Skip to main content
Glama

Server Details

Risk-scan a diff, flag AI-generated-code tells, find secrets. 5 of 7 tools need no account.

Ownership verified
Status
Healthy
Uptime
100.0% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
GarphenGate/moltline-mcp
GitHub Stars
0
Server Listing
moltline-mcp
ChatGPT
–
Claude
–

TDQS

A4.4/5.0

Scored across 7 tools

Disambiguation4/5

Each tool has a clearly distinct purpose and the descriptions actively route the agent ("Not on a diff (review_diff)", "Not for vulnerabilities (security_deep_dive)"). There is mild overlap in that review_diff itself flags secret patterns and injection sinks that secret_scan and security_deep_dive also cover, though input type (diff vs. file vs. text) mostly disambiguates.

Naming Consistency3/5

All names are snake_case and readable, but the patterns are mixed: noun-first analysis tools (complexity_report, secret_scan, security_deep_dive), verb-first tools (get_reviewer_persona), and a review_-prefixed pair (review_diff, review_checklist) that is sometimes a verb and sometimes a noun phrase. Not chaotic, but not a single predictable convention.

Tool Count5/5

Seven tools is well-scoped for a code-review analysis server, and each covers a distinct analysis angle (AI authorship, structure, security, secrets, diff risk, checklist, persona) with no obvious padding.

Completeness4/5

The surface covers the major review angles for files, diffs, and text, so agents can run a full triage workflow. Minor gaps remain: no tool to compose findings into an actual review comment/verdict, and no snippet-level review path distinct from whole-file or diff input.

Available Tools

7 tools
ai_code_smell_scanAi Code Smell ScanA
Read-onlyIdempotent
Inspect

Flag the tells of unreviewed AI-generated code in a source file. FREE.

Detects comments that restate the next line, leaked assistant preambles, placeholder TODOs, shipped 'Example usage' blocks, over-broad try/except that swallows errors, and auto-named identifiers. Typical input {"code": ""} returns {"reviewed_confidence": 0-100, "hits": [{"smell": "...", "evidence": ""}], "reading": "...", "note": "..."}.

Use on a full source file suspected of unreviewed machine authorship. Not on a diff (review_diff), and the result is a signal to check, not proof of authorship. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
codeYesFull source text to scan, any language; paste the file contents as a single string.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses important behavior: invalid input never raises a protocol error and instead returns an error object, retry is safe after correction, and the result should be interpreted as a confidence signal rather than definitive proof.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and concrete smell categories, then moves into usage and error behavior. It is efficient, though the example input/output overlaps with structured schema information and the read-only/idempotent note repeats annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, complete input schema, and rich annotations, the description provides everything needed: purpose, usage boundaries, interpretation caveat, and error handling behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single code parameter is already well documented in the schema. The description adds a typical input shape but does not add substantive meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: flagging AI code smells in a source file. It lists concrete smell categories and explicitly differentiates from the sibling review_diff by saying it should not be used on a diff.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear when-to-use guidance (full source file suspected of unreviewed machine authorship), an explicit when-not-to-use alternative (review_diff for diffs), and a caveat that the result is a signal rather than proof.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

complexity_reportComplexity ReportA
Read-onlyIdempotent
Inspect

Report structural complexity of a source file, function by function. FREE.

Measures per-function length, max nesting depth, and a cyclomatic-style branch count (if/for/while/case/&&/||/except), flagging functions too long or too deeply nested to review confidently. Typical input {"code": ""} returns {"functions": N, "detail": [{"name": ..., "start": N, "lines": N, "branches": N, "max_depth": N}], "flags": ["..."], "note": "..."}.

Use when structure rather than correctness is the question. Not for vulnerabilities (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
codeYesFull source text to analyze, pasted as a single string.
languageNoOptional language hint, e.g. "python" or "javascript"; "auto" (default) detects from syntax.auto

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly, idempotent, non-destructive, and non-open-world. The description adds genuinely non-annotated behavioral context: it never raises protocol errors, returns a structured {"error": ...} on bad input, and is safe to retry. The return-shape sketch overlaps somewhat with the existing output schema, slightly capping the score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and the FREE tag, then usage, then behavior. Mostly earns its space, though the verbose return-shape example is somewhat redundant given an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering safety, an output schema covering returns, and the description covering error semantics and usage routing, an agent has everything needed to call it correctly. No meaningful gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are fully documented in the schema. The description's typical-input example adds minor illustration but no semantics beyond what the schema already provides, so it holds at the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Report) and resource (structural complexity of a source file, function by function), and explicitly distinguishes itself from security_deep_dive. An agent can identify the tool's scope without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ("structure rather than correctness") and when-not-to-use ("Not for vulnerabilities (security_deep_dive)"), naming the alternative tool. Routing is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_reviewer_personaGet Reviewer PersonaA
Read-onlyIdempotent
Inspect

Load the Senior Reviewer persona for consistent, high-signal reviews. PREMIUM (license).

