Moltline Code Review & AI-Code Verifier

Secret Scan

secret_scan

Read-onlyIdempotent

Scan text for accidentally-committed machine credentials and private-key material. FREE.

Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": ""}], "note": "..."}.

Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`text`	Yes	The file, diff, or config contents to scan, pasted as a single string.

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

TDQS

A5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, destructiveHint, idempotentHint), the description adds important behavioral details: it never echoes matched values, errors return an error object instead of protocol errors, and every call is idempotent and safe to retry. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a clear purpose statement, then output and behavioral details, followed by limitations and error handling. Every sentence adds essential information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, clear annotations, and an output schema), the description covers all necessary context: input format, output structure, error handling, idempotency, and limitations. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only one parameter and 100% schema coverage, the description adds significant value by showing the exact input format and expected response structure. It also clarifies error behavior on invalid input, which goes well beyond the schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Scan text for accidentally-committed machine credentials and private-key material,' using a specific verb and resource. It explicitly distinguishes itself from the sibling tool security_deep_dive by noting it is 'Not a general security review.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use (scanning for leaked credentials) and when not (not for general security reviews, names the alternative security_deep_dive). Also advises that clean results are not proof and require human confirmation before action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Moltline Code Review & AI-Code Verifier tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.6/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: AI smell detection, structural complexity, persona loading, checklist generation, diff risk scanning, secret scanning, and security deep dive. No two tools overlap in function, and descriptions explicitly state what each should not be used for.

Naming Consistency4/5

All tool names use snake_case and are readable. However, the pattern varies: some are verb_noun (get_reviewer_persona, secret_scan) while others are noun phrases (complexity_report, review_diff). This minor inconsistency prevents a perfect score.

Tool Count5/5

Seven tools cover the code review domain well without being excessive. Each tool addresses a specific aspect of code quality, security, and AI authorship detection. The scope is focused and no tool seems superfluous.

Completeness4/5

The tool set covers most analysis needs for code review: full-file scans, diff analysis, secret detection, security audit, and context like persona and checklist. A minor gap is the lack of an aggregation tool to combine results into a unified review report, but the core analysis workflows are complete.

Resources

Need Help?