check_security_exposureGiven a package and the version you are running, return the known vulnerabilities that affect it, worst first, each with the version that fixes it. Advisories whose affected range could not be parsed are returned under undetermined; treat undetermined as unanswered, never as safe.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | ||
| version | Yes | ||
| ecosystem | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond the readOnly and idempotent annotations by detailing the output format: 'worst first, each with the version that fixes it' and the handling of unparsable advisories under 'undetermined'. This adds meaningful behavioral context about what the caller should expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and front-loaded with the core purpose. The extra clarification about undetermined advisories is relevant and adds value without unnecessary verbosity. There is no filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the main input and output expectations, including the order of results and the handling of edge cases (undetermined advisories). It lacks an explicit statement about the case where no vulnerabilities are found, and the ecosystem parameter remains unexplained, but overall it provides sufficient context for typical usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains the role of 'package' and 'version' by stating they are the inputs for the vulnerability check. However, 'ecosystem' is not mentioned or elaborated, leaving its purpose unclear. Since the schema provides no descriptions (coverage 0%), the description partially compensates but misses one parameter entirely.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Given a package and the version you are running, return the known vulnerabilities that affect it'. It specifies the verb 'return' and the resource (vulnerabilities for a package/version), and distinguishes itself by noting the output order ('worst first') and the inclusion of fixing versions. This is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool ('Given a package and the version you are running') and provides interpretive guidance ('treat undetermined as unanswered, never as safe'). It does not explicitly contrast with sibling tools like lookup_vulnerability, but the scenario is clearly defined, making it easy for an agent to decide when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.