How to fix: On each tool, declare annotations.readOnlyHint, annotations.destructiveHint, and annotations.openWorldHint as booleans. The policy review separately assesses whether their values match the tool's actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description97/100
List the consulting programs Techimpossible offers. Returns slug, title, price, duration, and one-paragraph summary for each program. Call get_program(slug) for the full description of a single program.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
No input fields.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
No output schema is declared. Add one for structured results so clients can interpret returned fields.
Not declared
Original tool metadata
{
"name": "list_programs",
"description": "List the consulting programs Techimpossible offers. Returns slug, title, price, duration, and one-paragraph summary for each program. Call get_program(slug) for the full description of a single program.",
"inputSchema": {
"type": "object",
"properties": {},
"additionalProperties": false
},
"annotations": {
"title": "List Techimpossible programs",
"readOnlyHint": true
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description93/100
Legacy narrative catalogue: list the Codex domain overviews published on this server — the free narrative slice of the Techimpossible Codex, a prerequisite graph of security capabilities. Returns slug, title, category, and summary for each. Call get_codex_domain(slug) for a narrative, or list_codex_taxonomy_domains for the full canonical graph.
Describe the returned information so the agent knows whether it will answer the request.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
No input fields.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
No output schema is declared. Add one for structured results so clients can interpret returned fields.
Not declared
Original tool metadata
{
"name": "list_codex_domains",
"description": "Legacy narrative catalogue: list the Codex domain overviews published on this server — the free narrative slice of the Techimpossible Codex, a prerequisite graph of security capabilities. Returns slug, title, category, and summary for each. Call get_codex_domain(slug) for a narrative, or list_codex_taxonomy_domains for the full canonical graph.",
"inputSchema": {
"type": "object",
"properties": {},
"additionalProperties": false
},
"annotations": {
"title": "List Codex domains",
"readOnlyHint": true
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description94/100
Return the full markdown overview of one Codex cybersecurity domain identified by slug. The Codex is Techimpossible's prerequisite graph of security capabilities — compliance frameworks (SOC 2, ISO 27001, HIPAA, ISO 42001) are views into it. Pair with list_codex_domains to discover valid slugs.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
slug
Codex domain slug, e.g. 'sanctions-screening'
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
Recommend a Techimpossible program (opinionated, Codex-grounded)
Shorten the title to an action and subject; move usage details into the description.
Description97/100
Opinionated framework recommendation from Techimpossible.
Asks the qualifying questions a real cybersecurity consultant asks on a scope call: 6 high-level routing questions (sector, AI involvement, customer profile, customer geographies, regulated data in scope, deal driver, org stage) plus 24 Codex foundational controls (6 per inventory: people, vendors, AI, data).
Returns a Codex-grounded recommendation: per-inventory foundational readiness, per-control state with what each missing control blocks, a primary program (which may legitimately be 'build foundation first' via Cybersecurity Fundamentals), queued recommendations with sequencing rationale, and an honest 'what we did not recommend' section.
Start here if you don't know which framework you need or want Techimpossible's perspective. Call gap_assess directly if you already know your framework.
The description explains the capability, when to use it, and what to expect.
Inputs79/100
32 of 35 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
sector
Primary industry the company operates in.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
ai_involvement
How AI is used in the company. Explicit, never inferred. 'none' = no AI; 'internal_only' = Copilot/Cursor/Claude in workflows but not in product; 'customer_facing' = AI feature in product; 'core_product' = AI is the product.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
customer_profile
Primary customer segment.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
customer_geographies
Where the company's customers are based. Multi-select.
Clear enough to supply this argument.
data_in_scope
Regulated or sensitive data classes the company handles. Multi-select. Use ['none'] if none apply.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
deal_driver › kind
What is driving the timeline.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
deal_driver › deadline
Free-text deadline if any, e.g. 'Q3 enterprise renewal'.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
org_stage › headcount
Not provided
Missing description. Explain what this value means and how to supply it.
org_stage › funding_stage
Not provided
Missing description. Explain what this value means and how to supply it.
org_stage › tenure_years
Not provided
Missing description. Explain what this value means and how to supply it.
current_state_notes
Optional free-text colour about the current state — existing certifications, prior audit history, anything the structured fields didn't capture.
