Zephex
Server Details
MCP gateway with 10 tools for code analysis, architecture, package audit & security.
/.well-known/glama.json file. Claimed server authors can inspect health checks, view analytics, and manage their connector listing.- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 4.7/5 across 10 of 10 tools scored. Lowest: 3.9/5.
Each tool targets a distinct domain: URL auditing, package checking, tests, architecture, code search, project context, planning, memory, code reading, and expert guides. Descriptions are extremely detailed and explicitly state when not to use each tool, leaving no ambiguity.
Most tools follow the verb_noun snake_case pattern (audit_headers, check_package, check_test, explain_architecture, find_code, get_project_context, read_code), but project_memory (noun_noun) and Zephex_dev_info (brand_noun) deviate, and keep_thinking uses a gerund instead of a noun. The pattern is strong but not perfectly uniform.
10 tools is well-scoped for a comprehensive development assistant. Each tool serves a clear purpose without redundancy, covering security, package management, testing, code understanding, project context, planning, memory, and expert knowledge. The count is neither too few nor excessive.
The tool surface covers a wide range of development analysis tasks: security auditing, package checking, test running, architecture mapping, code search, project context, planning, memory, code reading, and developer guides. Minor gaps include the lack of direct code editing or project execution/build tools, but the server appears intentionally focused on read-only information and planning.
Available Tools
10 toolsaudit_headersAudit HTTP HeadersARead-onlyIdempotentInspect
Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health (ALIVE/DEGRADED/BROKEN), exposed secrets, tech stack. Read plain_summary first; only drill into security_headers or secrets if grade is poor. quick ~1–3s; scan_depth=deep for secret scan (~8–12s). 6 credits hosted. Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys. Blocks localhost/private IPs. NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context). Example: audit_headers({ url: 'https://myapp.vercel.app' }). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public https:// URL to audit — e.g. https://myapp.vercel.app or https://zephex.dev | |
| path | No | Optional subpath (e.g. /checkout) — appended to url | |
| focus | No | Trim output layers (default: all) | |
| check_ssl | No | Check SSL certificate validity, expiry, and protocol (default: true) | |
| scan_mode | No | quick=~1-3s (default); thorough=DNS+APIs+secrets ~5-12s | |
| check_apis | No | Probe /api/health and common API paths — adds ~1-2s (default: false) | |
| check_tech | No | Tech stack: framework, hosting, CDN, third-party (default: true) | |
| scan_depth | No | quick=light scan, 3 bundles (default); deep=full supply URL phase with JWT decode, source maps, verification (~8-12s) | |
| timeout_ms | No | Max scan time in ms (default: 8000, max: 15000) | |
| check_health | No | Site health: verdict, trust score, load time, page title (default: true) | |
| probe_engine | No | fetch=HTTP only (default); browser=headless Chrome on Zephex servers for console errors + browser network (falls back to fetch with warning if unavailable) | |
| check_cookies | No | Check cookie Secure/HttpOnly/SameSite flags (default: true) | |
| check_headers | No | Grade all security headers and return fix snippets when include_fix_snippets=true (default: true) | |
| check_network | No | HTTP network timing table — slow requests, API probes (default: true) | |
| check_secrets | No | Secret scan: HTML/JS keys, exposed .env/.git, GraphQL (default: true; depth via scan_depth) | |
| security_depth | No | basic=fast (default); full adds DNS SPF/DMARC/DKIM + HSTS preload lookup | |
| check_redirects | No | Follow and audit the full redirect chain (default: true) | |
| include_fix_snippets | No | Include Nginx/Vercel/Next fix snippets — token-heavy (default: false) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/idempotent, so the bar for added transparency is lower. The description adds substantial behavioral context beyond annotations: 'Blocks localhost/private IPs' is a critical safety disclosure; 'quick ~1–3s; scan_depth=deep for secret scan (~8–12s)' discloses timing; '6 credits hosted' discloses cost; 'Read plain_summary first; only drill into security_headers or secrets if grade is poor' gives a workflow behavior. All traits are consistent with the readOnly hint, so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: state purpose, list outputs, provide reading strategy, timings, credit cost, when-to-call, safety block, exclusions, an example, and read-only reminder. It is front-loaded with the most important information and uses semicolons to keep it tight. For a tool with 18 parameters, this is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential context needed to safely and effectively invoke the tool: input constraints (public HTTPS URL), output summary (security grade, SSL, etc.), safety (blocks localhost/private IPs), cost (6 credits), performance expectations (quick vs. deep), usage flow (read plain_summary first), and a concrete example. Since there is no output schema, the description appropriately outlines the key return categories. The 18-parameter schema plus rich annotations make this complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (18/18 parameters have descriptions), so the baseline is 3. The tool description mentions 'scan_depth=deep for secret scan' but the schema already explains deep scan behavior in the 'scan_depth' parameter description. No additional parameter semantics are provided beyond what is already in the schema, so the score stays at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health, exposed secrets, tech stack.' This clearly states what the tool does and enumerates its outputs. It also distinguishes from siblings with explicit exclusions: 'NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context).' This is a model of purpose clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives precise when-to-use guidance: 'Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys.' It also provides an example call and explicitly names alternatives for non-matching cases, such as 'repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context).' This is comprehensive usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_packageCheck PackageARead-onlyIdempotentInspect
