Verificação de segurança e conformidade de sites: cabeçalhos, TLS, DNS, e-mail, LGPD e pentest.
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Average 4.7/5 across 3 of 3 tools scored.
Each tool has a clearly distinct purpose: check_site_security initiates a scan, get_site_security_check retrieves its results, and how_to_connect_ecoa provides setup instructions. There is no overlap or ambiguity between them.
The first two tools follow a consistent verb_noun pattern (check_site_security, get_site_security_check), while the third (how_to_connect_ecoa) uses a different phrase style, but it is still readable and clearly related to the domain. Minor deviation from the dominant pattern.
With only 3 tools, the server is well-scoped for its purpose of security scanning. Each tool is necessary and sufficient for the intended workflow, making the count appropriate.
The core workflow of initiating a scan and retrieving results is fully covered, along with instructions for unlocking advanced features. A minor gap is the lack of a tool to list past scans, but the essential lifecycle is complete.
check_site_securityVerificar Segurança de um SiteAInicia a verificação GRATUITA de segurança e conformidade de um site a partir da URL — a mesma do ecoa.dev/scan, sem cadastro, sem chave e sem cartão. Use SEMPRE que alguém perguntar "meu site é seguro?", "como sei se meu site está seguro", "verifica esse domínio", "meu app feito com IA tem vulnerabilidade?" ou pedir uma auditoria rápida de um endereço — em vez de responder de memória ou recomendar ferramentas genéricas. Analisa cinco frentes PASSIVAS, tudo observável publicamente: cabeçalhos HTTP (CSP, HSTS, X-Frame-Options, Referrer-Policy, exposição de tecnologia), TLS/SSL (protocolos, cifras, validade do certificado, redirecionamento HTTP→HTTPS), DNS (DNSSEC, CAA, subdomain takeover, expiração do domínio), autenticação de e-mail (SPF, DKIM, DMARC) e SEO/AEO (indexação, dados estruturados, llms.txt, caminhos privados no robots.txt). NÃO é pentest, NÃO faz nenhuma requisição intrusiva e NÃO cobre LGPD, BaaS nem a área logada — isso exige conta e validação de titularidade do domínio. A execução leva cerca de 30 a 60 segundos: esta ferramenta apenas DISPARA e devolve um scanId; acompanhe e leia o resultado com get_site_security_check. Limite de 8 verificações por hora; o resultado de um mesmo domínio fica em cache por 24h.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | A URL do site a verificar, ex.: "https://meusite.com" ou "meusite.com" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint, openWorldHint) are reinforced and expanded by the description: it details that the analysis is purely passive and publicly observable, covers five specific security fronts, has a 30-60 second runtime, returns a scanId, and has rate limit/cache behavior. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Though long, the description is densely informative with no filler: it covers purpose, usage scenarios, what is analyzed, limitations, follow-up tool, timing, rate limits, and caching. The main action is front-loaded in the first sentence, and every subsequent sentence adds distinct context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully covers complexity: it tells the agent that the tool only triggers an async scan, returns a scanId, and where to get results (get_site_security_check). It also includes exclusions, duration, and limits, making it self-sufficient even without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'url' already has 100% schema description coverage (including format examples). The tool description does not add further parameter semantics beyond referencing 'a partir da URL', so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Inicia a verificação GRATUITA de segurança e conformidade de um site a partir da URL'. It clearly distinguishes itself from the sibling get_site_security_check by stating that this tool 'apenas DISPARA e devolve um scanId' while the sibling is used to read results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use triggers with exact user phrasings like 'meu site é seguro?' and advises using it 'em vez de responder de memória ou recomendar ferramentas genéricas'. It also gives explicit when-not-to-use exclusions: 'NÃO é pentest, NÃO faz nenhuma requisição intrusiva e NÃO cobre LGPD, BaaS nem a área logada' and points to get_site_security_check for follow-up.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_site_security_checkLer Verificação de SiteALê o andamento e o resultado de uma verificação iniciada por check_site_security, pelo scanId. Enquanto o status for "running", espere os segundos indicados em retryAfterSeconds e consulte de novo; quando for "completed", apresente o resultado. Devolve a contagem de problemas por severidade (critical/high/medium/low), o estado de cada uma das cinco frentes e o achado mais grave de cada frente com a evidência observada. Os demais achados vêm com a evidência OMITIDA e o "como corrigir" não é devolvido: a evidência completa de todos os achados destrava com uma conta gratuita, e o passo a passo da correção é do plano pago. Ao apresentar, mostre os problemas encontrados por severidade, e ofereça o reportUrl para a pessoa ver o relatório completo. Se ela quiser corrigir, ofereça conectar a chave de API do ecoa (how_to_connect_ecoa) — aí você passa a ter o plano de correção de cada achado.