Clear enough to supply this argument.
foundational_checks › current_org_chart
Do you maintain a current org chart that reflects every employee, contractor, and their reporting line?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › idp_hr_reconciliation
Is your IdP / SSO directory reconciled against your HR system of record on a regular cadence (weekly or better)?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › jml_process
Do you have a documented joiner / mover / leaver workflow with named owners and SLAs?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › contractor_inventory
Do you maintain a current list of contractors, the systems they access, and contract end dates?
Clear enough to supply this argument.
foundational_checks › production_admin_inventory
Can you produce, on demand, a list of every person with administrative access to production systems?
Clear enough to supply this argument.
foundational_checks › quarterly_access_review
Do quarterly access reviews actually happen, with documented sign-off from system owners?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › vendor_list_complete
Do you maintain a current list of every third-party SaaS, processor, sub-processor, and infrastructure provider in use?
Clear enough to supply this argument.
foundational_checks › vendor_tiering
Are vendors tiered by data sensitivity and integration depth (e.g. tier-1 critical, tier-2 important, tier-3 incidental)?
Clear enough to supply this argument.
foundational_checks › subprocessor_disclosure
Do you maintain a subprocessor list and disclose it to enterprise customers when required by contract?
Clear enough to supply this argument.
foundational_checks › tier_1_security_evidence
Do you have current SOC 2 Type II reports (or equivalent ISO 27001 certificates) on file for your tier-1 vendors?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › vendor_review_cadence
Do you re-review your tier-1 vendors at least annually, and after any public incident (breach, regulator action, ownership change)?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › dpa_inventory
Are your Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) catalogued by vendor, current, and accessible?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › ai_tool_inventory
Can you produce a list of every AI tool actually used by employees (Copilot, Cursor, Claude, ChatGPT, Gemini, paid SaaS with AI features, etc.)?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › ai_use_policy
Do you have a written policy on what data can and cannot be sent to consumer AI tools, with role-based access to sanctioned alternatives?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › ai_features_in_saas_audit
Have you audited your existing SaaS subscriptions for AI features added in the last 12 months (most have shipped some)?
Clear enough to supply this argument.
foundational_checks › ai_in_product_register
Do you maintain a register of every AI system used in your product, including model provider, data inputs, and decision impact level?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › ai_human_oversight
For high-impact AI decisions, is there a documented human-in-the-loop or human-on-the-loop requirement?
Clear enough to supply this argument.
foundational_checks › ai_vendor_questions
Have you updated your vendor questionnaire to ask vendors about AI in their pipelines (their data your AI sees; their AI your data flows through)?
Clear enough to supply this argument.
foundational_checks › data_classification_scheme
Do you have a documented data classification scheme (e.g. Public / Internal / Confidential / Restricted), with classification applied to actual data?
Clear enough to supply this argument.
foundational_checks › data_flow_diagrams
Do you maintain data flow diagrams that show how customer data moves through your systems, including third parties?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › regulated_data_inventory
Do you maintain an explicit map of where regulated data (PHI, EU/UK PII, financial, IP/trade-secret) is stored and processed?
Clear enough to supply this argument.
foundational_checks › ropa_for_gdpr
If you process EU or UK personal data, do you maintain Records of Processing Activities (Article 30 RoPA)?
Clear enough to supply this argument.
foundational_checks › data_retention_policies
Are data retention policies defined per data class and technically enforced (not just documented)?
Clear enough to supply this argument.
foundational_checks › dpia_process
Do you have a Data Protection Impact Assessment (DPIA) process for new uses of personal data, with named approvers?
Clear enough to supply this argument.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
{
"title": "Recommend a Techimpossible program (opinionated, Codex-grounded)",
"readOnlyHint": true
}
Output schema0/100
No output schema is declared. Add one for structured results so clients can interpret returned fields.
