OneTrust API + MCP Server + A2A Agent — 100% API coverage
Server has 8 tools with significant quality gaps. Tool naming is inconsistent (example_prompt, onetrust_ingest_* vs onetrust_*). Descriptions vary widely in quality, some are detailed (onetrust_ingest_assessments at ~280 chars) but others are vague (onetrust_cookie_domain_data at ~50 chars). Most critically, input schemas are either missing or inferred from code rather than explicitly visible in the source. Parameters like 'action' in onetrust_data_mapping accept 40+ enum values but lack proper schema constraints. No output schemas documented. Error handling is absent from descriptions. Security concerns: params_json accepts arbitrary JSON strings, risking injection. Tool composition is poor, onetrust_data_mapping bundles 40+ unrelated operations into one tool.
Example prompt for OneTrust Api.
Manage OneTrust cookie domain data operations.
Manage OneTrust data mapping operations.
Manage OneTrust data mapping legacy operations.
Ingest OneTrust assessments into the KG as typed :Assessment nodes + :Document summaries. Lists assessments via ``get_all_assessment_basic_details_using_get`` (params_json is a JSON string of its query params, e.g. ``{"size":100}``) and pushes each as an :Assessment (+ :AssessmentTemplate / :Person links) plus a companion :Document.
Ingest OneTrust cookie-scan results into the KG as typed :Cookie (+ :CookieDomain) nodes. Lists cookies via ``get_cookies_by_filter`` (params_json = its JSON query/body params).
Input schemas not visible in source code. Tools accept params_json as free-form JSON strings without documented structure, type constraints, or validation rules. This violates pattern:constrained-input and invites hallucinated/malformed payloads.
onetrust_data_mapping bundles 40+ unrelated API operations (create_data_category, delete_data_subject, link_asset_inventory, etc.) into a single tool with an 'action' enum. This violates pattern:tool (one responsibility per tool) and forces LLMs to reason about 40+ distinct operations, increasing error likelihood.
Output schemas not documented. No tool description specifies what fields are returned, their types, or structure. LLMs cannot plan downstream calls or extract required data (e.g., does onetrust_ingest_assessments return assessment_ids for chaining?).
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | <=2025-11-25 | v2 |
Ingest OneTrust data-inventory records into the KG as typed :Inventory (+ :DataElement) nodes. Lists inventories via ``get_list_of_inventories_using_get`` (params_json = its JSON query params).
Manage OneTrust mobile app consent operations.
Vague descriptions for 4 tools (example_prompt, onetrust_cookie_domain_data, onetrust_data_mapping_legacy, onetrust_mobile_app_consent). Descriptions under 50 chars lack context for LLM selection. E.g., 'Manage OneTrust cookie domain data operations' does not explain WHAT operations, WHEN to call it, or what it returns.
No error handling guidance in any tool description. No indication of retryability, user-fixable errors, or recovery steps. Violates pattern:recovery-guide and pattern:error-classification.