Skip to main content
Glama

Server Details

Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.2/5 across 9 of 9 tools scored.

Server CoherenceA
Disambiguation5/5

Each tool has a clearly distinct purpose: fetching rules, market reports, scan history, listing jurisdictions/apps, registering, scanning (quick vs full), and verifying signatures. No two tools do the same thing.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case (e.g., get_compliance_rules, scan_app, verify_record). No mixing of conventions.

Tool Count5/5

Nine tools is well-scoped for a compliance scanning service. It covers registration, scanning (two types), reporting, and verification without being excessive.

Completeness4/5

The set covers core workflows: app registration, scanning (quick and full), retrieving results, rule/jurisdiction lookup, and signature verification. Missing a delete/unregister tool, but that is a minor gap.

Available Tools

9 tools
get_compliance_rulesGet sourced compliance rule snapshotsA
Read-onlyIdempotent
Inspect

Fetch LaunchTrust's sourced, founder-reviewed compliance rule snapshots, optionally filtered to one jurisdiction code (e.g. eu-ai-act-50, gdpr, ca-sb243). Compliance aid, not legal advice.

ParametersJSON Schema
NameRequiredDescriptionDefault
jurisdictionNoOptional jurisdiction code to filter by, e.g. gdpr or eu-ai-act-50.
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds qualitative context ('founder-reviewed', 'compliance aid'), but does not disclose additional behavioral traits beyond what annotations cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, no wasted words, and front-loads the core purpose. The disclaimer is a necessary addition without clutter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool (one optional param, no output schema, complete annotations), the description provides sufficient context. It explains the data source and nature, and the sibling tools are distinct enough to avoid confusion.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for the jurisdiction parameter. The tool description repeats the parameter's purpose but adds no new meaning beyond examples. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Fetch', the resource 'compliance rule snapshots', and specifies they are 'sourced, founder-reviewed'. It mentions optional filtering by jurisdiction code, making the tool's purpose distinct from siblings like get_market_report or list_jurisdictions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates when to use (fetching compliance rules) and provides a disclaimer, but does not explicitly state when not to use it or compare to siblings like list_jurisdictions for obtaining valid jurisdiction codes. There is no guidance on alternatives or context for bypassing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_market_reportGet a market-annotated compliance reportA
Read-onlyIdempotent
Inspect

Get the latest scan for one of your registered apps, with each finding annotated by the jurisdictions and rules applicable to that app's target markets. Requires a LaunchTrust token.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_idYesThe id of a registered app.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds the authentication requirement (LaunchTrust token) and specifies 'latest scan', which provides additional behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words, front-loading the main action and adding the auth note. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the single parameter, no output schema, and rich annotations, the description is largely complete. It explains the content (market annotations) and auth requirement. Could mention output structure but is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single parameter (app_id) described as 'The id of a registered app.' The description does not add further meaning, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves the latest scan with market annotations for a registered app, using specific verbs and resources. It distinguishes from siblings like get_scan_history (which likely returns raw scans) and get_compliance_rules (which returns rules).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the requirement for a LaunchTrust token, but does not explicitly state when to use this tool over alternatives or provide exclusions (e.g., for historical scans use get_scan_history). Usage context is implied but not fully elaborated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_scan_historyGet scan history for an appA
Read-onlyIdempotent
Inspect

List recent scans (summary + findings) for one of your registered apps. Requires a LaunchTrust token.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_idYesThe id of a registered app.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the safety profile is clear. The description adds value by specifying the output contains both summary and findings, which is beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences totaling 17 words. Every word is functional, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and strong annotations, the description is largely complete. It specifies the output type (summary + findings). The absence of pagination details is a minor gap, but acceptable given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single parameter app_id, which already has a description. The description does not add further meaning to the parameter beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List recent scans (summary + findings) for one of your registered apps.' The verb is specific ('list'), the resource is 'scans', and the scope is delineated. It is distinct from sibling tools like get_compliance_rules or scan_app.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a prerequisite ('Requires a LaunchTrust token') and implies the tool is for registered apps, but does not explicitly guide when to use this tool over alternatives or note when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_jurisdictionsList compliance jurisdictions coveredA
Read-onlyIdempotent
Inspect

List the jurisdictions and categories LaunchTrust tracks (e.g. EU AI Act, GDPR, US state privacy laws, app-store policies). Public coverage registry. Compliance aid, not legal advice.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds behavioral context: 'Public coverage registry' and 'Compliance aid, not legal advice' clarify the tool's nature and limitations. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with front-loaded action and examples. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is simple with no parameters, annotations, and no output schema, the description provides adequate completeness. It explains the output scope and adds a disclaimer. Could mention that the result is a list, but not necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so no parameter documentation is needed. The description adds meaning by specifying the content of the output (jurisdictions, categories, examples), which helps the agent understand what will be returned.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool lists jurisdictions and categories with concrete examples (EU AI Act, GDPR, US state privacy laws, app-store policies). It clearly identifies the action (list) and the resource (jurisdictions/categories), and distinguishes itself from siblings like get_compliance_rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates this is a public coverage registry and compliance aid, implying it is for checking covered jurisdictions. However, it does not explicitly state when to use this tool versus alternatives like get_compliance_rules, though the purpose is clear enough for an agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_my_appsList your registered appsA
Read-onlyIdempotent
Inspect