Verify a public registry package before the agent recommends, installs, or changes a dependency. ALWAYS call when the user says install, add a package, add a dependency, upgrade, bump, migrate, is this package safe, is this name real, check CVEs, vulnerability, deprecation, slopsquatting, supply-chain risk, or breaking changes. Call it before npm/pnpm/yarn/bun/pip/cargo/gem or another package-manager install command; do not install first and inspect later. PREFER this over web search or raw registry metadata for package safety and version-change decisions. Choose one task: check for existence, typo/slopsquat risk, deprecation, and basic safety; security for advisories affecting a pinned version; upgrade for changes from one version to the latest; migrate for a major-version plan; debug for version-specific advisories and release-note clues. Pass the public registry package name, not an import path or repository path. The ecosystem is auto-detected when possible; set ecosystem for non-npm names that are ambiguous. Pass version with check/security and from_version with upgrade/migrate/debug so the result is specific to the user's install. Read summary and hint first, then inspect only the relevant data fields. Follow next_calls when another package check or a project lookup is needed. Examples: check_package({ package: 'express', task: 'check', version: '5.1.0' }); check_package({ package: 'next', task: 'upgrade', from_version: '14.2.0' }). Not for locating imports in the user's code (find_code) or discovering installed dependencies from their project (get_project_context). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | One goal per call: check=safe to add; security=CVEs for version; upgrade=version bump plan; migrate=major-version migration; debug=version-specific release clues. | check |
| source | No | Optional. local = read pinned version from disk (stdio only). Prefer passing version/from_version directly. | |
| channel | No | INTERNAL: Zephex terminal CLI only. Agents must omit — returns richer fields than agent-safe JSON. | |
| package | Yes | Package name on the public registry — e.g. next, stripe, prisma, express, @supabase/supabase-js. | |
| version | No | Installed or pinned version. Pass for task=check|security so advisories are evaluated against the user's actual version. | |
| cli_depth | No | INTERNAL: CLI terminal depth. Agents must omit. | |
| ecosystem | No | Registry (default npm, auto-detected). Omit for next/stripe/prisma. | |
| from_version | No | Version being changed from. Pass for task=upgrade|migrate|debug so release notes and advisories are version-specific. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description's final 'read-only' line is redundant with annotations, but it adds genuinely useful behavioral context beyond them: auto-detection of ecosystem, one-task-per-call semantics, version-specific result specificity, output reading order (summary and hint first, then inspected fields), and next_calls follow-up behavior. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long and dense, but it stays front-loaded and every sentence earns its place: the core purpose, trigger list, ordering constraint, task semantics, parameter rules, output-handling protocol, examples, and exclusions are all instruction-bearing. The trigger list is somewhat long and some phrases overlap with the install-ordering sentence, but the structure is clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter tool with no output schema, the description leaves little unaccounted for. It states the exact task enum semantics, the version/from_version pairing rules, the auto-detection behavior, how to read the result (summary and hint first, then relevant data fields), and the next_calls follow-up flow. The only moderate gaps (e.g., exact return format) are mitigated by the described output-reading protocol.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real semantic value: it warns to pass the public registry package name, not an import path or repository path; specifies which task requires which version (package version with check/security, from_version with upgrade/migrate/debug); gives concrete argument examples for express and next; and adds 'set ecosystem for ambiguous non-npm names' with 'set the ecosystem for non-npm names ambiguous.' This goes meaningfully beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: verify a public registry package before installation, recommendation, or dependency changes. Names multiple concrete scenarios (safety, CVEs, typo/slopsquat, deprecation, breaking changes) and explicitly differentiates from siblings (not for find_code, not for get_installed_dependencies), so an agent can distinguish it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit ALWAYS trigger list (install, add package, upgrade, bump, migrate, is this package safe, check CVEs, etc.), a strict ordering rule (call before npm/pnpm/yarn/bun/pip/cargo/gem install; do not install first and inspect later), and a preference statement over web search and raw registry metadata. Also names when NOT to use it (installed dependencies, locale nding code). This is comprehensive and non-ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_testTest PulseARead-onlyInspect
Run the project's real test suite and return structured health — the same engine as the terminal command zephex check test. Detects bun, vitest, jest, pytest, go test, and cargo. Parses JUnit plus lcov (not a regex over stdout). Returns summary, a plain card (what broke, why clusters, coverage, warnings), fix_first, broken_areas, failure_clusters, coverage_by_area, and session_id. Not a file picker for what to edit. ALWAYS call after you edited source, when they ask if tests pass, what is failing, why tests failed, are we green, before commit, before push, or to re-run only the failed tests. PREFER this over running bun test, npm test, or pytest yourself and dumping logs. This already ran the suite, clustered the failures, and named the first file to fix. Workflow: task=detect sees the runner without executing (framework, command, test file count). task=run executes once and stores a session. Then task=failures, status, list, coverage, missing, why, or fix_prompt using session_id (or omit session_id to read the last run on this machine). Do not re-run the whole suite just to read failures. Read summary and fix_first first. On FAIL, call task=failures, then fix those files. task=why with a question explains clusters. task=missing finds changed source without tests. task=fix_prompt is a paste-ready brief. Pass diff_base: main after edits for failures_in_diff. area or file_filter scopes a later run. Local stdio: omit path (the editor cwd — their machine) or pass that project folder. Hosted: public GitHub URL or inline_files — not a local disk path. Does not modify source. Does not invent a runner if none exists. Does not choose product files to edit. Does not check npm packages. Does not scan a live URL. Example: check_test({ task: "run" }) then check_test({ task: "failures", session_id: "" }).
