Exepal

Launch scan (website safety and basics)

launch_scan

Read-onlyIdempotent

Pre-launch check of a live website: leaked keys in JavaScript bundles, public .env/.git, HTTPS and security headers, Google and link-preview basics, email spoofing protection (SPF/DMARC/DKIM), domain expiry and AI readiness, with a copy-paste fix prompt for each problem. Use before or after a site goes live, for apps built with Lovable, Bolt, Cursor or Claude Code, or on every deploy in CI. About 40 requests to the site and its DNS; no login, nothing intrusive. Returns domain, url, score 0-100, grade A-F, counts {pass, warn, fail, info}, sections[] {id secrets/security/seo/email/ai, title, items[] {id, status, title, detail, fix}}, aiReadiness and summary. Not charged when the site can't be reached. For a report to send to a non-technical client, use client_report. Price: $0.02 per call from Exepal credit; not charged if the call fails.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "launch_scan"
  }
}

Input Schema

Name	Required	Description	Default
`url`	Yes	The live site to check, e.g. https://example.com (a bare domain works too)

Output Schema

Name	Required	Description
`url`	No
`grade`	No	A-F
`score`	No	0-100
`counts`	No
`domain`	No
`scripts`	No
`summary`	No
`sections`	No
`fetchedAt`	No	ISO 8601
`aiReadiness`	No

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 8, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/openWorld, and the description adds cost and safety context that annotations cannot: ~40 requests to site and DNS, no login, nothing intrusive, $0.02 per call from Exepal credit, and no charge when the site is unreachable or the call fails. It also summarizes the shape of the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose and scope, and every later sentence (usage, cost, no-charge cases, return shape) carries real decision value. The first sentence is a very long comma-chained run-on, and the return-value inventory is partly redundant with the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only scanning tool this is complete: scope, preconditions (live site, no login), cost and failure billing, sibling alternative, and result outline are all covered. Nothing an agent needs in order to decide and invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema description coverage ("The live site to check, e.g. https://example.com (a bare domain works too)"), so the schema already carries the semantic load. The description adds no extra syntax or edge-case guidance about the url itself, which matches the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ("Pre-launch check of a live website") and then enumerates the concrete check families: leaked keys, public .env/.git, HTTPS/headers, SEO/link previews, SPF/DMARC/DKIM, domain expiry, AI readiness. It is clearly distinguishable from siblings like client_report and the individual scan_* tools, which cover single concerns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States explicit trigger conditions ("before or after a site goes live", "on every deploy in CI") and named builder contexts (Lovable, Bolt, Cursor, Claude Code), and routes to the alternative "For a report to send to a non-technical client, use client_report." When-to-use and when-to-use-something-else are both present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Exepal tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?