List the apps registered in your LaunchTrust account, with each one's latest scan status. Requires a LaunchTrust token.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and idempotentHint, so the bar is lower. The description adds context about requiring a LaunchTrust token and that it returns the latest scan status, which goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no wasted words, front-loaded with the action and resource. Efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description is sufficient: it tells what the tool lists, additional data (scan status), and auth requirement. The complexity is low, so it is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so schema description coverage is 100%. The description adds no parameter info, but with zero parameters, baseline is 4 as it cannot add more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists registered apps with the latest scan status, using specific verb 'List' and resource 'apps'. It distinguishes from siblings like 'register_app' (creation) and 'scan_app' (scanning) by focusing on listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for viewing registered apps but does not explicitly state when to use vs alternatives or provide exclusions. It mentions requires a token, which is basic context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

register_appRegister an app to monitorA
Idempotent
Inspect

Register a web URL in your LaunchTrust account so it can be fully scanned and monitored. Idempotent — if the URL is already registered, returns the existing app. Requires a LaunchTrust token and an active subscription.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic https URL of the app to register.
nameNoOptional label (defaults to the hostname).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds value beyond annotations by specifying idempotent behavior and prerequisites (token, subscription); no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with main action; no redundant information, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for a registration tool with idempotency and safety annotations; missing return structure details but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and description does not add new information beyond what schema already provides (e.g., defaults to hostname).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'register' and the resource 'web URL' for monitoring, distinguishing it from sibling tools like scan_app or list_my_apps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit context with 'Requires a LaunchTrust token and an active subscription' and notes idempotency, but no direct mention of when not to use or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_appRun a full signed scan on a registered appAInspect

Run the full LaunchTrust scan on one of your registered apps and store a signed, dated evidence record. Requires a LaunchTrust token and an active subscription. Limited to 5 scans per app per day.

ParametersJSON Schema
NameRequiredDescriptionDefault
app_idYesThe id of a registered app (see list_my_apps or register_app).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false and destructiveHint=false, and the description adds critical behavioral details: the scan creates a signed evidence record (non-read-only), requires a token and subscription, and has a daily limit. No contradictions with annotations; description enriches the agent's understanding of side effects and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences covering action, requirements, and limit with zero redundancy. Every sentence adds essential information; it's front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers all necessary aspects: what it does, prerequisites, constraints, and result (signed evidence record). It is fully sufficient for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'app_id', which already includes a description referencing list_my_apps or register_app. The tool description doesn't add new semantic details beyond that, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Run'), the resource ('full LaunchTrust scan on a registered app'), and the outcome ('store a signed, dated evidence record'). It distinguishes from siblings like scan_url and get_scan_history by focusing on registered apps and signed records.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit prerequisites (LaunchTrust token, active subscription) and a usage constraint (limit of 5 scans per app per day). It doesn't explicitly say when not to use this tool vs alternatives, but the context signals and purpose make it clear for registered apps vs URLs (scan_url) or history retrieval.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_urlFree compliance + security quick-scanA
Read-onlyIdempotent
Inspect

Run a FREE LaunchTrust compliance + security quick-scan on a public web URL. Returns a focused SUBSET of checks — leaked frontend secrets/API keys, exposed .env//.git, security headers, HTTPS/HSTS, missing privacy/terms pages, trackers/cookie banner, and AI-interaction disclosure. The result is unsigned and not stored. The full 27-detector signed, dated, continuously-monitored scan requires a LaunchTrust account. Compliance aid, not legal advice.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic http(s) URL to scan, e.g. https://example.com
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide read-only, idempotent, non-destructive hints. Description adds that the result is unsigned and not stored, and specifies the subset of checks. Adds behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is somewhat long but each sentence is informative. Well-structured with front-loaded action. Could be slightly tighter but overall effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers all necessary context: purpose, scope of checks, storage policy, and disclaimer. Complete given complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of the single parameter with a clear description. Description doesn't add extra meaning beyond schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool runs a quick-scan on a public web URL for compliance and security checks, listing specific checks (leaked secrets, security headers, etc.). It distinguishes from the full scan requiring an account.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Indicates the scan is free, returns a subset of checks, not stored, and is a compliance aid not legal advice. Implicitly guides when to use this vs. full scan but lacks explicit when-not or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_recordVerify a LaunchTrust signed recordA
Read-onlyIdempotent
Inspect

Independently verify the ECDSA (ES256) signature on a LaunchTrust signed scan/disclosure record against the published public key. Pass the record JSON (the downloaded record, or an object containing canonical and signature).

ParametersJSON Schema
NameRequiredDescriptionDefault
recordYesThe LaunchTrust signed record JSON (or an object with `canonical` + `signature`).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint, idempotentHint, destructiveHint=false. Description adds verification against published public key, no side effects stated. Acceptable for a safe operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with front-loaded purpose. Every word adds value, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for input specification but lacks output description. With no output schema, describing return value (e.g., boolean) would be beneficial. Minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameter with identical description. Tool description repeats schema text. No additional semantic value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states specific verb 'verify' and resource 'ECDSA signature on a LaunchTrust signed record', includes algorithm and key source, clearly distinguishing from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear context for when to use (independently verify a signed record), but no explicit when-not-to-use or alternative tool mentions. Sibling list lacks verification tools, so implied usage is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Try in Browser

Your Connectors

Sign in to create a connector for this server.

Resources