Snapforge Ship-Ready Check
Server Details
Free, read-only ship-readiness check for Replit, Lovable and Bolt apps.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
TDQS
Scored across 2 tools
check_app performs the diagnostic scan while get_fix_prompt produces remediation text from an issue id — two clearly distinct phases with no overlap. An agent can unambiguously pick the right tool at each step.
Both names use a consistent snake_case verb_noun pattern (check_app, get_fix_prompt) with no stylistic deviations. The convention is predictable and readable.
Two tools is thin for a launch-check domain; the workflow of scan-then-fix is sensible, but there is no way to re-verify after fixes or list issues separately. Borderline minimal but each tool earns its place.
The pair covers the core lifecycle: detect problems (check_app) and generate a fix (get_fix_prompt). A re-check or structured issue-listing operation is missing, but the main agent workflow has no hard dead end.
Available Tools
2 toolscheck_appShip-ready checkARead-onlyInspect
Run a passive, read-only launch check on the public URL of a live app the user owns or is authorized to test (built with Replit, Lovable or Bolt). Checks: reachable and fast, SEO title/meta, robots/sitemap, security headers, open CORS, and a dev banner left in production. Only reads what any visitor's browser already sees (homepage, response headers, robots.txt, sitemap.xml); never scans JavaScript bundles for secrets, never signs in, submits forms, writes data or reads databases. Refuse private/internal addresses.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public https URL of the app to check, e.g. https://yourapp.replit.app |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| note | No | |
| stack | Yes | |
| summary | No | |
| findings | Yes | |
| reachable | Yes | |
| free_audit | Yes | |
| http_status | No | |
| response_ms | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint and destructiveHint=false, but the description adds substantial context beyond them: exactly which surfaces are read (homepage, response headers, robots.txt, sitemap.xml) and an explicit refusal rule for private/internal addresses. That is the authorization and safety detail an agent needs before firing an open-world network call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then a tight enumeration of checks and limits; there is no filler. The second sentence is a long run-on of comma-separated negatives, which is dense but still scannable, so it falls just short of ideal structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. With safety covered by annotations and the description supplying scope, authorization conditions, inspection surface, and explicit exclusions, an agent has everything needed to decide and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the url parameter is already documented with format and an example, so the baseline would be 3. The description adds meaning by constraining the accepted value to a public URL of a live app and by stating that private/internal addresses must be refused, which is a semantic rule the schema does not encode.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('run a passive, read-only launch check on the public URL of a live app') and enumerates exactly which checks are performed (reachability/speed, SEO title/meta, robots/sitemap, security headers, CORS, dev banner). This enumeration makes it unmistakable versus the sibling get_fix_prompt, which by name implies remediation rather than inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for use: a live app the user owns or is authorized to test, built with Replit/Lovable/Bolt, and explicitly excludes private/internal addresses. It also sets negative scope (never scans JS bundles, never signs in, submits forms, writes data or reads databases). It does not name get_fix_prompt as a follow-up alternative, so it stops short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_fix_promptGet fix promptARead-onlyInspect
Return a paste-ready prompt to fix a specific issue in the user's builder (Replit Agent, Lovable or Bolt). Use the issue id from check_app.
| Name | Required | Description | Default |
|---|---|---|---|
| issue | Yes | ||
| builder | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| issue | Yes | |
| builder | Yes | |
| fix_prompt | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful context that the output is a paste-ready prompt intended for the user's chosen builder rather than executable code, but says nothing about prompt length, builder-specific differences, or error behavior for an invalid issue id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the core purpose front-loaded and the argument-sourcing instruction immediately after. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not explain the returned structure, and the tool is a simple read-only prompt generator. The only residual gap is behavior for an unrecognized issue id or omitted builder, which is minor for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two parameters, so the description carries the burden. It meaningfully links the required 'issue' argument back to check_app's output, but the optional 'builder' parameter is only implied by the parenthetical list of builder names rather than explained (e.g., behavior when omitted).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (return) and concrete artifact (a paste-ready fix prompt) scoped to a specific issue, and names the target builders (Replit Agent, Lovable, Bolt). It is clearly distinguishable from the sibling check_app, which detects issues rather than producing fix text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly sets up the workflow dependency: 'Use the issue id from check_app,' which tells the agent this tool is invoked after issue detection and how to source the argument. It stops short of stating when NOT to use it or what to do if no issue has been identified, so it is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
check_app - First observed
get_fix_prompt
Related MCP Connectors
Check a live app you own for public databases, leaked keys and exposed files.
Read-only XRP Ledger token-risk, issuer-authenticity and wallet-security checks.
31Free enterprise-grade due diligence for your app, run by your coding agent. Then the full SDLC.
Compliance & security scan for your app: secrets, exposed files, headers, privacy, AI-disclosure.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceProvides pre-deploy AI-assisted security and readiness checks for AI-built apps, including scanning for secrets, auth gaps, and payment safety.5MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI coding assistants to scan an iOS, Android, Flutter, React Native or Expo project for App Store and Google Play rejection risks, returning deterministic findings that cite the guideline section, link to the official Apple or Google page and explain how to fix each problem. Nothing leaves the machine and no AI is used in the checks.MIT
- AlicenseNot gradedqualityDmaintenanceLocal-first security check for AI coding agents — finds hardcoded secrets, exposed .env files, git-history leaks and vulnerable dependencies (OSV), entirely on your machine. Ask your agent "is this safe to ship?" and get a Launch Readiness score with a fix for every finding.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI coding assistants to run static analysis on GitHub repositories, raw code snippets, or local directories to detect cloud cost leaks in Terraform/AWS configs, PostgreSQL migration table-lock hazards, and OWASP/Next.js API security gaps. Each finding returns structured severity, line-level detail, and drop-in fixes.MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.