list_modulesList every audit module nittim can run: the two deterministic scanners (secret scan + OSV dependency CVE check) and the LLM-reasoned checks. Returns each module's key, tier, and a plain-English description of what it checks. Each module's key identifies it for running individually.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful behavioral context by specifying exactly what the tool returns, including the plain-English description of each module, which goes beyond the bare annotation metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences convey the full scope, the returned fields, and the follow-up usage of the keys without any filler. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless listing tool with read-only annotations, the description fully equips an agent to select and call it correctly. It explains what modules are included, what the response contains, and how the returned keys relate to running a module individually.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics to document. The description appropriately focuses on the output and the purpose of the returned keys, which is all that is needed here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('audit modules nittim can run'), then enumerates the module categories and the exact returned fields (key, tier, plain-English description). This clearly distinguishes it from run_module and other siblings that execute or manage audits.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The statement 'Each module's key identifies it for running individually' implies this tool is the discovery step before run_module, giving clear context for when to use it. It does not explicitly name alternatives or say when not to use it, but the intended use is clear for a zero-parameter listing tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools map to distinct workflow stages: estimate, preview, submit audit, retrieve audit, run module, dispute finding, and judge output. The closest pairs are audit_repo vs audit_source and scan_source vs run_module, but the descriptions provide enough boundary detail for an agent to choose correctly.
Every tool follows the same snake_case verb_noun pattern: audit_repo, audit_source, estimate_audit, get_audit, list_modules, run_module, scan_source, and so on. There is no mixing of naming conventions or vague standalone verbs.
11 tools is well-scoped for a paid AI audit service with async delivery, approval flows, and both repo-based and source-based inputs. Each tool covers a distinct step in the audit pipeline without feeling redundant or bloated.
The core lifecycle is covered: estimate cost, submit audits, run single modules, check status, retrieve results, and dispute findings. Minor gaps include no way to list past audits, cancel a pending audit, or manage credits directly, though estimate_audit does show the balance.