Not declared
Original tool metadata
{
"name": "recommend_framework",
"description": "Opinionated framework recommendation from Techimpossible.\n\nAsks the qualifying questions a real cybersecurity consultant asks on a scope call: 6 high-level routing questions (sector, AI involvement, customer profile, customer geographies, regulated data in scope, deal driver, org stage) plus 24 Codex foundational controls (6 per inventory: people, vendors, AI, data).\n\nReturns a Codex-grounded recommendation: per-inventory foundational readiness, per-control state with what each missing control blocks, a primary program (which may legitimately be 'build foundation first' via Cybersecurity Fundamentals), queued recommendations with sequencing rationale, and an honest 'what we did not recommend' section.\n\nStart here if you don't know which framework you need or want Techimpossible's perspective. Call gap_assess directly if you already know your framework.",
"inputSchema": {
"type": "object",
"required": [
"sector",
"ai_involvement",
"customer_profile",
"customer_geographies",
"data_in_scope",
"deal_driver",
"org_stage",
"foundational_checks"
],
"properties": {
"sector": {
"enum": [
"saas",
"ai_first_saas",
"fintech",
"health_tech",
"ecommerce",
"other"
],
"type": "string",
"description": "Primary industry the company operates in."
},
"org_stage": {
"type": "object",
"required": [
"headcount",
"funding_stage",
"tenure_years"
],
"properties": {
"headcount": {
"type": "integer",
"maximum": 1000000,
"minimum": 0
},
"tenure_years": {
"type": "number",
"maximum": 200,
"minimum": 0
},
"funding_stage": {
"enum": [
"bootstrapped",
"pre_seed",
"seed",
"series_a",
"series_b",
"series_c_plus",
"public",
"other"
],
"type": "string"
}
},
"additionalProperties": false
},
"deal_driver": {
"type": "object",
"required": [
"kind"
],
"properties": {
"kind": {
"enum": [
"customer_contract",
"certification",
"regulator",
"proactive"
],
"type": "string",
"description": "What is driving the timeline."
},
"deadline": {
"type": "string",
"maxLength": 200,
"description": "Free-text deadline if any, e.g. 'Q3 enterprise renewal'."
}
},
"additionalProperties": false
},
"data_in_scope": {
"type": "array",
"items": {
"enum": [
"phi",
"eu_uk_pii",
"financial",
"ip_trade_secret",
"none"
],
"type": "string"
},
"minItems": 1,
"description": "Regulated or sensitive data classes the company handles. Multi-select. Use ['none'] if none apply."
},
"ai_involvement": {
"enum": [
"none",
"internal_only",
"customer_facing",
"core_product"
],
"type": "string",
"description": "How AI is used in the company. Explicit, never inferred. 'none' = no AI; 'internal_only' = Copilot/Cursor/Claude in workflows but not in product; 'customer_facing' = AI feature in product; 'core_product' = AI is the product."
},
"customer_profile": {
"enum": [
"consumer",
"smb",
"mid_market",
"enterprise",
"government"
],
"type": "string",
"description": "Primary customer segment."
},
"current_state_notes": {
"type": "string",
"maxLength": 2000,
"description": "Optional free-text colour about the current state — existing certifications, prior audit history, anything the structured fields didn't capture."
},
"foundational_checks": {
"type": "object",
"required": [
"current_org_chart",
"idp_hr_reconciliation",
"jml_process",
"contractor_inventory",
"production_admin_inventory",
"quarterly_access_review",
"vendor_list_complete",
"vendor_tiering",
"subprocessor_disclosure",
"tier_1_security_evidence",
"vendor_review_cadence",
"dpa_inventory",
"ai_tool_inventory",
"ai_use_policy",
"ai_features_in_saas_audit",
"ai_in_product_register",
"ai_human_oversight",
"ai_vendor_questions",
"data_classification_scheme",
"data_flow_diagrams",
"regulated_data_inventory",
"ropa_for_gdpr",
"data_retention_policies",
"dpia_process"
],
"properties": {
"jml_process": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a documented joiner / mover / leaver workflow with named owners and SLAs?"
},
"dpia_process": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a Data Protection Impact Assessment (DPIA) process for new uses of personal data, with named approvers?"
},
"ai_use_policy": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a written policy on what data can and cannot be sent to consumer AI tools, with role-based access to sanctioned alternatives?"
},
"dpa_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are your Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) catalogued by vendor, current, and accessible?"
},
"ropa_for_gdpr": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "If you process EU or UK personal data, do you maintain Records of Processing Activities (Article 30 RoPA)?"
},
"vendor_tiering": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are vendors tiered by data sensitivity and integration depth (e.g. tier-1 critical, tier-2 important, tier-3 incidental)?"