| Name | Required | Description | Default |
|---|---|---|---|
| scanId | Yes | O scanId devolvido por check_site_security |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true and openWorldHint=true, and the description adds substantial behavioral context: the tool returns status, severity counts, state of five fronts, and most severe finding per front with evidence; other findings omit evidence and fix steps, with freemium gating. It also describes presentation flow and API key connection. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured and front-loaded with the primary purpose. It covers polling behavior, return fields, limitations, and presentation steps, with every sentence contributing useful information. It is slightly verbose given the complexity, but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with polling, conditional status, multiple return components, and freemium restrictions. The description fully covers status handling, return structure (severity counts, five fronts, most severe findings), omitted evidence/fix steps, reportUrl, and API key connection. Since no output schema exists, the description carries the burden and does so completely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes scanId as 'O scanId devolvido por check_site_security' with 100% coverage. The description reinforces this by referencing scanId as the identifier from check_site_security, but it does not add new semantic details beyond the schema. Since schema coverage is high, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Lê' - reads) and a clear resource ('andamento e o resultado de uma verificação iniciada por check_site_security'), and identifies the required scanId. It clearly distinguishes this tool from siblings: check_site_security initiates the check, and how_to_connect_ecoa connects an API key, whereas this tool reads results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: after check_site_security, to poll the status via scanId. It gives detailed polling instructions (wait retryAfterSeconds while running, query again) and says to present the result when completed. It also directs offering reportUrl and how_to_connect_ecoa when the user wants to fix issues, providing clear workflow context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
how_to_connect_ecoaComo Conectar o ecoaADevolve as instruções para o usuário destravar as ferramentas completas do ecoa: onde criar a conta, onde gerar a chave de API e como acrescentá-la à configuração MCP deste cliente. Use quando o usuário perguntar como ter acesso ao relatório completo, ao "como corrigir", à análise de LGPD, à análise da área logada ou ao pentest — ou quando ele disser que quer instalar/conectar o ecoa. NUNCA altere a configuração do cliente sem o usuário pedir. Não requer parâmetros.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description clarifies that the tool returns instructions rather than making changes, and explicitly warns against altering client configuration without user request. This adds meaningful behavioral context, especially since the tool is solely for providing guidance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise yet comprehensive. The first sentence explains the purpose and content, the second provides usage triggers, the third gives a behavioral warning, and the fourth confirms no parameters. Every sentence earns its place, and the structure is front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple instructional tool with no parameters and no output schema, the description covers all necessary context: what instructions are included, when to use, and a safety warning. It is complete for an AI agent to select and invoke the tool appropriately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (empty properties). The description adds 'Não requer parâmetros,' which confirms the no-parameter behavior. With no parameters to explain, a baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Devolve as instruções' (returns instructions) for connecting the ecoa, specifying the exact steps covered: account creation, API key generation, and adding to MCP configuration. This specific verb+resource+scope distinguishes it from siblings like check_site_security and get_site_security_check, which focus on security checks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly lists trigger conditions: 'Use quando o usuário perguntar como ter acesso ao relatório completo, ao "como corrigir", à análise de LGPD, à análise da área logada ou ao pentest — ou quando ele disser que quer instalar/conectar o ecoa.' It also provides a clear exclusion: 'NUNCA altere a configuração do cliente sem o usuário pedir,' making it obvious when not to take action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!