The persona is a reviewing voice that is skeptical, specific, and kind: demands evidence over vibes and blocks only on real risk. Takes no arguments. Returns {"persona": ..., "identity": ..., "rules": ["...", ...], "opening_move": "..."} ready to adopt as a system prompt.

Use to keep repeated reviews consistent in voice and rigor. Not for running a review - the scan tools do that. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, but the description adds genuinely non-structured context: a PREMIUM license gate, a no-argument contract, and an error contract stating that malformed input returns an {"error": ...} payload rather than a protocol error and that retrying after correction is safe. The one redundancy is restating the return shape, which the output schema already carries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and the premium gate, then voice characterization, then usage and error contract. It is slightly padded by the persona flavor line ('skeptical, specific, and kind...') and by the inline return-shape string that duplicates the output schema, but no sentence is pure filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only persona loader with an output schema present, the definition covers everything an agent needs: what it returns conceptually, that it takes no input, the license prerequisite, the error/retry behavior, and how it differs from the scan tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4; the description confirms the contract with 'Takes no arguments,' which matches the empty schema with additionalProperties: false. There is nothing further to disambiguate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Load the Senior Reviewer persona') and immediately characterizes what the loaded artifact is: a reviewing voice with stated traits that returns a system-prompt-shaped object. It explicitly distinguishes itself from the sibling scan/report tools by saying it is 'Not for running a review - the scan tools do that.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when ('Use to keep repeated reviews consistent in voice and rigor'), an explicit when-not ('Not for running a review'), and points to the class of alternatives ('the scan tools') among the listed siblings. An agent can route correctly without inspecting any schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_checklistReview ChecklistA
Read-onlyIdempotent
Inspect

Produce a focused pull-request review checklist for a language or stack. FREE.

Covers the things that actually break in production, with extra items per language. Typical input {"language": "python"} returns {"language": "python", "checklist": ["...", ...], "note": "..."}.

Use before a review, to decide what to look for. Not for reviewing actual code - pass code to review_diff or security_deep_dive. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
languageNoLanguage or stack to tailor for: "python", "javascript", "typescript", "go", "sql", or "general" (default). Unknown values fall back to the general checklist.general

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, yet the description still adds genuinely new behavior: it never raises a protocol error on bad input, returns an {"error": ...} payload instead, and is therefore safe to retry after correction. That error contract is real value beyond the annotations. Minor deduction for the 'FREE.' marketing token and for restating retry safety that idempotentHint partly implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose in the first line, then usage, exclusion, and error behavior in a logical order; every sentence carries information. The dangling 'FREE.' fragment and the hard line breaks add noise without adding meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations cover the safety profile. Combined with the stated alternative tools, the error contract, and a sample request/response, an agent has everything needed to call this correctly on the first try.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents the allowed values and the unknown-value fallback to general. The description contributes only an example invocation ({"language": "python"}), which illustrates rather than adds semantics. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact ('Produce a focused pull-request review checklist') scoped to a language or stack, and explicitly excludes code review, naming review_diff and security_deep_dive as the tools for that. An agent can distinguish it from all six siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit timing ('Use before a review, to decide what to look for'), an explicit exclusion ('Not for reviewing actual code'), and two named alternatives for the excluded case. Nothing about tool selection is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_diffReview DiffA
Read-onlyIdempotent
Inspect

Risk-scan a unified diff the way a senior reviewer triages a PR. FREE.

Flags added lines matching known risk patterns (injection sinks, disabled TLS, bare excepts, debug prints, TODOs, N+1 hints, leaked secrets) with the new-file line number and a severity (1 low - 4 high). Typical input {"diff": ""} returns {"added_lines": N, "risk_score": 0-100, "verdict": "...", "secrets": [...], "findings": [{"line": N, "severity": 1-4, "issue": "...", "code": "..."}], "note": "..."}.

Use on a unified diff, when only the change matters. Not for whole-file analysis (complexity_report, ai_code_smell_scan). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
diffYesA unified diff exactly as produced by `git diff`, text with @@ hunk headers and +/- line prefixes. Only added (+) lines are scanned.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent/non-destructive, and the description still adds substantial value: only added (+) lines are scanned, findings carry new-file line numbers and a 1-4 severity scale, and the tool never raises protocol errors but returns a structured error object that is safe to retry after fixing input. That error contract and scan-scope disclosure go well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the purpose and cost in one line, then flags, then input/output shape, then usage boundaries, then error behavior. Every sentence carries distinct information; nothing is repeated from the annotations or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers scope, alternatives, return shape, error handling, and retry safety for a single-parameter tool. With an output schema present it need not re-describe return values, and the error contract fills the remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the parameter is already documented, but the description adds a concrete call example ({"diff": "<git diff output>"}) and reinforces that only '+' lines are scanned, which clarifies what the string must contain. Slight redundancy with the schema's own description keeps it below 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('risk-scan a unified diff') and frames the scope as triaging a PR diff, which immediately distinguishes it from whole-file analyzers. A reader knows exactly what class of operation this is without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use on a unified diff, when only the change matters' and names the two whole-file alternatives (complexity_report, ai_code_smell_scan) to use instead. However, it flags 'leaked secrets' while a sibling secret_scan exists, and the description never explains when to prefer one over the other, leaving a real routing ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_scanSecret ScanA
Read-onlyIdempotent
Inspect

Scan text for accidentally-committed machine credentials and private-key material. FREE.

