vercelpycheck
Server Details
Scan a public GitHub repo for known Vercel Python-runtime deploy footguns.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
TDQS
Scored across 1 tool
There is only one tool, so there is no possibility of confusing it with another tool. Its purpose is clearly stated and the tool name matches its function.
The single tool name follows a clear verb_noun pattern, and with only one tool there are no conflicting conventions to create inconsistency.
A single tool makes the server feel thin, though the server's narrow purpose as a static analyzer for Vercel Python projects is a reasonable fit for one operation. Splitting checks into separate tools could feel more complete, but the current count is borderline.
The tool covers a broad set of known Vercel Python-runtime footguns in a single static-analysis passcase. However, it does not run a real build, and scanning a remote GitHub repo requires leaving the MCP server, which leaves some gaps for projects that need deeper validation.
Available Tools
1 toolcheck_vercel_python_projectAInspect
Scan pasted project files for known Vercel Python-runtime deploy footguns: conflicting requirements.txt/pyproject.toml manifests, a dependency manifest missing from the project root, sibling-module imports that need sys.path, multiple top-level ASGI apps under api/, streaming/SSE responses that can crash the Python runtime, oversized dependencies (torch/tensorflow/etc.), and unrouted .well-known/ files. Static analysis over file contents -- it doesn't run a real build, so a clean result means 'no known footgun found,' not a deploy guarantee. To scan a public GitHub repo automatically instead of pasting files, use the $9 checkout at https://www.edgethirteen.com/tools/vercelpycheck.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | Project files bundled as repeated '### FILE: path' markers followed by that file's content, e.g. '### FILE: requirements.txt\nfastapi\n### FILE: api/index.py\n...'. Include api/*.py files plus root manifests (requirements.txt, pyproject.toml, vercel.json, uv.lock). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral disclosure. It explicitly says the tool performs 'static analysis over file contents' and does not run a real build, meaning a clean result does not guarantee deployability. This prevents the agent from treating the output as a definitive deployment verdict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded, but the description is one long run-on sentence with a dense embedded checklist and ends with a paid-upgrade URL. The detection list is useful, but splitting it into a short purpose statement, a structured checklist, and a usage alternative would improve clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with a fully documented schema, the description covers scope, methodology, limitations, and an alternative workflow. It does not spell out the exact return format, but it defines what a clean result means, which is adequate given the absence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage, including a concrete '### FILE: path' example and guidance on which files to include. The description's mention of 'pasted project files' aligns with the schema but adds no new parameter-level semantics beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and object: 'Scan pasted project files for known Vercel Python-runtime deploy footguns' and then enumerates concrete detection categories. It also distinguishes itself from a repo-based scan by pointing to an automatic alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the intended input ('pasted project files') and gives an explicit alternative for public GitHub repos via the checkout tool. It also cautions that a clean result is not a deploy guarantee, which tells the agent when not to over-trust the outcome.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
check_vercel_python_project3 fields changed- added
Input schema / properties / filesAdded value: +{ + "description": "Project files bundled as repeated '### FILE: path' markers followed by that file's content, e.g. '### FILE: requirements.txt\\nfastapi\\n### FILE: api/index.py\\n...'. Include api/*.py files plus root manifests (requirements.txt, pyproject.toml, vercel.json, uv.lock).", + "type": "string" +} - removed
Input schema / properties / repoRemoved value: -{ - "description": "A github.com/owner/name URL for the public repo to scan", - "type": "string" -} - changed
Input schema / requiredPrevious value: -[ - "repo" -]New value: +[ + "files" +]
1 tool update
- First observed
check_vercel_python_project
Related MCP Connectors
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Free deterministic security scan of public git repos: OSV.dev vulnerable deps, secrets, config lint.
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Related MCP Servers
- AlicenseAqualityAmaintenanceLocal-only GitHub Actions and CI maintenance scanner for AI-built apps. Exposes scan, explanation, and fix-planning tools to MCP clients; modifies nothing and makes no outbound requests by default.3113 npm2MIT
- FlicenseNot gradedqualityCmaintenanceEnables users to profile public GitHub repositories via a single tool, checking for Spring/Java structure such as pom.xml, src/main/java, Java file counts, and Spring layer annotations to assess suitability for deep local analysis.-
- AlicenseNot gradedqualityAmaintenanceDetect live website vulnerabilities and security flaws in GitHub repositories using automated DAST and SAST scanning. Safeguard applications by identifying exposed secrets, insecure dependencies, and common code patterns prone to exploitation. Receive structured fix plans with precise code remediation steps to resolve identified risks and improve security posture.2MIT
- AlicenseNot gradedqualityCmaintenanceEnables agents to run static heuristic scans over a repository path via stdio, surfacing review candidates with file:line evidence for web3 auth and payment vulnerability patterns. Results can be used as CI-style gates or triage input without any dataflow analysis or external dependencies.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.