Skip to main content
Glama

Security Assessment

security_assessment

Run a Security Assessment (SECURITY, 5 agents) — public OSINT tech/security diligence brief (attack surface, disclosures, breach history, vendor stack, posture). Returns a run_id immediately; poll check_report_status until completed. Costs 75 credits. Not a pen test or attestation.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "target": "<target>"
    },
    "name": "security_assessment"
  }
}

Input Schema

NameRequiredDescriptionDefault
configNo
targetYesCompany, deal, property, or market category to research.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses the async contract (returns run_id immediately, must poll), the credit cost (75), the multi-agent composition (5 agents), and the public-OSINT scope. This is exactly the operational context an agent needs before spending credits on a non-idempotent, open-world job.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is front-loaded with the outcome and keeps only sentences that add operational value (async polling, cost, exclusions). The em-dash-heavy first sentence is dense but does not waste words; minor tightening could improve scannability without losing substance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an async, credit-consuming research tool with no output schema, the description covers the return contract, polling requirement, cost, and scope exclusions. The remaining gap is parameter-level detail for the nested `config` object, which the schema only half-documents.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 50% schema description coverage and a nested config object, the description does not mention `target` or `config` at all, so it adds no meaning beyond the schema for either parameter. The nested `config.company_domain` is especially under-explained since `additionalProperties: true` leaves its accepted contents unclear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Run a Security Assessment') and enumerates the deliverable contents (attack surface, disclosures, breach history, vendor stack, posture), so an agent knows exactly what it produces. It also explicitly excludes two adjacent interpretations ('Not a pen test or attestation'), which sharpens the boundary against other intelligence siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It tells the agent the follow-up flow ('poll check_report_status until completed') and rules out pen-test/attestation use cases. It does not directly compare against siblings like due_diligence or company_intelligence, so selection between similar research tools remains partly implicit, but the stated exclusions and next step are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources