Loading ToolBench
MCP server for nISO GRC System - provides tools for governance, risk, and compliance management with role-based access control (consultant vs auditor)
24 tools with complete schemas and descriptions, but significant quality gaps. All tools have input schemas with proper types and required fields. Descriptions present but often generic or overly technical. Many parameters lack detailed constraints. Critical issue: descriptions frequently reference Portuguese compliance context and internal approval workflows ('ESCRITA em projeto de cliente: requer contrato ativo...') that are not actionable for LLMs. No output schemas documented. Error handling absent. Tool naming is consistent (verb_noun pattern) but some names are domain-specific jargon ('niso_coherence_check', 'niso_traceability') that may confuse LLMs unfamiliar with GRC terminology.
Download the audit readiness pack (consolidated JSON: project state, controls, risks, evidence, findings, notes)
Run coherence checks: control-risk alignment, evidence-control mapping, finding-evidence traceability
Register an audit finding (fact with evidence). Auditor-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Create an auditor observation or note (not a formal finding). Auditor-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Create a new control. Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Descriptions contain non-actionable Portuguese compliance boilerplate ('ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia') that does not guide LLM tool selection or usage. This text should be removed or replaced with actionable constraints (e.g., 'Requires human approval before execution').
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., what fields does niso_list_projects return? Is there a project_id field for use in niso_get_project?). This breaks tool chaining.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2026-07-28+ | v2 |
Create evidence record (text only: markdown, plain text, CSV, JSON). Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Create a new risk entry in a project's risk matrix. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Evaluate evidence against a control (AI-assisted assessment). Consultant-only tool.
Run the project's gap analysis: control coverage %, breakdown by status, and the list of open gaps
Generate multiple policies in bulk (AI-assisted). Consultant-only tool. Requires explicit human approval in active contract before execution. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Get detailed information about a specific control
Get detailed information about a specific project, including phases and progress
Get detailed information about a specific risk
Link an evidence record to a control. Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
List all audit findings for a project
List all auditor notes for a project
List all compliance controls for a specific project
List all evidence records for a project
List all active GRC projects in the nISO portfolio
List all risks in a project's risk register
Respond to an auditor note (consultant action plan). Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Get the project's traceability matrix linking risks -> controls -> evidence
Update control details (status, description). Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Update risk details (impact, probability, status). Consultant-only tool. ESCRITA em projeto de cliente: requer contrato ativo e aprovação humana prévia (ver constituição do Aegis-Consultor).
Domain-specific jargon in tool names ('coherence_check', 'traceability', 'gap_analysis') may confuse LLMs unfamiliar with GRC terminology. Consider adding clarifying descriptions or renaming to more explicit verbs (e.g., 'analyze_control_gaps', 'map_risk_to_controls').
Many write tools lack error handling guidance. If niso_create_risk fails (e.g., invalid impact/probability score, duplicate risk), the description does not explain what went wrong or how to recover. Add error classification and recovery hints.
Parameter descriptions are minimal. E.g., 'impact' and 'probability' in niso_create_risk are described as 'Impact score (1-5)' and 'Probability score (1-5)' but lack context: what do these scores mean? How are they used in risk calculation? Are they CVSS-based, custom, or standard GRC metrics?