| Name | Required | Description | Default |
|---|---|---|---|
| area | No | Scope to module/area name derived from test paths (e.g. proxy, auth, handlers) | |
| path | No | Project folder. Local/stdio: omit to use the editor cwd (tests run on their machine), or pass the absolute folder. Hosted: public GitHub URL or inline_files — not a local disk path. Required for run/detect unless stdio cwd is a project. missing accepts path or session_id. | |
| task | No | run = execute the suite (stores a session). detect = see runner, do not execute. failures|status|list|coverage|fix_prompt|why = read the last session (no re-run). missing = git-diff sources without tests. Same tasks as zephex check test / check test failures. | run |
| limit | No | Max rows for task:history (1–20) | |
| command | No | Override auto-detected test command | |
| question | No | Natural-language follow-up for task:why (e.g. "what failed in proxy?") | |
| diff_base | No | Git branch for patch coverage and failures_in_diff (e.g. main) — use after edits | |
| session_id | No | From a prior task=run (ts_*). Reuse for failures/status/list/why/fix_prompt so you do not re-run. Omit on stdio to read the last run on this machine. | |
| timeout_ms | No | Max run time ms (default 1800000 stdio, capped 600000 hosted) | |
| failed_only | No | Re-run only tests that failed in the prior session | |
| file_filter | No | Substring or glob fragment to filter test_files (e.g. auth, handlers) | |
| coverage_top | No | Max files in coverage slice | |
| detail_level | No | Token budget: brief <500 tokens on PASS; agent default; full=all slices | agent |
| inline_files | No | Hosted fallback when github is unavailable: { "package.json": "...", "src/foo.test.ts": "..." }. Supports task detect and task run (temp dir on Railway). Include package.json with scripts.test. | |
| include_flaky | No | Include flaky test hints from local history | |
| with_coverage | No | Collect lcov coverage (default true) | |
| include_missing | No | Git-diff scan for source files without matching tests (default true on detect and when diff_base set) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish readOnlyHint:true and destructiveHint:false, and the description corroborates and adds beyond structured data by disclosing session caching: it can be executed without re-running, and 'session_id persists across calls for the same run' but beware sub-concept of last-run. The description also carries the notable disclaimer that it 'does not invent a runner if none is present', 'does not modify test files...', and that a run is not re-executed on a status/read call but reuses the session. These are important behavioral traits: each call may be cached, and in hosted mode cannot accept a filesystem path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured, front-loaded with the core purpose in the first sentence, followed by exclusions, use triggers, a workflow section, negative behavioral notes, and a brief example pair. Length is justified by the breadth (13 task values, 17 parameters), but a few repeated phrases (e.g., identical runner list, 'parsing no vs. not') could be tightened, so it is efficient but not maximally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is highly complex with 17 parameters and 12 task modes, and there is no output schema; the description compensates fully by listing the 10 named return fields (breakdown, coverage, fix_first, broken-area-failures...). It covers operation in both standard I/O and hosted contexts, gaits through a typical 'run then inspect failures' sequence, and states limitations ('no npm check', 'no scanning') and the count of an execution. Everything an interview agent needs to know to call it correctly for a given situation is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3: the input schema already documents `task`, `session_id`, `path`, `diff_base`, `question`, etc. Leading the description above baseline is workflow guidance: it orders which value to use whenlife — 'task=detect... then task=run; then failures|status|list|coverage|why|fix_prompt with session_id' — and semantics that cross parameters, like 'diff_base: main after edits' and 'area/file_filter scopes the next run.' It makes the orchestrations between task and other parameters meaning richer than the schema's enum descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource: 'Run the project's real test suite and return structured health' — a precise, action-oriented statement of what it does. It further distinguishes itself from siblings by explicit negatives: 'not a file-picker for what to edit', 'Does not check npm packages', 'Does not scan a live URL', and names the terminal alias 'the same engine as zephex check test.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives extremely explicit triggers: 'ALWAYS use after you edited source, when they ask if tests pass, what is failing, why defects, green check, before commit, before push, or to re-run only failed tests.' It even names the alternative it replaces: 'PREFER this over running bun test, npm test, or pytest yourself and dumping logs.' Conditions like 'PREFER this over' and 'Use when not' make through when-to-use unambiguous; it also tells when NOT to: 'not a file picker for what to edit.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_architectureExplain ArchitectureARead-onlyIdempotentInspect
Map how files in the user's project connect — which files are hubs, what imports what, where auth/API/database live. Not file bodies. ALWAYS call when they ask how auth works, where login is checked, what's the database, how the API is wired, give me an overview of these files, or where do I patch this feature. If they named Zephex or MCP and want a wiring map, you MUST call this before opening a pile of files. Prefer this over native Read on 10–20 files. Any language on their machine: Python CLI, Node, Go, a monorepo, an unsaved folder. Local/stdio: omit path (editor cwd) or pass their folder. No disk: inline_files or a public GitHub URL (https://github.com/owner/repo). concern = the word they used (auth, gateway, billing, users) — any label, not a fixed list. focus=auth|api|database|integrations when they named that slice. mode=overview first; mode=deep only if you need request_flows. subpath = one package in a monorepo. Read summary + data.entry_points + data.auth_flow + data.concern_cluster + next_calls. Then read_code outline on those hubs — do not open 20 files yourself. Empty cluster means that label is not in this repo. Outbound provider keys (OPENAI_API_KEY) are not inbound login. Not for stack/scripts (get_project_context). Not for 'where is this symbol' (find_code). Not for a function body (read_code). Example: explain_architecture({ concern: "auth", mode: "overview" }). Public repo: explain_architecture({ path: "https://github.com/owner/repo", focus: "api" }).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | overview=fast wiring map (no AST flow trace), deep=request_flows + sequenceDiagram, audit=anti_patterns + health_score. Default: overview | |
