Skip to main content
Glama

Run the ship check

check_project
Read-only

SPOE's ship check on the project as it stands, free and with no AI: keys written in the code, SQL or shell commands built from text, raw HTML, cookies accepted from any site, routes that change data without sign-in, and what search engines will miss. The same check every export ships as check.mjs. A critical finding stops a publish until the owner confirms it, so fix those with write_files first.

Input Schema

NameRequiredDescriptionDefault
project_idYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true and openWorldHint=false, and the description adds meaningful behavior beyond that: it is free and non-AI, lists what it checks, notes that it is the same check exported as check.mjs, and discloses the publish-gating behavior for critical findings. This adds useful operational context without contradicting the read-only annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two dense sentences with the core operation front-loaded followed by the critical-finding and write_files guidance. Every clause contributes something useful: what is checked, the export equivalence, and the publish gate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only check with annotations covering safety and no output schema, the description is largely complete: it explains scope, behavioral impact, and remediation path. It stops short of describing the result format or how to obtain project_id, but the annotation coverage reduces the burden on the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter, project_id, but schema description coverage is 0% and the description does not specify its format, where to obtain it, or how it is interpreted. The phrase 'on the project as it stands' only weakly implies that project_id identifies the target, leaving the parameter largely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: a ship check on the project as it stands. It enumerates the exact classes of issues checked (hardcoded keys, generated SQL/shell, raw HTML, permissive cookies, unauthenticated data-changing routes, SEO misses), which makes the tool clearly distinct from siblings like app_status or check_handle. Naming write_files as the follow-up for critical findings further clarifies its role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: the check is run before publish/export, critical findings stop a publish until owner confirmation, and those should be fixed with write_files first. It does not explicitly state when not to use it or compare directly against sibling tools such as check_handle, so it falls short of a full when/when-not/alternatives treatment.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources