A conversational compliance workbench exposing an AI-compliance corpus over /ask (humans/UI) and /mcp (agents) endpoints. Provides grounded, cited answers about AI regulations, frameworks, and compliance requirements.
Three tools with complete schemas and descriptions, but significant gaps in parameter documentation and output schema clarity. ask_compliance has good structure with enum constraints on 'mode', but lacks descriptions for 'site' parameter depth and output format. list_frameworks and get_framework are minimal, no parameter descriptions beyond the bare schema. No error handling guidance, no output schemas documented, and no tool annotations (readOnlyHint). Descriptions are adequate (50-100 chars) but lack WHEN/WHY context. Naming is clear and verb-forward. Composition is sound, each tool has one responsibility.
Ask a grounded, cited question about the AI-compliance corpus.
Get manifest metadata for one framework by doc_id.
List the frameworks/documents in the corpus, grouped by tier.
Output schemas not documented. LLMs cannot plan downstream calls or extract fields without knowing response structure. ask_compliance returns JSON-serialized response; list_frameworks and get_framework return corpus data, structure unknown.
Parameter 'site' in ask_compliance lacks description. LLM cannot infer format (comma-separated? array? single value?). Description says 'e.g. eu,us-co' but does not state whether it is required, what valid values are, or how it filters results.
No error handling guidance. If ask_compliance fails (corpus empty, query malformed), the response does not tell the LLM what to do next. No recovery hints, no categorization (retryable vs user-fixable).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Tool annotations missing. No readOnlyHint, destructiveHint, or idempotentHint declared. All three tools are read-only and idempotent, these should be explicitly marked so agents know they are safe to retry.
list_frameworks and get_framework have minimal descriptions (under 50 chars). Descriptions lack context on WHEN to call them, what they return, or how they relate to ask_compliance. LLM cannot distinguish when to use list_frameworks vs ask_compliance.