Loading ToolBench
Scan AI-generated Terraform for security misconfigurations, in your editor, before it is committed.
Sovereign Observer demonstrates strong tool design with clear, action-oriented naming (scan_terraform, explain_finding, apply_fixes) and comprehensive descriptions (avg 180+ chars). All 7 tools have documented input schemas with type definitions and parameter descriptions. However, output schemas are not explicitly documented in the source code, and error handling lacks recovery guidance. Tool composition is excellent, each tool has a single responsibility and chains naturally (scan → explain → apply). The server includes exceptional procedural instructions that guide LLM behavior, which partially compensates for missing output documentation.
Apply the mechanically-safe fixes from scan_terraform to Terraform source and return the patched HCL. Pass the file content plus the findings you want fixed (each as {check_id, resource_address}). Only fixes on the hand-verified allowlist are applied; everything else is returned in `skipped` with the reason, and must be applied by hand. Never overwrites a value that is wired to a variable or expression. Returns content — it does not write to disk.
Map Terraform findings to the compliance controls they speak to: SOC 2, ISO 27001, NIST 800-53, PCI-DSS, and the regulatory overlays DORA, NIS2, Saudi NCA Cloud Cybersecurity Controls and UAE NESA/SIA. Pass `findings` from scan_terraform, or `files` to scan and map in one call. Returns control mappings — evidence for an audit, never an attestation of compliance. Always relay the returned caveat to the user; do not present the result as a compliance verdict.
Get the full remediation for one finding from scan_terraform: what is wrong, the exact Terraform to fix it, and whether it is safe to apply mechanically. Call this for every finding you intend to fix instead of guessing the fix yourself.
For one regulatory framework (DORA, NIS2, NCA-CCC, NESA-IAS), list every article with whether automated configuration scanning can evidence it. Use this when the user asks how much of a regulation the tool covers — the not-evidenced articles are part of the honest answer and must be shown.
Output schemas not documented in source code. While input schemas are well-defined, return types and field structures are not explicitly declared, forcing LLMs to infer response structure.
Error handling lacks recovery guidance. EngineUnavailable exception returns generic error dict without actionable next steps or error classification (retryable vs fatal).
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) present. While risk levels are documented in the spec (READ_ONLY vs WRITE), they are not encoded in the MCP tool definitions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 65 | 2026-07-28+ | v2 |
Get this organization's own infrastructure policy requirements for a resource type — approved regions, required tags, mandatory settings — BEFORE writing the Terraform. Call this first whenever you are about to create a resource, so the code satisfies company policy on the first attempt rather than being corrected afterwards. Returns an empty, explanatory result when no organization policy is configured, which is normal and not an error.
Scan Terraform (HCL) for security misconfigurations and compliance failures. Call this after generating or editing any .tf content, before showing it to the user. Pass `files` (filename -> HCL content) to scan content that is not saved yet, or `paths` to scan .tf files and directories on disk. Runs locally; nothing is uploaded. Returns findings ordered by severity, each with a file, line, and whether an exact fix is available. Every finding is tagged with the environment it was inferred to belong to (production/staging/development/unknown). Set `environment_aware` to let resilience and housekeeping findings report lower on a non-production stack; exposure, encryption, identity and hardcoded credentials never move, in any environment.
Get a security-hardened Terraform template for a resource type (for example 'aws_s3_bucket', 'aws_db_instance', 'aws_security_group', 'azurerm_storage_account', 'google_storage_bucket'). Prefer this over writing the resource from memory: provider defaults are frequently insecure, and every template here is test-verified to contain no Critical or High findings. Returns the Terraform plus notes on what deliberately still needs the user's input.
check_compliance and framework_coverage accept optional parameters (findings vs files, frameworks) but do not document mutual exclusivity or validation logic.
scan_terraform paths parameter accepts list[str] but does not specify whether it supports files, directories, or both, or what happens if a path does not exist.