},
"ai_tool_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Can you produce a list of every AI tool actually used by employees (Copilot, Cursor, Claude, ChatGPT, Gemini, paid SaaS with AI features, etc.)?"
},
"current_org_chart": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current org chart that reflects every employee, contractor, and their reporting line?"
},
"ai_human_oversight": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "For high-impact AI decisions, is there a documented human-in-the-loop or human-on-the-loop requirement?"
},
"data_flow_diagrams": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain data flow diagrams that show how customer data moves through your systems, including third parties?"
},
"ai_vendor_questions": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Have you updated your vendor questionnaire to ask vendors about AI in their pipelines (their data your AI sees; their AI your data flows through)?"
},
"contractor_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current list of contractors, the systems they access, and contract end dates?"
},
"vendor_list_complete": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current list of every third-party SaaS, processor, sub-processor, and infrastructure provider in use?"
},
"idp_hr_reconciliation": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Is your IdP / SSO directory reconciled against your HR system of record on a regular cadence (weekly or better)?"
},
"vendor_review_cadence": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you re-review your tier-1 vendors at least annually, and after any public incident (breach, regulator action, ownership change)?"
},
"ai_in_product_register": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a register of every AI system used in your product, including model provider, data inputs, and decision impact level?"
},
"data_retention_policies": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are data retention policies defined per data class and technically enforced (not just documented)?"
},
"quarterly_access_review": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do quarterly access reviews actually happen, with documented sign-off from system owners?"
},
"subprocessor_disclosure": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a subprocessor list and disclose it to enterprise customers when required by contract?"
},
"regulated_data_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain an explicit map of where regulated data (PHI, EU/UK PII, financial, IP/trade-secret) is stored and processed?"
},
"tier_1_security_evidence": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have current SOC 2 Type II reports (or equivalent ISO 27001 certificates) on file for your tier-1 vendors?"
},
"ai_features_in_saas_audit": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Have you audited your existing SaaS subscriptions for AI features added in the last 12 months (most have shipped some)?"
},
"data_classification_scheme": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a documented data classification scheme (e.g. Public / Internal / Confidential / Restricted), with classification applied to actual data?"
},
"production_admin_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Can you produce, on demand, a list of every person with administrative access to production systems?"
}
},
"description": "Answers to the 24 Codex foundational controls (6 per inventory: people, vendors, ai, data). Ask the prospect each question; record \"present\" / \"partial\" / \"absent\" / \"unknown\" honestly. \"unknown\" is a valid signal that surfaces as a thing to resolve.",
"additionalProperties": false
},
"customer_geographies": {
"type": "array",
"items": {
"enum": [
"north_america",
"eu_uk",
"apac",
"latam",
"mena"
],
"type": "string"
},
"minItems": 1,
"description": "Where the company's customers are based. Multi-select."
}
},
"additionalProperties": false
},
"annotations": {
"title": "Recommend a Techimpossible program (opinionated, Codex-grounded)",
"readOnlyHint": true
}
}
Gap-assess against a known framework (express path)
Shorten the title to an action and subject; move usage details into the description.
Description99/100
Express-path gap assessment against a known target framework.
Pass the framework (soc2, iso27001, hipaa, iso42001), AI involvement (explicit), and answers to the 24 Codex foundational controls. Returns a Codex-grounded report: a 2-3 sentence framing of what the framework covers, foundational readiness per inventory and per control (with what each missing control blocks), the recommended starting point (which may be Cybersecurity Fundamentals first if foundational inventories are incomplete), an ISO 42001 stacking recommendation when AI is in product, and a scope-call brief.
Operational/advanced/expert tier gaps are intentionally not assessed by this tool — they require deep framework knowledge and live-stack inspection that belong on the scope call. The foundational tier is the substance.
If you don't yet know your framework — or want Techimpossible's perspective on which fits — call recommend_framework first.
The description explains the capability, when to use it, and what to expect.
Inputs97/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
framework
The target framework you want a gap report against.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
ai_involvement
How AI is used in the company. Explicit, never inferred. Drives ISO 42001 stacking recommendations even when the primary framework is something else.
Clear enough to supply this argument.
foundational_checks › current_org_chart
Do you maintain a current org chart that reflects every employee, contractor, and their reporting line?
