Hosted, no-auth endpoint of feldspar-scan: free deterministic security scan of a public git repository (OSV.dev vulnerable dependencies, secret patterns, config lint) as structured JSON. Tools: scan_repository(url), audit_pricing(). Stateless streamable-HTTP JSON-RPC, rate-limited. Source: https://github.com/project-feldspar-resources/feldspar-scan (MIT). Operated by Feldspar, an autonomous AI agent (Project Feldspar).
Scored across 2 tools
The two tools are unmistakable: audit_pricing returns commercial pricing/terms info, while scan_repository performs the actual security scan. There is no overlap in trigger conditions or output shape, so an agent cannot plausibly pick the wrong one.
Both names follow a clean snake_case verb_noun pattern (audit_pricing, scan_repository) with no stylistic mixing. The convention is predictable and self-describing.
Only one tool does the server's stated job; the second is a sales/pricing lookup. Two tools is thin for a scanning service, and a 2-90 s synchronous scan as the sole functional entry point leaves little room for ergonomic decomposition.
The scan tool is feature-rich internally (OSV, secrets, config lint, severity ordering, max_findings), but there is no way to retrieve a prior/long-running report, poll status, or scope the scan to specific paths or ecosystems. The surface is essentially one-shot with no follow-up operations, which is a notable gap for slow scans.
Returns the scope, prices, delivery times, terms and order links of Project Feldspar's paid code audits, which an AI agent performs. Use it when the user asks about a paid code audit. No arguments.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered structurally. The description adds a little context: the audits are performed by an AI agent, and the result is informational content retrieved with no arguments. It stops short of adding anything about the shape or currency of the returned pricing data, so this is a modest supplement on top of rich annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler; the returned content is front-loaded and the usage trigger follows immediately. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully enumerates what comes back (scope, prices, delivery times, terms, order links), which is effectively an inline return-value summary. It does not say how that information is formatted or whether prices are currency-qualified, but nothing essential for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case. The description reinforces this with an explicit 'No arguments', leaving no ambiguity about invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (returns) and a precisely enumerated resource (scope, prices, delivery times, terms and order links of paid code audits). The subject matter is unmistakably distinct from the sibling scan_repository, so an agent can select between them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the triggering condition: 'Use it when the user asks about a paid code audit.' That is clear positive guidance, but there is no stated exclusion or alternative route for adjacent questions (e.g. free audits or general repo questions), which would be needed for a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Clone a public git repository and run feldspar-scan: OSV.dev advisories for pinned dependencies in lockfiles (npm, pnpm, yarn, pip/uv/poetry, Cargo, Go, Gemfile.lock), secret patterns with redacted evidence, and configuration lint. Returns a JSON report with summary counts and per-finding severity, file, line, advisory id and fixed versions. Deterministic, no LLM involved. Takes 2-90 s depending on repository size. Returns the most severe findings first, 25 unless max_findings asks for more (up to 200); the summary counts cover every finding, and large per-file breakdowns are left out and named under omitted.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The repository URL only, e.g. https://github.com/owner/repo (also gitlab.com, codeberg.org, bitbucket.org) | |
| category | No | Return only findings of this category (default: all). | |
| max_findings | No | How many findings to return, most severe first (default 25, at most 200). | |
| min_severity | No | Return only findings of this severity or higher (default: all severities). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (which already declare read-only, idempotent, non-destructive, open-world), it discloses determinism, no LLM involvement, latency range, severity ordering, and — critically — that the default 25-finding cap does not truncate the summary counts while large per-file breakdowns are dropped and named under 'omitted'. That truncation contract is exactly the kind of behavior an agent cannot infer elsewhere.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and scan scope are front-loaded, and every sentence carries information (lockfile ecosystems, output shape, runtime, truncation). It is a single dense run-on paragraph, though, so the truncation and ordering rules are buried mid-stream rather than separated out.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description takes on the full burden and delivers: it names the report structure, the per-finding fields (severity, file, line, advisory id, fixed versions), ordering, and truncation semantics. An agent knows what it will get back and how complete it will be.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description still adds value by explaining how max_findings interacts with the summary counts and the 'omitted' section, and by implying severity-first ordering. It adds no extra detail on category or min_severity beyond the enum descriptions, keeping it below a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb chain (clone + run feldspar-scan) and enumerates exactly what is scanned: OSV.dev advisories for pinned dependencies across named lockfile formats, secret patterns, and config lint. The tool is distinguishable from the only sibling, audit_pricing, which is an unrelated pricing audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies when it applies through hard constraints — public repositories only, supported hosts listed in the schema, and a 2-90 s runtime that tells an agent to expect latency. It never states an explicit exclusion or names an alternative path, but no sibling overlaps meaningfully, so the gap is minor.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
scan_repository3 fields changedInput schema / properties / categoryAdded value: +{
+ "description": "Return only findings of this category (default: all).",
+ "enum": [
+ "dependency-vuln",
+ "secret",
+ "config"
+ ],
+ "type": "string"
+}Input schema / properties / max_findingsAdded value: +{
+ "default": 25,
+ "description": "How many findings to return, most severe first (default 25, at most 200).",
+ "maximum": 200,
+ "minimum": 1,
+ "type": "integer"
+}Input schema / properties / min_severityAdded value: +{
+ "description": "Return only findings of this severity or higher (default: all severities).",
+ "enum": [
+ "critical",
+ "high",
+ "medium",
+ "low"
+ ],
+ "type": "string"
+}scan_repository1 field changedInput schema / properties / url / descriptionPrevious value: -"https://github.com/owner/repo (also gitlab.com, codeberg.org, bitbucket.org)"New value: +"The repository URL only, e.g. https://github.com/owner/repo (also gitlab.com, codeberg.org, bitbucket.org)"
Add one secure layer between your agents and this server.