| path | No | The user's project folder. Local/stdio: omit to use editor cwd, or pass the absolute folder. Hosted with no disk: omit and use inline_files, or a public GitHub URL. | |
| focus | No | Wiring slice. Default: api. auth=validation chain, integrations=external SDK touchpoints, database=ORM, security=auth+errors, full=all analyzers. | |
| force | No | Bypass architecture result cache. Default false. | |
| concern | No | Any subsystem label (folder name, feature codename, module). Uses find_code concept search + import graph — not a fixed keyword list. Returns roles, edges, symbols (no file bodies). | |
| exclude | No | Optional glob patterns to exclude from ripgrep (vendor, build, etc.). | |
| subpath | No | Monorepo scope — analyze only this subdirectory (e.g. apps/api). Faster than whole repo. | |
| verbosity | No | Output size. minimal=core only, standard=default, full=adds constraints + state_management. Alias: detail_level | |
| seed_files | No | 1–20 paths from find_code — graph expands to related modules. Use with or without concern. | |
| detail_level | No | Legacy alias for verbosity | |
| inline_files | No | Fallback for remote transports. Shape: { "": "" }. Include 10-50 SOURCE files (entry points, routes, middleware, auth, DB setup) plus package.json. For local stdio, prefer 'path'. | |
| project_path | No | Alias for 'path' (some clients pass this name). Accepts the same values. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey read-only and non-destructive behavior, and the description adds meaningful behavioral context: it returns an architecture map, has empty-cluster semantics for absent labels, clarifies that outbound provider keys are not inbound login, and warns against opening many files manually. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and the first sentence carries the essential meaning. It is long and dense, and its one-paragraph layout makes scanning harder, so it loses a point on structure despite every sentence carrying useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by naming expected result fields (summary, data.entry_points, data.auth_flow, data.concern_cluster, next_calls), giving the follow-up workflow (read_code on hubs), covering the local/stdio/remote cases, and explaining what an empty cluster means. For a 12-parameter compositional analysis tool, this is a fully serviceable definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Because the schema documentation covers 100% of parameters, the floor is 3, but the description adds clarifying semantics beyond the schema: 'concern' is any user label, not a fixed list, 'focus' maps to the slice the user named, 'path' behaves differently for local vs hosted, and it gives concrete invocation examples. Not every parameter gets extra treatment, so 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Map how files in the user's project connect' and clarifies scope with 'Not file bodies'. It also distinguishes itself from siblings like read_code and find_code, so an agent gets a crisp picture of what this tool is for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-call triggers ('ALWAYS call when they ask how auth works', 'where to patch this feature'), a MUST-call condition for Zephex/MCP wiring questions, and an explicit not-for list naming sibling tools. It even advises preferring this over native Read on 10–20 files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_codeFind CodeARead-onlyIdempotentInspect
Search the user's project when you do not know which file holds something. Ranked hits; the definition of that name comes first, not a call site like const user = await name(). ALWAYS call instead of guessing a path. ALWAYS call when the user says where is, find, who uses, usages, or rename X everywhere. If they named Zephex or MCP and asked to find something in their code, this is the tool. Prefer this over native Grep when location is unknown — results are ranked and hand off to read_code. intent=symbol — they named a function/class/type. intent=concept — a topic; pass also_try synonyms (rate limit + throttle). intent=snippet — they pasted a line from the editor. intent=everywhere — every occurrence before a rename (whole_word:true). Works on any local project on their machine, any language. Local/stdio: omit path to search the editor cwd, or pass path as their project folder. No disk: inline_files, or a public GitHub URL. Returns summary, data.matches, files_hit, next_calls. Then call read_code with target set to that symbol name, or mode=file/outline with files=[path]. Not for stack/scripts (get_project_context). Not when you already have the exact file and symbol (read_code). Example: find_code({ query: "validateToken", intent: "symbol" }). Rename: find_code({ query: "OldName", intent: "everywhere", whole_word: true }). Topic: find_code({ query: "encrypt", intent: "concept", also_try: ["cipher", "AES"] }). If the first hit is the wrong file, follow next_calls or tighten with file_pattern / include=code. Do not fall back to guessing a path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | The user's project folder. Local/stdio: omit to use editor cwd, or pass the absolute folder. Hosted: public GitHub URL or inline_files. | |
| query | Yes | Required. Text to find: pasted editor line, symbol name (validateToken), or topic keyword (encrypt). | |
| intent | No | Search mode. snippet=paste exact line. symbol=find definition. concept=topic hunt. everywhere=all hits before rename. | |
| include | No | Limit file types. code=src. docs=md/readme. config=json/yaml. data=sql/prisma. all=default. | |
| also_try | No | Extra keywords merged in parallel. concept=topic synonyms. everywhere=rename variants (crystal, CRYSTAL, crystal-app). | |
| whole_word | No | With intent everywhere. true = whole word only (Crystal not Crystalline). Use before renames. | |
| file_pattern | No | Custom glob; overrides include. Examples: src/**/*.ts, **/*.md. | |
| inline_files | No | Hosted MCP only: {"path/to/file.ts": "file contents"}. Use when path disk is unavailable. | |
| case_sensitive | No | true = match exact casing (Crystal vs crystal). Default false. | |