Clear enough to supply this argument.
foundational_checks › idp_hr_reconciliation
Is your IdP / SSO directory reconciled against your HR system of record on a regular cadence (weekly or better)?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › jml_process
Do you have a documented joiner / mover / leaver workflow with named owners and SLAs?
Clear enough to supply this argument.
foundational_checks › contractor_inventory
Do you maintain a current list of contractors, the systems they access, and contract end dates?
Clear enough to supply this argument.
foundational_checks › production_admin_inventory
Can you produce, on demand, a list of every person with administrative access to production systems?
Clear enough to supply this argument.
foundational_checks › quarterly_access_review
Do quarterly access reviews actually happen, with documented sign-off from system owners?
Clear enough to supply this argument.
foundational_checks › vendor_list_complete
Do you maintain a current list of every third-party SaaS, processor, sub-processor, and infrastructure provider in use?
Clear enough to supply this argument.
foundational_checks › vendor_tiering
Are vendors tiered by data sensitivity and integration depth (e.g. tier-1 critical, tier-2 important, tier-3 incidental)?
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
foundational_checks › subprocessor_disclosure
Do you maintain a subprocessor list and disclose it to enterprise customers when required by contract?
Clear enough to supply this argument.
foundational_checks › tier_1_security_evidence
Do you have current SOC 2 Type II reports (or equivalent ISO 27001 certificates) on file for your tier-1 vendors?
Clear enough to supply this argument.
foundational_checks › vendor_review_cadence
Do you re-review your tier-1 vendors at least annually, and after any public incident (breach, regulator action, ownership change)?
Clear enough to supply this argument.
foundational_checks › dpa_inventory
Are your Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) catalogued by vendor, current, and accessible?
Clear enough to supply this argument.
foundational_checks › ai_tool_inventory
Can you produce a list of every AI tool actually used by employees (Copilot, Cursor, Claude, ChatGPT, Gemini, paid SaaS with AI features, etc.)?
Clear enough to supply this argument.
foundational_checks › ai_use_policy
Do you have a written policy on what data can and cannot be sent to consumer AI tools, with role-based access to sanctioned alternatives?
Clear enough to supply this argument.
foundational_checks › ai_features_in_saas_audit
Have you audited your existing SaaS subscriptions for AI features added in the last 12 months (most have shipped some)?
Clear enough to supply this argument.
foundational_checks › ai_in_product_register
Do you maintain a register of every AI system used in your product, including model provider, data inputs, and decision impact level?
Clear enough to supply this argument.
foundational_checks › ai_human_oversight
For high-impact AI decisions, is there a documented human-in-the-loop or human-on-the-loop requirement?
Clear enough to supply this argument.
foundational_checks › ai_vendor_questions
Have you updated your vendor questionnaire to ask vendors about AI in their pipelines (their data your AI sees; their AI your data flows through)?
Clear enough to supply this argument.
foundational_checks › data_classification_scheme
Do you have a documented data classification scheme (e.g. Public / Internal / Confidential / Restricted), with classification applied to actual data?
Clear enough to supply this argument.
foundational_checks › data_flow_diagrams
Do you maintain data flow diagrams that show how customer data moves through your systems, including third parties?
Clear enough to supply this argument.
foundational_checks › regulated_data_inventory
Do you maintain an explicit map of where regulated data (PHI, EU/UK PII, financial, IP/trade-secret) is stored and processed?
Clear enough to supply this argument.
foundational_checks › ropa_for_gdpr
If you process EU or UK personal data, do you maintain Records of Processing Activities (Article 30 RoPA)?
Clear enough to supply this argument.
foundational_checks › data_retention_policies
Are data retention policies defined per data class and technically enforced (not just documented)?
Clear enough to supply this argument.
foundational_checks › dpia_process
Do you have a Data Protection Impact Assessment (DPIA) process for new uses of personal data, with named approvers?
Clear enough to supply this argument.
current_state_notes
Optional free-text colour about the current state — existing certifications, prior audit history, anything the structured fields didn't capture. Echoed back in the response for context.
Clear enough to supply this argument.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
{
"title": "Gap-assess against a known framework (express path)",
"readOnlyHint": true
}
Output schema0/100
No output schema is declared. Add one for structured results so clients can interpret returned fields.
