternative tools such as find_by_external_reference, so it lacks formal exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

map_risks_to_controlsA
Read-onlyIdempotent

Map risks to the controls that mitigate them. Pass explicit risk_ids (up to 25), a free-text query (the top k matching risks are used), and/or up to 5 queries (each contributing its own top k matches, unioned with everything else) -- useful for "both X and Y" questions where a single query blurs together two distinct concepts. Controls are ordered by how many of the given risks they cover; control_type (PREV or DET) restricts the result. Reports uncovered risks and any inputs that did not resolve.

NameRequiredDescriptionDefault
kNo
queryNo
queriesNo
risk_idsNo
control_typeNo

Output Schema

NameRequiredDescription
edgesYes
risksYes
controlsYes
unresolvedNoInputs that did not resolve to a risk.
uncovered_risksNoRisk ids with no mapped control.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the readOnly/idempotent annotations by disclosing important behavior: controls are ordered by coverage count, control_type restricts results, uncovered risks are reported, and unresolved inputs are surfaced. This gives the agent accurate expectations for the tool's output and edge-case handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence carries operational value: input modes, limits, union semantics, ordering, filtering, and reporting behavior. It is front-loaded with the core purpose and avoids filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a 5-parameter tool with no required parameters and an output schema present, the description covers all relevant invocation semantics, constraints, and result-shaping behavior. An agent can correctly decide how to call this tool for single, multi-query, id-based, and filtered mapping scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully: it explains risk_ids (up to 25), free-text query behavior (top k matching risks), up to 5 queries with unioned results, control_type as PREV or DET, and k as the match count. Every parameter's role is described beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Map risks to the controls that mitigate them.' It clearly distinguishes the tool from sibling list/get/search tools by focusing on the mapping relationship and the combination of risks-to-controls coverage semantics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear guidance on when to use each input mode and specifically calls out the multi-query use case for 'both X and Y' questions. It does not explicitly name alternative sibling tools or state when not to use this tool, but the usage context is strongly implied and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_frameworkA
Read-onlyIdempotent

Search risks and controls with matching sections and citable source URIs.

For an unscoped question clearly asking for risks or for controls, rank those record types first while retaining the other type as a fallback. This is a stable partition of the original relevance-ranked results, not a new relevance score. Questions asking for both kinds stay mixed; explicit scope always wins.

NameRequiredDescriptionDefault
kNo
queryYes
scopeNoall

Output Schema

NameRequiredDescription
hitsYes
queryYes
scopeYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, non-destructive, closed-world), so the description's job is to add context beyond that — and it does, explaining that the risks/controls ordering is a 'stable partition of the original relevance-ranked results, not a new relevance score.' That is a genuine behavioral disclosure about ranking semantics that the annotations and schema do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short paragraphs, the core capability front-loaded in the first line and the ranking caveat second. No filler, no restatement of the tool name, and every clause carries information an agent would otherwise have to guess.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no explanation, and annotations cover the safety profile. Still, for a three-parameter search tool the description leaves the result-count parameter undefined and gives no sense of corpus size or result limits, so an agent could call it correctly but not optimally.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It does explain the non-obvious 'scope' semantics well (unscoped vs. explicit precedence, mixed results for both), but 'k' is never mentioned and the query format/limits are left unstated, so compensation is partial rather than complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource pair ('Search risks and controls') plus what comes back ('matching sections and citable source URIs'). It implicitly separates itself from get_risk/list_risks by being a search, but never names or contrasts those siblings explicitly, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second paragraph gives real conditional guidance ('for an unscoped question clearly asking for risks or for controls', 'questions asking for both kinds stay mixed', 'explicit scope always wins'), which helps an agent decide how to rank. However, it never addresses when to choose this tool over list_risks, list_controls, or search_status, so tool-selection guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_statusA
Read-onlyIdempotent