| response_format | No | concise=line preview per hit. detailed=full function/class block when AST available. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive. The description adds significant behavioral context: results are ranked, definitions first, hand-off to read_code, rate limiting/throttle for concept intent, and output details (summary, matches, files_hit, next_calls). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with a clear intro, usage rules, parameter explanations, and examples. It is front-loaded with purpose. While verbose for a simple tool, the complexity of 10 parameters justifies the length. Could be slightly trimmed but still effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters, no output schema, and complex behavior (intents, rate limits, hosted vs local, rename workflow), the description fully covers what the agent needs: when to use, how to construct queries, what to expect in results, and what to do next (call read_code). It even addresses edge cases like inline_files and next_calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description goes beyond by providing examples for each intent, explaining whole_word usage with rename, and detailing also_try synonyms. This adds meaning but some parameter details are also in schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Search the user's project when you do not know which file holds something.' It uses strong action verbs and differentiates from siblings like read_code (exact location) and get_project_context (stack/scripts).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use ('ALWAYS call instead of guessing a path', 'ALWAYS call when the user says where is, find, who uses, usages, or rename'), when not to use ('Not for stack/scripts (get_project_context)', 'Not when you already have the exact file and symbol (read_code)'), and provides a clear alternative (read_code).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_project_contextProject Stack & ScriptsARead-onlyIdempotentInspect
Answer what the user's project is — name, stack, how to run/test/build, auth, database, deploy, folder layout — from their files on disk, not from training data. ALWAYS call this before you invent npm/pip/cargo commands or read package.json yourself. ALWAYS call when the user says: what is this app, what's the stack, how do I run it, how do I test, is this a monorepo, where is auth, what database, how do we deploy. If they named Zephex or MCP, call this first on their project. One topic per call. Start with topic=identity on a new folder, then follow next_calls (usually run or framework). Other topics: backend, frontend, database, auth, deploy, structure, integrations, security. This is the user's machine, any project: Node, Python, Go, Rust, Java, PHP, a monorepo, an unsaved folder. Local/stdio: omit path to use the editor cwd, or pass path as their project folder. No disk on this transport: inline_files with package.json or pyproject.toml/go.mod/Cargo.toml plus 2–4 source files. Returns topic, summary, data (identity, commands, key_paths), hint, next_calls. Copy dev/test/build from data — do not guess bun vs npm vs uv. Not for finding a function name (find_code) or reading a file body (read_code). Those come after you know what the project is. Example: get_project_context({ topic: "identity" }) then get_project_context({ topic: "run" }). Also call topic=auth before touching login, topic=database before schema work, topic=structure when you need the folder map. force:true if the project just changed. Brief is enough for orientation; do not skip this tool to save a round-trip — one identity call replaces reading several manifests.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | The user's project folder. Local/stdio: omit to use editor cwd, or pass the absolute folder (any OS). Hosted with no disk: omit and use inline_files. | |
| force | No | Set true to re-detect even if cached (use when project changed) | |
| topic | No | Which slice to return (one per call). identity=project name/type + which topics apply; run=dev/test/build/lint commands; framework=language/runtime/package manager; backend=API routes and server entry points; frontend=UI framework and pages; database=ORM and providers; auth=login/session providers; deploy=hosting and CI; structure=monorepo layout; integrations=Stripe/Sentry/etc.; security=env and auth surface. | |
| focus_on | No | Subdirectory to focus the file tree scan on (e.g. 'src/tools') | |
| detail_level | No | Output tier: "brief" (default, ≤500 tokens), "standard" (full fields), "full" (all fields + file tree) | |
| inline_files | No | Primary way to supply code. Shape: { "": "", ... }. The VALUE is the actual file body — never a filename, path, or placeholder. Example: { "package.json": "{\"name\":\"my-app\",\"dependencies\":{...}}" }. Always include the project-definition file (package.json / pyproject.toml / Cargo.toml / go.mod / pom.xml / Gemfile / composer.json / pubspec.yaml) plus tsconfig.json / framework config if present, plus 2-4 representative source files. Works on Mac, Windows, Linux, private repos, unsaved folders. | |
| structure_depth | No | Max folder depth for file tree scan (default: 3, max: 6) | |
| include_structure | No | When true, includes file tree in response (also triggered by detail_level: full) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds significant context: data comes from disk (not training), one topic per call, caching with force flag, transport-specific instructions (omit path for local, use inline_files for hosted), and that commands should be copied from data without guessing. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but every sentence earns its place given the tool's complexity (8 params, multiple topics, different transports). It is front-loaded with core purpose and critical 'ALWAYS call' rules. Slight verbosity from examples and repetition, but justified by preventing misuse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no output schema, and annotations present, the description covers all bases: purpose, usage triggers, parameter semantics, return fields (topic, summary, data, hint, next_calls), caching behavior, transport handling, and disambiguation from siblings. It is fully complete for an AI agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all 8 parameters. The description adds substantial meaning beyond schema: explains topic values in detail (identity, run, framework, etc.), provides usage examples (get_project_context({ topic: 'identity' })), clarifies inline_files format with explicit example, and ties parameters together in a workflow (start with topic=identity then follow next_calls).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it answers project identity, stack, and run/test/build commands from disk, not training data. It explicitly distinguishes from siblings like find_code (function name) and read_code (file body), providing clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong usage guidance: 'ALWAYS call this before you invent npm/pip/cargo commands or read package.json yourself.' It lists trigger phrases, specifies topics order (start with identity), and warns when NOT to use (for finding functions or reading files). Explicit alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keep_thinkingStructured ReasoningARead-onlyInspect