Not declared
Original tool metadata
{
"name": "gap_assess",
"description": "Express-path gap assessment against a known target framework.\n\nPass the framework (soc2, iso27001, hipaa, iso42001), AI involvement (explicit), and answers to the 24 Codex foundational controls. Returns a Codex-grounded report: a 2-3 sentence framing of what the framework covers, foundational readiness per inventory and per control (with what each missing control blocks), the recommended starting point (which may be Cybersecurity Fundamentals first if foundational inventories are incomplete), an ISO 42001 stacking recommendation when AI is in product, and a scope-call brief.\n\nOperational/advanced/expert tier gaps are intentionally not assessed by this tool — they require deep framework knowledge and live-stack inspection that belong on the scope call. The foundational tier is the substance.\n\nIf you don't yet know your framework — or want Techimpossible's perspective on which fits — call recommend_framework first.",
"inputSchema": {
"type": "object",
"required": [
"framework",
"ai_involvement",
"foundational_checks"
],
"properties": {
"framework": {
"enum": [
"soc2",
"iso27001",
"hipaa",
"iso42001"
],
"type": "string",
"description": "The target framework you want a gap report against."
},
"ai_involvement": {
"enum": [
"none",
"internal_only",
"customer_facing",
"core_product"
],
"type": "string",
"description": "How AI is used in the company. Explicit, never inferred. Drives ISO 42001 stacking recommendations even when the primary framework is something else."
},
"current_state_notes": {
"type": "string",
"maxLength": 2000,
"description": "Optional free-text colour about the current state — existing certifications, prior audit history, anything the structured fields didn't capture. Echoed back in the response for context."
},
"foundational_checks": {
"type": "object",
"required": [
"current_org_chart",
"idp_hr_reconciliation",
"jml_process",
"contractor_inventory",
"production_admin_inventory",
"quarterly_access_review",
"vendor_list_complete",
"vendor_tiering",
"subprocessor_disclosure",
"tier_1_security_evidence",
"vendor_review_cadence",
"dpa_inventory",
"ai_tool_inventory",
"ai_use_policy",
"ai_features_in_saas_audit",
"ai_in_product_register",
"ai_human_oversight",
"ai_vendor_questions",
"data_classification_scheme",
"data_flow_diagrams",
"regulated_data_inventory",
"ropa_for_gdpr",
"data_retention_policies",
"dpia_process"
],
"properties": {
"jml_process": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a documented joiner / mover / leaver workflow with named owners and SLAs?"
},
"dpia_process": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a Data Protection Impact Assessment (DPIA) process for new uses of personal data, with named approvers?"
},
"ai_use_policy": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a written policy on what data can and cannot be sent to consumer AI tools, with role-based access to sanctioned alternatives?"
},
"dpa_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are your Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) catalogued by vendor, current, and accessible?"
},
"ropa_for_gdpr": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "If you process EU or UK personal data, do you maintain Records of Processing Activities (Article 30 RoPA)?"
},
"vendor_tiering": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are vendors tiered by data sensitivity and integration depth (e.g. tier-1 critical, tier-2 important, tier-3 incidental)?"
},
"ai_tool_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Can you produce a list of every AI tool actually used by employees (Copilot, Cursor, Claude, ChatGPT, Gemini, paid SaaS with AI features, etc.)?"
},
"current_org_chart": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current org chart that reflects every employee, contractor, and their reporting line?"
},
"ai_human_oversight": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "For high-impact AI decisions, is there a documented human-in-the-loop or human-on-the-loop requirement?"
},
"data_flow_diagrams": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain data flow diagrams that show how customer data moves through your systems, including third parties?"
},
"ai_vendor_questions": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Have you updated your vendor questionnaire to ask vendors about AI in their pipelines (their data your AI sees; their AI your data flows through)?"
},
"contractor_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current list of contractors, the systems they access, and contract end dates?"
},
"vendor_list_complete": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a current list of every third-party SaaS, processor, sub-processor, and infrastructure provider in use?"
},
"idp_hr_reconciliation": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Is your IdP / SSO directory reconciled against your HR system of record on a regular cadence (weekly or better)?"
},
"vendor_review_cadence": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you re-review your tier-1 vendors at least annually, and after any public incident (breach, regulator action, ownership change)?"
},
"ai_in_product_register": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a register of every AI system used in your product, including model provider, data inputs, and decision impact level?"
