Sentrint

Start a scan

sentrint_scan_repo

Start a Sentrint security scan of a GitHub repository's pushed code. Give the repository URL, and optionally a branch (default: the repository's default branch) and a full 40-character commit SHA on that branch. Returns a submission_id at once; poll sentrint_scan_status with it. Each new commit uses one scan from the account's allowance; sentrint_get_allowance shows what is left. The same commit again is free while Sentrint's rules are unchanged; after they change, the old report stays free and a rescan needs force=true and costs one scan.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "repo_url": "<repo_url>"
    },
    "name": "sentrint_scan_repo"
  }
}

Input Schema

Name	Required	Description
`force`	No	Set true only after the user agrees to spend one scan: it runs the commit again under Sentrint's current rules, even when an older report exists. Leave it out otherwise.
`branch`	No	A branch to scan. Omit it to scan the repository's default branch.
`repo_url`	Yes	The GitHub repository URL, such as https://github.com/owner/repo. Sentrint scans the code pushed to GitHub, not local files.
`commit_sha`	No	A full 40-character commit SHA on that branch, to scan one exact commit. Omit it to scan the branch's latest commit.

Output Schema

Name	Required	Description
`status`	Yes	The submission's state, usually accepted.
`next_step`	Yes	What to do next, in a sentence written for the agent.
`submission_id`	Yes	Pass this to sentrint_scan_status to follow the scan.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedNov 1, 2026

addedOutput schema / properties

Added value: +{
+  "next_step": {
+    "description": "What to do next, in a sentence written for the agent.",
+    "title": "Next Step",
+    "type": "string"
+  },
+  "status": {
+    "description": "The submission's state, usually accepted.",
+    "title": "Status",
+    "type": "string"
+  },
+  "submission_id": {
+    "description": "Pass this to sentrint_scan_status to follow the scan.",
+    "title": "Submission Id",
+    "type": "string"
+  }
+}

addedOutput schema / required

Added value: +[
+  "submission_id",
+  "status",
+  "next_step"
+]

changedOutput schema / title

Previous value: -"scan_repoDictOutput"New value: +"ScanRepoOutput"

First observedOct 31, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly=false, openWorld=true, idempotent=false, destructive=false; the description goes well beyond by disclosing the billing model (one scan per new commit), the free-rescan window tied to rule changes, and the synchronous-vs-async behavior (returns submission_id at once, poll for results). That quota/cost context is exactly what an agent needs before invoking a metered write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and the poll instruction are front-loaded, and the following sentences each carry distinct payload (quota, free-rescan rule, force cost). The final sentence is packed with three separate billing conditions and could be split, but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, yet it still names submission_id and the polling counterpart. For a metered, open-world, non-idempotent scan trigger, the cost model and follow-up path are both covered, leaving no material gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds cross-parameter meaning the schema does not: commit_sha must be a full 40-character SHA *on that branch*, branch defaults to the repository default, and force carries a quota cost. It does not restate the repo_url format, which the schema already handles well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ("Start a Sentrint security scan of a GitHub repository's pushed code") and scopes it to pushed GitHub code rather than local files. It is immediately distinguishable from siblings like sentrint_scan_status and sentrint_list_scans, which are named as follow-ups rather than alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: call this first, then poll sentrint_scan_status with the returned submission_id, and use sentrint_get_allowance to check remaining quota. It also states the exact condition for the costly path ("a rescan needs force=true and costs one scan") and the free paths, so the agent knows both when to use it and when a variant of it is warranted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Sentrint tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?