Structure multi-step debugging and planning across tool calls — not a one-shot think. Tracks hypotheses, observations, plans; detects loops via lastActions; riskLevel high/critical blocks dangerous edits (drop table, prod deploy). Loads projectBrief (stack, key_paths, project_memory recall) on local project. On close, suggestedRemember → call project_memory remember. 4 credits hosted. Hard cap 10 thoughts/session. Call when: stuck after 2+ failed debug attempts, auth/billing/schema change spans 3+ files, flaky test you cannot explain, or you need a plan before editing. Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem. NOT when fix is known, single typo, repeating without new evidence, or session ended (nextThoughtNeeded:false). Read thoughtConfirmed and shouldContinue first. Legacy alias: thinking. Example: keep_thinking({ thought: 'Hypothesis: refresh token not rotated in middleware', thoughtType: 'hypothesis', thoughtNumber: 1, totalThoughts: 5, nextThoughtNeeded: true, confidence: 0.6, goalAnchor: 'Fix auth logout loop', lastActions: ['find_code(query=refreshToken)', 'read_code(target=authMiddleware)'], area: 'auth' }). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| area | No | Subsystem (auth, billing, api) — scopes project_memory recall. | |
| revises | No | Thought number this revision replaces. | |
| thought | Yes | Reasoning (20–2000 chars) — file names, symbols, error messages. | |
| sessionId | No | Resume prior session; restores checkpoint on thought 1. | |
| confidence | Yes | 0–1. Below 0.5 forces revision. Above 0.85 safe to proceed. | |
| goalAnchor | No | One sentence restating the task — required after thought 2. | |
| actionReady | No | true when done planning and about to execute edits. | |
| assumptions | No | Up to 5 assumptions; set invalidated:true when contradicted. | |
| lastActions | No | Last 2–5 tool calls as name(arg=val) — identical pair triggers boredLoopDetected. | |
| projectPath | No | Local project root (stdio defaults to cwd) for projectBrief. | |
| thoughtType | Yes | hypothesis|debug for investigation; plan|conclusion before acting. | |
| thoughtNumber | Yes | 1-based thought index in this session. | |
| totalThoughts | Yes | Estimated thoughts needed (revise upward if needed). | |
| nextThoughtNeeded | Yes | false ends session and writes checkpoint. | |
| toolOutputRelevance | No | Classify last tool result — 3+ noise/error in last 5 triggers loop. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond annotations by disclosing side effects and constraints: loop detection via lastActions, blocking dangerous edits under high risk, projectBrief loading, suggestedRemember triggering project_memory remember, credit costs, and a session cap of 10 thoughts. These are non-obvious behaviors that the agent needs to know.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and lengthy, but every sentence adds unique value. It is structured logically from purpose to behavior to usage to parameter guidance to an example. Though somewhat long, the complexity of the tool justifies the length, and the example aids comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 15 parameters, no output schema, and rich annotations, the description covers purpose, behavior, usage conditions, and parameter semantics substantially. It references response fields like thoughtConfirmed and shouldContinue, but doesn't spell out the full response structure, which is a minor gap given the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema coverage is 100%, the description enriches parameter meaning with a concrete example and contextual notes like 'Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem.' This adds practical usage nuance beyond the schema's individual field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Structure multi-step debugging and planning across tool calls.' It clearly distinguishes itself from a one-shot think and outlines concrete behaviors like tracking hypotheses and detecting loops, making the tool's unique purpose unmistakable relative to sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use criteria ('stuck after 2+ failed debug attempts...') and when-not-to-use conditions ('NOT when fix is known, single typo...'). This is a textbook example of usage guidance, including alternatives and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_memoryProject MemoryAInspect
Save project notes that must survive this chat — rules, conventions, decisions, gotchas, preferences. Writes notes. Does not read source files. ALWAYS call when they say remember, save this, don't forget, write this down, keep this, my rule, our convention, I always want, last time, what did we decide, what did we save, show me what we stored, or you just learned something that will be gone when this session ends. PREFER this over hoping the next chat still has it. Chat memory dies when the session ends. This does not. One folder can hold many notes (up to 200). Each note is title + content (up to 2000 words) + type. Write the rule and the why — not a one-liner. type=decision|gotcha|goal|preference|area_fact|convention. area= the topic (auth, billing, deploy). tags= keywords that make it findable later (jwt, cookie). action=remember saves the note. action=recall searches title, body, area, and tags and returns matches[].content — read that text and use it. action=list shows recent notes (title, type, area, tags, preview of the body) so you can see what is stored. action=forget deletes by id. Pass limit up to 20 when they want more than a handful. One folder is one set of notes. Different folders never mix unless they ask (scope=all). Omit path on stdio (this folder) or pass that folder. Hosted: pass the same folder string every time. Stdio stores on their machine (/.zephex/memory). Hosted stores in their cloud account. Empty matches means nothing was saved for that query — do not invent a past note. If they ask what we saved, call list or recall. Example: project_memory({ action: "remember", title: "Auth is cookie JWT", content: "Session in httpOnly cookie; refresh on /api/auth/refresh. Do not store access tokens in localStorage.", type: "gotcha", area: "auth", tags: ["jwt","cookie"] }). Find it later: project_memory({ action: "recall", query: "auth cookies" }). See what is stored: project_memory({ action: "list", limit: 10 }).
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Required for forget. Memory uuid. | |
| area | No | Subsystem label (auth, billing, deploy) — included in search index for scoped recall. Max 64 chars. | |
| path | No | Folder these notes belong to. Same string on remember, recall, and list. Stdio: optional (editor cwd). Hosted: reuse that folder string (or normalized_path from remember). | |
| tags | No | Optional lowercase tags. Max 10. | |
| type | No | Required for remember. decision=chose an approach; gotcha=non-obvious bug; goal=what we are building toward; preference=user style; area_fact=fact about a subsystem; convention=naming or process rule. | |
| limit | No | recall/list cap. Default 10, max 20. | |
| query | No | Required for recall. Short keywords from the title or topic (e.g. auth middleware stripe). | |
| scope | No | project=this folder only (default). personal=notes that apply everywhere. all=every project — only when they ask to search everything. | project |
| title | No | Required for remember. Max 80 chars. | |
| action | Yes | remember=save a note, recall=search notes and return full content, list=recent notes with preview, forget=delete by id | |
| content | No | Required for remember. Up to 12000 characters (~2000 words). Write the why and the trap — not a one-liner. | |
| written_by | No | Who authored this memory. | agent |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are sparse and non-destructive, but the description carries the behavioral burden well: it discloses persistent state, per-folder isolation, storage location differences (stdio vs hosted), that empty matches return nothing, and that the tool will not invent notes. It also explains that writes need sufficient detail ('not a one-liner'). It doesn't fully describe output shape, but with no output schema it provides more than enough behavior context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every sentence earns its place: trigger phrases, action rules, storage semantics, and an example are all required to make the four action modes safe to invoke. The trigger list could have been tighter, but it's front-loaded with the core mission first (persist across session), then action-specific details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 12 parameters and no output schema, the description covers: all four actions, required parameters per action, storage location differences, folder isolation, note limits (200 notes; ~2000 words), tag/area semantics, scope=all behavior, and empty match behavior. The biggest gap is a more explicit note on how recall returns matches[] and that the agent must read the content text to use it, but even that is addressed in the text ('read that text and use it').
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers 100% of parameters with descriptions, which sets a baseline. The description adds value beyond schema by describing required parameters per action ('id Required for forget', 'title/content Required for remember', 'query Required for recall'), gives a complete worked example, and explains how tags/area/title combine for search semantics. It might have explained more about the 'title' vs 'query' interplay, but it still exceeds what the structured schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource: 'Save project notes that must survive this chat.' It explains what the tool is for, explicitly states what it does NOT do ('Does not read source files'), and outlines the four actions (remember, recall, list, forget) that map to concrete behaviors. It clearly distinguishes itself from sibling file-reading/repo tools by focusing on persisted conversational memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit trigger phrases ('remember, save this, don't forget...'), states when to prefer this tool over default chat memory, and specifies which action to use in each scenario ('If they ask what we saved, call list or recall'). It also provides guidance on scope, folder isolation, and when to include limit. This is among the most actionable usage guidance possible.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_codeRead CodeARead-onlyIdempotentInspect
Read a known symbol or file from the user's project without dumping the whole tree. AST extract — signature plus body — cheaper than opening a 2,000-line file. ALWAYS call when find_code just returned a name or path, when the user named a function to inspect, or before you edit a large file. If they named Zephex or MCP and asked you to open or explain a function, this is the tool. Prefer this over native Read on files over ~50 lines. mode=symbol — extract by name (target or targets[]). mode=file — batch 1–20 paths. mode=outline — table of contents + plain-English overview before drilling a 300+ line file. mode=scan/smell — keywords or bug smells across files[] you already have. Works on any local project on their machine. Local/stdio: omit path to use editor cwd, or pass path as their project folder. No disk: inline_files. Call-graph modes (callers, blast_radius, dead_code) need local disk only. Returns summary, data.symbols or data.files, next_calls. Follow next_calls if truncated. Not for unknown location (find_code first). Not for stack/scripts (get_project_context). Example: read_code({ mode: "symbol", target: "validateToken" }) or read_code({ mode: "outline", files: ["src/auth.ts"] }). After find_code, do not re-search — pass the symbol as target or the path in files[]. detail_level=signature is enough to decide; body when you will edit. compact:true drops line numbers. Batch files[] instead of opening one path at a time.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | With mode:symbol. Filter to one symbol kind — disambiguate class vs method with same name. | |
| mode | No | symbol=AST extract by name (default). file=batch read files[] (all paths return). outline=file TOC. scan=keyword/pattern hits across files[] (use target or targets). smell=bug-pattern pass on files[] (empty catch, TODO, secrets). callers|blast_radius|dead_code=call graph (local path only). | |
| path | No | The user's project folder. Local/stdio: omit to use editor cwd, or pass the absolute folder. Hosted with no disk: use inline_files. Pair files[] from find_code. | |
| files | No | With mode:file|outline. Relative paths — from find_code hits. File mode: every path returns in one call (truncated per file if large, never dropped). | |
| target | No | mode:symbol|callers|blast_radius — symbol name (fuzzy). mode:scan — keyword or regex to find across files[]. | |
| compact | No | With mode:file|symbol. true = omit line numbers to save tokens. | |
| targets | No | mode:symbol — batch symbol names (max 8, set max_results:10). mode:scan — multiple keywords in one pass across files[]. | |
| symbol_id | No | With mode:symbol. Direct lookup ID from a prior hit (e.g. src/auth.ts::validateUser#function). Skips fuzzy search. | |
| max_tokens | No | Response size cap (default 2000, max 8000). File batch auto-shares across paths. Lower only if context is tight. | |
| session_id | No | Dedup across turns — symbols already returned get a stub with symbol_id instead of full body. | |
| limit_lines | No | With mode:file. Max lines per file. Default: budget-based; set for pagination slices. | |
| max_results | No | mode:symbol — max symbols (default 3, max 10). mode:scan|smell — max hits returned (default 30, max 100). | |
| offset_line | No | With mode:file. Start line (1-indexed). Use after batch read when data.hint says truncated. | |