},
"data_retention_policies": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Are data retention policies defined per data class and technically enforced (not just documented)?"
},
"quarterly_access_review": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do quarterly access reviews actually happen, with documented sign-off from system owners?"
},
"subprocessor_disclosure": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain a subprocessor list and disclose it to enterprise customers when required by contract?"
},
"regulated_data_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you maintain an explicit map of where regulated data (PHI, EU/UK PII, financial, IP/trade-secret) is stored and processed?"
},
"tier_1_security_evidence": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have current SOC 2 Type II reports (or equivalent ISO 27001 certificates) on file for your tier-1 vendors?"
},
"ai_features_in_saas_audit": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Have you audited your existing SaaS subscriptions for AI features added in the last 12 months (most have shipped some)?"
},
"data_classification_scheme": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Do you have a documented data classification scheme (e.g. Public / Internal / Confidential / Restricted), with classification applied to actual data?"
},
"production_admin_inventory": {
"enum": [
"present",
"partial",
"absent",
"unknown"
],
"type": "string",
"description": "Can you produce, on demand, a list of every person with administrative access to production systems?"
}
},
"description": "Answers to the 24 Codex foundational controls (6 per inventory: people, vendors, ai, data). Ask the prospect each question; record \"present\" / \"partial\" / \"absent\" / \"unknown\" honestly. \"unknown\" is a valid signal that surfaces as a thing to resolve.",
"additionalProperties": false
}
},
"additionalProperties": false
},
"annotations": {
"title": "Gap-assess against a known framework (express path)",
"readOnlyHint": true
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description99/100
Submit a request for a 30-minute intro call with Techimpossible. Stores the request in the Techimpossible inbox and returns a reference id. Call this when a user has decided they want to talk to Techimpossible — do not call unprompted.
The description explains the capability, when to use it, and what to expect.
Inputs93/100
Input documentation gives an agent enough context to populate the arguments.
name
Full name of the requester
Clear enough to supply this argument.
company
Company / organization name
Clear enough to supply this argument.
email
Work email address
Clear enough to supply this argument.
context
What the intro call should cover — programs of interest, deadlines, regulatory drivers, etc.
Clear enough to supply this argument.
Annotations25/100
Declare readOnlyHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description83/100
Version, canonical counts, source file hashes, available public catalogues and interpretation limits. Start here. Legacy list_codex_domains/get_codex_domain return nine narratives; use the taxonomy tools for canonical domains.
Describe the returned information so the agent knows whether it will answer the request.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
No input fields.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description80/100
Retrieve a canonical domain by its unchanged slug, including its scopes, descriptions, effective tiers and first steps. Domain and narrative IDs are separate namespaces.
The description explains the capability, when to use it, and what to expect.
Inputs0/100
0 of 1 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
slug
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description74/100
Search all public canonical domains, scopes and control briefs/evidence hints. Omit query to enumerate; results are paginated. Use kind=scope to list all 173 scopes. All query words must match; matching is case-insensitive. Retrieve full scope details with get_codex_scope, controls with list_codex_controls.
Describe the returned information so the agent knows whether it will answer the request.
Inputs0/100
0 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
cursor
Not provided
Missing description. Explain what this value means and how to supply it.
query
Not provided
Missing description. Explain what this value means and how to supply it.
kind
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
{
"title": "search codex",
"readOnlyHint": true
}
Output schema0/100
No output schema is declared. Add one for structured results so clients can interpret returned fields.
Not declared
Original tool metadata
{
"name": "search_codex",
"description": "Search all public canonical domains, scopes and control briefs/evidence hints. Omit query to enumerate; results are paginated. Use kind=scope to list all 173 scopes. All query words must match; matching is case-insensitive. Retrieve full scope details with get_codex_scope, controls with list_codex_controls.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"kind": {
"enum": [
"all",
"domain",
"scope",
"control"
],
"type": "string",
"default": "all"
},
"limit": {
"type": "integer",
"default": 20,
"maximum": 50,
"minimum": 1
},
"query": {
"type": "string",
"default": "",
"maxLength": 200
},
"cursor": {
"type": "string",
"maxLength": 2048
}
},
"additionalProperties": false
},
"annotations": {
"title": "search codex",
"readOnlyHint": true
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description89/100
Retrieve one canonical scope (subdomain): definition, parent domain, effective tier, canonical effort/first step and evidence coverage. Null first_step means no canonical first step is authored; do not invent one. Use list_codex_controls(scope_slug) for paginated evidence expectations.
