Skip to main content
Glama

Snapforge Ship-Ready Check

Ship-ready check

check_app
Read-only

Run a passive, read-only launch check on the public URL of a live app the user owns or is authorized to test (built with Replit, Lovable or Bolt). Checks: reachable and fast, SEO title/meta, robots/sitemap, security headers, open CORS, and a dev banner left in production. Only reads what any visitor's browser already sees (homepage, response headers, robots.txt, sitemap.xml); never scans JavaScript bundles for secrets, never signs in, submits forms, writes data or reads databases. Refuse private/internal addresses.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesPublic https URL of the app to check, e.g. https://yourapp.replit.app

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYes
noteNo
stackYes
summaryNo
findingsYes
reachableYes
free_auditYes
http_statusNo
response_msNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint and destructiveHint=false, but the description adds substantial context beyond them: exactly which surfaces are read (homepage, response headers, robots.txt, sitemap.xml) and an explicit refusal rule for private/internal addresses. That is the authorization and safety detail an agent needs before firing an open-world network call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then a tight enumeration of checks and limits; there is no filler. The second sentence is a long run-on of comma-separated negatives, which is dense but still scannable, so it falls just short of ideal structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. With safety covered by annotations and the description supplying scope, authorization conditions, inspection surface, and explicit exclusions, an agent has everything needed to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the url parameter is already documented with format and an example, so the baseline would be 3. The description adds meaning by constraining the accepted value to a public URL of a live app and by stating that private/internal addresses must be refused, which is a semantic rule the schema does not encode.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('run a passive, read-only launch check on the public URL of a live app') and enumerates exactly which checks are performed (reachability/speed, SEO title/meta, robots/sitemap, security headers, CORS, dev banner). This enumeration makes it unmistakable versus the sibling get_fix_prompt, which by name implies remediation rather than inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use: a live app the user owns or is authorized to test, built with Replit/Lovable/Bolt, and explicitly excludes private/internal addresses. It also sets negative scope (never scans JS bundles, never signs in, submits forms, writes data or reads databases). It does not name get_fix_prompt as a follow-up alternative, so it stops short of full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources