Server Quality Checklist
Latest release: v1.0.0
- Disambiguation4/5
Most tools have distinct purposes targeting different security activities (compliance, remediation, rule management, false positives, pentesting, network scanning, project scanning), though 'scan_network' and 'scan_project' could potentially overlap in scope if network scanning is part of project scanning. The descriptions help clarify their boundaries, with only minor ambiguity.
Naming Consistency4/5Tools follow a consistent verb_noun pattern throughout (e.g., check_compliance, generate_remediation, manage_custom_rules), with all using snake_case. The only deviation is 'pentest_application' which uses 'pentest' as a verb instead of a more standard verb like 'perform_pentest', but this is minor and still readable.
Tool Count5/5With 7 tools, the count is well-scoped for a security-focused server, covering key areas like scanning, testing, compliance, and management. Each tool appears to earn its place without feeling too thin or bloated, fitting typical server tool ranges (3-15 tools).
Completeness4/5The toolset provides good coverage for security operations, including scanning (network and project), testing (pentest), compliance validation, remediation generation, and rule/false positive management. Minor gaps might include tools for reporting results or integrating with external systems, but core workflows are well-covered and agents can likely work around these omissions.
Average 2.7/5 across 7 of 7 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No issues in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
Add a LICENSE file by following GitHub's guide. Once GitHub recognizes the license, the system will automatically detect it within a few hours.
If the license does not appear after some time, you can manually trigger a new scan using the MCP server admin interface.
MCP servers without a LICENSE cannot be installed.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add
glama.jsonto the root of your repository:{ "$schema": "https://glama.ai/mcp/schemas/server.json", "maintainers": [ "your-github-username" ] }Then . Browse examples.
Add related servers to improve discoverability.
Tool Scores
- Behavior1/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but fails completely. 'Manage' implies mutation operations, but the description doesn't specify permissions required, whether changes are destructive, rate limits, error conditions, or what happens when rules conflict. For a tool with multiple actions including 'add', 'update', and 'remove', this lack of behavioral context is a critical gap that leaves the agent guessing about the tool's operational characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words, which could be appropriate if it were more informative. However, this brevity comes at the cost of under-specification rather than efficient communication. While it's front-loaded (the entire description is the single phrase), it fails to convey necessary information about this multi-action tool. The structure is minimal but not effectively informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple actions, nested object parameter, no annotations, no output schema), the description is woefully incomplete. A tool with 8 different actions including potentially destructive operations like 'remove' needs far more context about behavior, outcomes, and appropriate usage. The description doesn't compensate for the lack of annotations or output schema, leaving critical gaps in understanding how this tool operates and what results to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, providing detailed documentation for all parameters including the 'action' enum values and the complex 'rule' object structure. The description adds no parameter semantics beyond what's already in the schema - it doesn't clarify relationships between parameters (e.g., that 'rule' is required for 'add' but not for 'list'), nor does it provide examples or context about what constitutes a valid rule definition. The baseline score of 3 reflects adequate schema coverage with no added value from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Manage custom security rules' is essentially a tautology that restates the tool name 'manage_custom_rules' without adding meaningful specificity. It doesn't clarify what 'manage' entails (CRUD operations, enable/disable, validation) or what 'security rules' are in this context. While the name suggests security rules, the description doesn't distinguish this tool from potential siblings like 'check_compliance' or 'manage_false_positives'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, appropriate contexts, or exclusions. Given siblings like 'check_compliance' and 'manage_false_positives', an agent would have no indication whether this tool is for rule creation/maintenance versus rule application or false positive handling. The description is too generic to offer any usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Manage false positive suppressions' implies mutation operations (add/remove) and read operations (list/filter), but it doesn't specify permissions needed, whether changes are reversible, rate limits, or what the response looks like. For a tool with multiple actions and no annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste. It's appropriately sized for a tool name that implies its function, though it could be more front-loaded with operational details. Every word earns its place, but the brevity contributes to underspecification rather than optimal clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple actions, security domain) and lack of annotations and output schema, the description is incomplete. It doesn't explain return values, error conditions, or behavioral nuances. For a tool that likely involves critical security operations like suppressing findings, more context is needed to ensure safe and correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters (action, findingId, reason) with descriptions and enum values. The description adds no additional meaning beyond what the schema provides, such as explaining how parameters interact or providing examples. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose2/5Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Manage false positive suppressions' is a tautology that essentially restates the tool name 'manage_false_positives'. It lacks a specific verb indicating what operations are performed (add, remove, list, filter) and doesn't distinguish this tool from sibling tools like 'manage_custom_rules' or 'check_compliance'. While it mentions the resource domain (false positive suppressions), the purpose remains vague without operational details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description doesn't mention prerequisites, context (e.g., after a scan), or exclusions. Sibling tools like 'check_compliance' or 'generate_remediation' might overlap in security contexts, but there's no explicit comparison or usage scenarios to help an agent decide appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions 'within project boundaries', which adds some context about scope, but fails to describe critical behaviors such as whether this is a read-only or destructive operation, permission requirements, rate limits, or expected output format. For a network scanning tool with zero annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's purpose and scope without unnecessary elaboration. It is appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of network scanning (which can involve security implications and varied outputs), the description is incomplete. With no annotations, no output schema, and minimal behavioral context, it fails to provide enough information for an agent to understand the tool's full impact, such as whether it's safe to use, what results to expect, or how it differs from siblings. This leaves significant gaps in contextual understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with clear descriptions for all three parameters (e.g., 'Port range to scan', 'Network target'). The description adds no additional meaning beyond what the schema provides, such as examples or usage notes. Since the schema does the heavy lifting, the baseline score of 3 is appropriate, as the description doesn't compensate but also doesn't detract.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5Does the description clearly state what the tool does and how it differs from similar tools?