The description explains the capability, when to use it, and what to expect.
Inputs0/100
0 of 1 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
slug
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description63/100
Page through canonical prerequisite edges. from must precede to; hard is required, soft is recommended. Omit slug for all edges. With slug, direction=prerequisites walks incoming edges, dependents walks outgoing edges. transitive=true traverses the selected edge kind; hard traversal gives the required prerequisite closure.
Describe the returned information so the agent knows whether it will answer the request.
Inputs0/100
0 of 6 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
cursor
Not provided
Missing description. Explain what this value means and how to supply it.
slug
Not provided
Missing description. Explain what this value means and how to supply it.
kind
Not provided
Missing description. Explain what this value means and how to supply it.
direction
Not provided
Missing description. Explain what this value means and how to supply it.
transitive
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description60/100
Page through the canonical closed Pareto-40 profile: 35 majority scopes plus five required hard prerequisites. Preserve the roles and rationale; membership is not an 80% effectiveness claim. All hard prerequisites of the selected set are included.
Describe the returned information so the agent knows whether it will answer the request.
Inputs0/100
0 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
cursor
Not provided
Missing description. Explain what this value means and how to supply it.
role
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description73/100
Page through explicitly public catalogue control IDs, Techimpossible briefs, scope mapping hints and evidence expectations. Filters may select framework, native control_id or canonical scope_slug. Official control-title lists, held catalogues and private workspace automation are excluded. No invented equivalence mappings.
Describe the returned information so the agent knows whether it will answer the request.
Inputs0/100
0 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
cursor
Not provided
Missing description. Explain what this value means and how to supply it.
framework
Not provided
Missing description. Explain what this value means and how to supply it.
control_id
Not provided
Missing description. Explain what this value means and how to supply it.
scope_slug
Not provided
Missing description. Explain what this value means and how to supply it.
Annotations25/100
Declare destructiveHint, idempotentHint, openWorldHint based on the tool’s actual behavior.
A few tasks worth trying with this server, chosen from its reviewed tools. These have not been run.
01List Techimpossible programsList the consulting programs Techimpossible offers.
02Search codexSearch all public canonical domains, scopes and control briefs/evidence hints.
03List Codex domainsLegacy narrative catalogue: list the Codex domain overviews published on this server — the free narrative slice of the Techimpossible Codex, a prerequisite g…
04Get Techimpossible program detailReturn the full markdown description of one Techimpossible consulting program identified by slug.
05Get Codex domain detailReturn the full markdown overview of one Codex cybersecurity domain identified by slug.
Want to run these tasks against your MCP server with us?
mcp.techimpossible.com setup, tools, quality score, publishing readiness, and alternatives.
How do I add mcp.techimpossible.com to Claude, ChatGPT, or Cursor?
Add mcp.techimpossible.com to Claude, ChatGPT, or Cursor by connecting its remote MCP URL in each client's MCP settings. In Claude, add a custom connector. In ChatGPT, add an MCP app. In Cursor, add an MCP server under Settings. The MCP URL is https://mcp.techimpossible.com/mcp.
Is mcp.techimpossible.com MCP ready for ChatGPT and Claude?
As of October 14, 2026, mcp.techimpossible.com scores 94/100 on Manufact's MCP publishing checklist. The scan does not yet meet ChatGPT publishing checks and meets Claude publishing checks. Passing these checks does not guarantee marketplace approval.
How clear is mcp.techimpossible.com's MCP tool documentation?
As of October 14, 2026, mcp.techimpossible.com scores 62/100 in Manufact's review of tool titles, descriptions, input and output schemas, and behavior annotations. The review covers 15 of 15 discovered tools. The quality score measures documentation clarity; runtime behavior and marketplace readiness require separate checks.
How can mcp.techimpossible.com improve its MCP documentation?
get_codex_pareto is the lowest-scoring reviewed tool at 36/100. 0 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values. Open its review for feedback and a copyable fix prompt, then rerun the documentation review after updating your tool metadata.
Not your MCP?
Review any public or OAuth MCP server for protocol compatibility, tool documentation, and ChatGPT and Claude publishing readiness. No account required.