| context_path | No | With mode:symbol. File path hint for ranking (e.g. src/auth.ts when repo has many auth symbols). | |
| detail_level | No | With mode:symbol. signature=~100 tokens. body=full implementation (default). context=body+imports. | |
| inline_files | No | When path disk is unavailable: {"src/auth.ts": ""}. Hosted/private transport fallback. | |
| confidence_threshold | No | With mode:symbol. Min match confidence 0–1 (default 0.5). Raise 0.8 for exact; lower 0.3 to explore. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, indicating a safe read operation. The description adds substantial behavioral context: it explains the AST extraction approach cost vs whole-file reads, that it returns summary with data.symbols/data.files and next_calls for pagination, and how modes affect behavior (e.g., file mode returns all paths, symbol mode uses fuzzy search). It also notes constraints like local disk requirements for call graph modes and path fallback for hosted transport. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every sentence earns its place given the tool's complexity (17 parameters, 8 modes). It is front-loaded with the essential purpose and immediate usage rule, then systematically covers each mode. While it could be slightly tighter, the density of actionable information justifies the length. Structure with mode labels and bullet-tips is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has many modes, 17 parameters, and no output schema, the description provides a thorough overview. It explains what is returned (summary, data.symbols/files, next_calls), truncation behavior, and successfully bridges the gap between parameters and real usage. It covers edge cases like missing disk (inline_files) and pagination (offset_line, session_id). Minor gaps: the exact shape of symbol/file objects in the output is not detailed, but the description does reference prior hits and stubs to indicate reuse.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter already has a description. However, the tool description adds strategic value beyond the schema: it explains the interplay between modes and parameters (e.g., 'detail_level=signature is enough to decide; body when you will edit', 'compact:true drops line numbers', 'batch files[] instead of opening one path at a time'). It also provides usage patterns like 'After find_code, do not re-search — pass the symbol as target or the path in files[].' This high-level guidance is not inferable from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a known symbol or file from the user's project without dumping the whole tree, using AST extraction. It distinguishes from siblings by explicitly telling when to prefer this over native Read (files over ~50 lines) and when to use find_code first or get_project_context instead. The verb 'Read' and resource 'symbol or file' are specific, and the many modes are well-scoped.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: 'ALWAYS call when find_code just returned a name or path, when the user named a function to inspect, or before you edit a large file.' It also says when not to use: 'Not for unknown location (find_code first). Not for stack/scripts (get_project_context).' It names alternatives (find_code, get_project_context) and gives concrete examples for different modes. This is exceptional usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Zephex_dev_infoZephex Developer Knowledge BaseARead-onlyIdempotentInspect
Expert developer playbooks — not your repo. Stripe webhooks & checkout, Supabase RLS, Next.js auth (clerk, next-auth), payment flows, CSP/HSTS, deploy patterns. operation=search finds entries by question; operation=get returns full guidance by slug from search. Read summary and checklist first. 2 credits hosted. No project path. Call when standard patterns beat guessing — wiring stripe checkout, fixing auth middleware, Supabase RLS policies, hardening after audit_headers. Use AFTER repo tools if code context is still thin. NOT for user's codebase (get_project_context, find_code, read_code), registry packages (check_package), tests (check_test), live URL (audit_headers), or saving decisions (project_memory). Example: Zephex_dev_info({ operation: 'search', query: 'Stripe webhook raw body verification', category: 'payments' }) then get with returned slug. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Required for get — exact slug from a search hit. | |
| query | No | Required for search — e.g. 'Supabase RLS for multi-tenant' or 'Next.js middleware auth'. | |
| category | No | Optional search filter — payments, auth, security, databases, etc. | |
| operation | No | search=find by query (first step); get=full entry by slug from search. | search |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, deceptiveHint, and idempotentHint. The description adds valuable context: credit cost ('2 credits hosted'), no project path, the need to use search before get (slug must come from search), and 'Read-only' reinforces safety. No contradiction detected; it supplements annotations with operational constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense yet every sentence adds value: scope, operations, use cases, exclusions, and an example. It is front-loaded with the core concept ('Expert developer playbooks — not your repo') and structured logically. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, workflow, limitations, cost, timing, and explicit exclusions. Despite no output schema, it clarifies that get returns 'full guidance by slug' and search returns entries. It is sufficiently complete for an agent to select and invoke correctly in varied scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter described. The description adds workflow semantics by explaining operation sequence (search first, get with returned slug) and provides a concrete usage example (Zephex_dev_info({ operation: 'search', query: 'Stripe webhook...', category: 'payments' })). This goes beyond the schema's static descriptions, earning a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as 'Expert developer playbooks' with specific operations (search by query, get by slug) and scope ('not your repo'). It explicitly contrasts with repo tools and lists concrete use cases like 'wiring stripe checkout' and 'Supabase RLS policies', making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance ('Call when standard patterns beat guessing'), when-to-use-after ('Use AFTER repo tools if code context is still thin'), and a detailed NOT list naming sibling tools (get_project_context, find_code, read_code, check_package, check_test, audit_headers, project_memory). This is exemplary usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceMCP gateway adding per-tool RBAC, tenant isolation, audit export, and PII redaction to any server.MIT
- FlicenseNot gradedqualityDmaintenanceMCP server for automated architectural mapping, security vulnerability detection, ML asset tracking, and code metrics in local repositories.
- AlicenseNot gradedqualityBmaintenanceA self-hosted MCP gateway and control plane that aggregates and manages MCP servers and tools, providing unified access, a web console, access control, invocation auditing, and integrated build/deploy workflows.Apache 2.0
- FlicenseNot gradedqualityDmaintenanceA centralized gateway and router that integrates multiple MCP servers into a single endpoint with built-in policy enforcement and secret management. It features a Web GUI for managing tool access, audit logs, and multi-environment configurations across various sub-servers.