Report search_framework's active retrieval mode: whether it is BM25-only (lexical) or fused with dense semantic search (hybrid), and why -- e.g. the semantic extra is not installed, or a model failed to load.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
modeYes
modelNo
semantic_statusYes
semantic_enabledYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive behavior. The description adds meaningful behavioral context by explaining that the tool reports not just the mode but the underlying reason, with concrete examples like missing 'semantic' extra or model load failure. This goes beyond the annotation metadata without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly written sentence that front-loads the core purpose and then provides useful explanatory detail and concrete examples. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, read-only status tool with an output schema available, the description is comprehensive enough. It tells the agent what the tool reports, why it matters, and what kind of reasons might appear, leaving no critical gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the description does not need to explain parameter behavior. It still adds semantic value by describing what the status output is about, satisfying the baseline for parameterless tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Report') and identifies the exact resource and concern: search_framework's active retrieval mode, including whether it is BM25-only or hybrid and why. This clearly distinguishes it from sibling tools like search_framework, which performs searches, and server_info, which reports general server state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies the tool is for diagnosing search_framework's retrieval configuration, and the read-only annotations reinforce when it is safe to call. However, it does not explicitly name alternatives or conditions when another tool should be used instead, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

server_infoA
Read-onlyIdempotent

Describe this server: standard version, upstream provenance, exposed counts, latency, policy.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
nameYes
toolsNo
countsNo
policyNo
latencyNo
versionYes
standardYes
read_onlyNo
resourcesNo
upstream_refNo
upstream_repoNo
upstream_commitNo
standard_versionNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so safety is covered. The description adds value by listing the exact informational dimensions returned (version, provenance, counts, latency, policy), but does not disclose any additional behavioral traits such as whether the information is cached, whether the call itself may be slow due to latency measurement, or how policy is represented. With annotations present, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that front-loads the core action and then provides a compact, informative list of the six content areas. There is no filler, repetition, or extraneous context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only informational tool with an output schema, the description covers the essential purpose and content scope. It could be slightly more explicit about what 'exposed counts' and 'policy' mean, but the presence of an output schema compensates for any ambiguity about return structure. Overall, it is adequate and complete for this low-complexity tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema is empty, so parameter semantics are trivially satisfied. Per the baseline for 0-parameter tools, the description need not compensate for missing parameter documentation. It also avoids inventing unnecessary parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Describe') and a clear resource ('this server'), then enumerates the dimensions it covers: standard version, upstream provenance, exposed counts, latency, and policy. This clearly distinguishes it from the sibling risk/control tools, which concern controls, risks, and frameworks rather than server metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Although there is no explicit 'when to use' statement, the context is clear: this is the only server-info tool among siblings that all address risk/control/framework operations. An agent can infer it should be used when server metadata is needed. It lacks an explicit exclusion or alternative, but the sibling set makes the use case unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedfind_by_external_reference
    • First observedget_control
    • First observedget_risk
    • First observedlist_controls
    • First observedlist_reference_frameworks
    • First observedlist_risks
    • First observedmap_control_to_external
    • First observedmap_risks_to_controls
    • First observedsearch_framework
    • First observedsearch_status
    • First observedserver_info

TDQS

A4.2/5.0

Scored across 11 tools

Disambiguation4/5

Most tools target clearly distinct resources and actions (list_risks vs get_risk vs list_controls vs get_control). The main overlap is between search_framework and the list_* tools, and between map_control_to_external and find_by_external_reference, but the descriptions make the boundaries (forward vs reverse crosswalk, free-text search vs filtered listing) reasonably clear.

Naming Consistency4/5

Strong verb_noun pattern: list_risks, get_risk, list_controls, get_control, map_risks_to_controls, map_control_to_external, find_by_external_reference. Minor deviations are search_status and server_info, which describe state rather than an action but are still readable and predictable.

Tool Count5/5

11 tools is well within the ideal 3-15 range for a reference-framework server. Each tool earns its place: search, per-type listing and retrieval, bidirectional mapping, and reference listing/info all cover distinct needs.

Completeness4/5

Coverage is strong for a read-only reference surface: search, list/get for both risks and controls, risk-to-control mapping, control-to-external crosswalk, reverse crosswalk, and framework listing. The main gap is that external crosswalking is only directly exposed for controls (map_control_to_external), with risk-side external mapping only inferable via the reverse lookup.

Maintenance

ActivityActive
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to understand and query your database safely by providing a semantic layer of metadata, with tools to search, explain, validate, and generate safe SQL.
    2
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to interact with the OSDU® data platform through Model Context Protocol, providing tools for search, storage, schema management, and dataset operations.
    2
    Apache 2.0
  • A
    license
    A
    quality
    D
    maintenance
    Enables MCP-compatible agents to query security checklists, protocols, and framework mappings to safely build and operate AI agents, with tools for checklist runs, protocol lookup, mapping lookup, and threat search.
    9
    CC BY-4.0