The description states the action ('Performs network scanning') and scope ('within project boundaries'), which provides a basic understanding of what the tool does. However, it lacks specificity about what 'network scanning' entails (e.g., port scanning, vulnerability detection) and doesn't clearly distinguish it from sibling tools like 'scan_project' or 'pentest_application', leaving room for ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance by mentioning 'within project boundaries', which hints at a scope constraint. However, it offers no explicit advice on when to use this tool versus alternatives like 'scan_project' or 'pentest_application', nor does it specify prerequisites or exclusions, leaving the agent with little direction on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While 'validates' implies a read-only assessment, the description doesn't specify whether this tool requires special permissions, whether it modifies anything, what the validation process entails, or what happens with the results. For a compliance validation tool with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that states the core functionality without unnecessary words. It's appropriately sized for a tool with three parameters and gets straight to the point with zero wasted content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of compliance validation and the absence of both annotations and an output schema, the description is incomplete. It doesn't explain what the validation produces (e.g., a report, pass/fail status, detailed findings), how results are structured, or what behavioral constraints apply. For a tool that likely produces important compliance assessment results, this leaves significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so all parameters are well-documented in the schema itself. The description doesn't add any meaningful parameter semantics beyond what's already in the schema descriptions (e.g., explaining what 'frameworks' represent or how 'path' is interpreted). This meets the baseline expectation when schema coverage is complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('validates') and resource ('project against compliance frameworks'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'scan_project' or 'pentest_application', which might have overlapping security/compliance functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With sibling tools like 'scan_project' and 'pentest_application' that might serve related security purposes, there's no indication of when validation against compliance frameworks is preferred over other scanning or testing approaches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool generates advice but doesn't cover critical aspects like whether this is a read-only operation, if it requires specific permissions, what the output format might be, or any rate limits. This is a significant gap for a tool that likely interacts with findings data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that directly states the tool's purpose without any fluff or redundancy. It is appropriately sized and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of generating remediation advice, the lack of annotations and output schema, and the presence of sibling tools, the description is incomplete. It doesn't explain the output format, behavioral traits, or how it differs from other tools, leaving the agent with insufficient context to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the parameter 'findingIds' clearly documented in the schema. The description adds no additional meaning beyond what the schema provides, such as explaining what constitutes a valid ID or how the advice is generated. Given the high schema coverage, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('generate') and the resource ('actionable remediation advice for findings'), making the purpose understandable. However, it doesn't differentiate this tool from sibling tools like 'manage_false_positives' or 'check_compliance', which might also involve findings remediation, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'manage_false_positives' or 'check_compliance'. It lacks explicit context, prerequisites, or exclusions, leaving the agent to infer usage based on the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action ('performs penetration testing') but doesn't describe critical traits like whether this is a read-only or destructive operation, permission requirements, rate limits, or what the output looks like. For a potentially invasive security tool, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero waste—it directly states the tool's purpose without unnecessary words. It's appropriately sized and front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of penetration testing (a potentially invasive operation), lack of annotations, and no output schema, the description is incomplete. It doesn't address behavioral risks, output format, or usage context, which are critical for an agent to invoke this tool safely and effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters (depth, targetUrl, testTypes) with descriptions and an enum for depth. The description adds no additional meaning beyond what the schema provides, such as explaining what 'quick' vs 'thorough' entails or typical test types. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('performs penetration testing') and resource ('on deployed applications'), making the purpose understandable. However, it doesn't differentiate this tool from sibling tools like 'scan_network' or 'scan_project', which might also involve security testing but on different targets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'scan_network' or 'check_compliance'. It lacks explicit when/when-not scenarios, prerequisites, or named alternatives, leaving the agent to infer usage context from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
- Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. While 'performs comprehensive security scan' implies a read-only analysis operation, it doesn't specify whether this requires special permissions, has side effects (e.g., generating logs), involves rate limits, or what the output format might be. The description is too minimal for a tool with security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with zero wasted words. It's appropriately sized for a tool with good schema documentation and gets straight to the point without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a security scanning tool with no annotations and no output schema, the description is inadequate. It doesn't explain what 'comprehensive' means, what security aspects are scanned, what the typical output contains, or how this differs from sibling tools. Given the complexity of security operations, more context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters thoroughly. The description adds no additional parameter semantics beyond what's in the schema, meeting the baseline expectation when structured data does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('performs comprehensive security scan') and target ('on project directory'), providing a specific verb+resource combination. However, it doesn't explicitly distinguish this tool from sibling tools like 'check_compliance' or 'pentest_application', which might also involve security assessments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'check_compliance' or 'pentest_application'. It doesn't mention prerequisites, appropriate contexts, or exclusions, leaving the agent with no usage differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
GitHub Badge
Glama performs regular codebase and documentation scans to:
- Confirm that the MCP server is working as expected.
- Confirm that there are no obvious security issues.
- Evaluate tool definition quality.
Our badge communicates server capabilities, safety, and installation instructions.
Latest Blog Posts
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/NeoTecDigital/mcp_shamash'
If you have feedback or need assistance with the MCP directory API, please join our Discord server