Reports each match's location and category so it can be rotated before it leaks. Detection is pattern-based over the common leaked-credential formats; it never echoes the matched value back. Typical input {"text": "<file, diff, or config contents>"} returns {"leaked": bool, "count": N, "findings": [{"line": N, "type": ""}], "note": "..."}.

Pattern matching only - a clean result is not proof, and every hit needs human confirmation before anyone acts on it. Not a general security review (security_deep_dive). Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
textYesThe file, diff, or config contents to scan, pasted as a single string.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish read-only and idempotent behavior, but the description adds substantial context beyond them: it is free, pattern-based only, never echoes matched values, returns structured findings, and handles invalid input with an error object rather than a protocol error. It also states that retrying after correction is safe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and target, and nearly every sentence adds useful behavioral context. It is slightly long for a one-parameter scanner and includes a return-value sketch even though an output schema exists, but it avoids filler and remains well organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter scanner, the description covers the key gaps an agent would otherwise have: limitations of pattern matching, human-confirmation requirement, no echoing of secrets, error behavior, and retry safety. With annotations and an output schema present, this is complete enough to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and there is only one parameter, so the schema already explains that `text` is the file, diff, or config contents pasted as a single string. The description repeats that usage with a typical input example, but adds no further constraints or format details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb, 'Scan', and names the exact resource and targets: text containing accidentally-committed machine credentials and private-key material. It also distinguishes the tool from the broader sibling `security_deep_dive` by explicitly saying it is not a general security review.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear usage context: scanning file, diff, or config contents for leaked credentials. It explicitly routes broader security work away from this tool by naming `security_deep_dive`, and it explains the trust boundary: pattern matching only, clean results are not proof, and hits need human confirmation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

security_deep_diveSecurity Deep DiveA
Read-onlyIdempotent
Inspect

Run an OWASP-oriented security pass over a source file. PREMIUM (license).

Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling. Each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": ""} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}.

Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error; it returns {"error": ""}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

NameRequiredDescriptionDefault
codeYesFull source text to audit, pasted as a single string; any common language.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description adds value on top: a PREMIUM license requirement, a guarantee that invalid input never raises a protocol error but returns a structured error object, and an explicit retry-safety statement. These are operational traits an agent cannot infer from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then constraints, then error behavior — a sensible order. The inline return-shape JSON is partly redundant given an output schema exists, making the description slightly longer than necessary, but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, exclusions, licensing, error semantics, retry safety, and input shape for a single-parameter tool with annotations and an output schema already in place. An agent has everything needed to decide and to invoke correctly, including what to do on failure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema description coverage, so the schema already carries the semantics. The description only echoes it as an input example ('{"code": "<file contents>"}') without adding format, size, or language constraints beyond what the schema states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run an OWASP-oriented security pass over a source file') and immediately bounds scope with the enumerated check categories (injection, auth/session, crypto, SSRF/deserialization, path handling). It distinguishes itself from a sibling by naming complexity_report as the tool for style/structure instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit positive condition ('Use on one source file when vulnerabilities are the question'), an explicit exclusion with the alternative named ('Not for style or structure (complexity_report)'), and a caveat about not replacing a human reviewer on high-risk code. The only unmentioned neighbor is secret_scan, but the vulnerability-vs-secret split is implicit in the enumerated check list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedreview_diff1 field changed
      • changedInput schema / properties / diff / description
        Previous value: -"A unified diff exactly as produced by `git diff` — text with\n@@ hunk headers and +/- line prefixes. Only added (+) lines are\nscanned."New value: +"A unified diff exactly as produced by `git diff`, text with\n@@ hunk headers and +/- line prefixes. Only added (+) lines are\nscanned."
  2. 7 tool updates
    • First observedai_code_smell_scan
    • First observedcomplexity_report
    • First observedget_reviewer_persona
    • First observedreview_checklist
    • First observedreview_diff
    • First observedsecret_scan
    • First observedsecurity_deep_dive

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Security checks for apps built with AI: Trivy and Opengrep findings explained in plain English, with a fix request for your coding agent. Hosted scan by default (only files Git would commit, never secret files) or fully local.
    5
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    AI-powered security scanner for Python projects and GitHub repositories. Detects vulnerabilities, secrets, and provides AI risk assessment.
    11
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI assistants to audit git diffs, scan for leaked secrets and unsafe APIs, detect breaking changes, triage issues, generate changelogs, and assess repository hygiene through native stdio JSON-RPC tools.
    7
    Apache 2.0
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.