Skip to main content
Glama

Server Details

MCP gateway with 10 tools for code analysis, architecture, package audit & security.

Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.8/5 across 10 of 10 tools scored.

Server CoherenceA
Disambiguation5/5

Each tool targets a distinct purpose: URL auditing, package verification, test execution, architecture mapping, code search, project context, multi-step reasoning, persistent notes, code reading, and knowledge base. No two tools have overlapping responsibilities, making selection unambiguous.

Naming Consistency3/5

Most tools follow a verb_noun pattern (e.g., audit_headers, check_package, find_code), but project_memory and Zephex_dev_info are noun phrases without verbs, and keep_thinking uses a verb+gerund structure. This reduces overall consistency.

Tool Count5/5

With 10 tools covering diverse analysis and development tasks, the count is well-scoped for a developer assistant server. Each tool earns its place without feeling redundant or overwhelming.

Completeness4/5

The set covers essential developer needs: code search, project context, testing, package verification, URL auditing, architecture analysis, memory, and knowledge base. Missing write or modification tools, but the read-only focus seems intentional and the coverage is broad.

Available Tools

10 tools
audit_headersAudit HTTP HeadersA
Read-onlyIdempotent
Inspect

Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health (ALIVE/DEGRADED/BROKEN), exposed secrets, tech stack. Read plain_summary first; only drill into security_headers or secrets if grade is poor. quick ~1–3s; scan_depth=deep for secret scan (~8–12s). 6 credits hosted. Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys. Blocks localhost/private IPs. NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context). Example: audit_headers({ url: 'https://myapp.vercel.app' }). Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic https:// URL to audit — e.g. https://myapp.vercel.app or https://zephex.dev
pathNoOptional subpath (e.g. /checkout) — appended to url
focusNoTrim output layers (default: all)
check_sslNoCheck SSL certificate validity, expiry, and protocol (default: true)
scan_modeNoquick=~1-3s (default); thorough=DNS+APIs+secrets ~5-12s
check_apisNoProbe /api/health and common API paths — adds ~1-2s (default: false)
check_techNoTech stack: framework, hosting, CDN, third-party (default: true)
scan_depthNoquick=light scan, 3 bundles (default); deep=full supply URL phase with JWT decode, source maps, verification (~8-12s)
timeout_msNoMax scan time in ms (default: 8000, max: 15000)
check_healthNoSite health: verdict, trust score, load time, page title (default: true)
probe_engineNofetch=HTTP only (default); browser=headless Chrome on Zephex servers for console errors + browser network (falls back to fetch with warning if unavailable)
check_cookiesNoCheck cookie Secure/HttpOnly/SameSite flags (default: true)
check_headersNoGrade all security headers and return fix snippets when include_fix_snippets=true (default: true)
check_networkNoHTTP network timing table — slow requests, API probes (default: true)
check_secretsNoSecret scan: HTML/JS keys, exposed .env/.git, GraphQL (default: true; depth via scan_depth)
security_depthNobasic=fast (default); full adds DNS SPF/DMARC/DKIM + HSTS preload lookup
check_redirectsNoFollow and audit the full redirect chain (default: true)
include_fix_snippetsNoInclude Nginx/Vercel/Next fix snippets — token-heavy (default: false)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses read-only nature, blocks localhost/private IPs, credit cost, and timing differences between quick/deep scans. Annotations already indicate readOnlyHint, but description adds valuable context like credit usage and timeout guidance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Reasonably concise with front-loaded purpose and example. Could be slightly trimmed, but each sentence adds value. Structure is logical: purpose, usage, example, exclusions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers output types (grade A-F, health statuses), timing, and exclusions. Lacks detailed output schema but given no output schema, the description provides sufficient context for an agent to understand what the tool returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 18 parameters with descriptions (100% coverage). Description adds usage hints (e.g., 'include_fix_snippets token-heavy') and an example, but mostly restates schema info. Adds moderate value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'audit' with specific resource 'public HTTPS URL' and outputs like security grade, SSL, headers, etc. Explicitly distinguishes from sibling tools by listing what it is NOT for (find_code, check_package, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States when to use: 'Call when user pastes a live URL — post-deploy check' and explicitly lists alternatives for other use cases. Also recommends reading plain_summary first.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_packageCheck PackageA
Read-onlyIdempotent
Inspect

Check a public registry package before install or version bump — frameworks (next, react, vite), payments (stripe), auth (next-auth, clerk), ORMs (prisma, drizzle). task=check: exists, slopsquat, deprecation, CVEs (pass version); task=upgrade|migrate: breaking_changes + migration_steps from release notes; task=security: CVEs for your version. Returns summary, data, next_calls, meta.credits (5 hosted). No project path — just package name + version. Call BEFORE npm install or bumping next/stripe/prisma. NOT for repo layout (get_project_context), import search (find_code), tests (check_test), architecture (explain_architecture), live URLs (audit_headers). Example: check_package({ package: 'next', task: 'upgrade', from_version: '14.2.0' }). Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskNocheck=safe to add? upgrade|migrate=bump plan; security=CVEs; debug=advisories+detail.check
sourceNoOptional. local = read pinned version from disk (stdio only). Prefer passing version/from_version directly.
channelNoINTERNAL: Zephex terminal CLI only. Agents must omit — returns richer fields than agent-safe JSON.
packageYesPackage name on the public registry — e.g. next, stripe, prisma, express, @supabase/supabase-js.
versionNoYour installed/pinned version — required for CVE check on task=check|security.
cli_depthNoINTERNAL: CLI terminal depth. Agents must omit.
ecosystemNoRegistry (default npm, auto-detected). Omit for next/stripe/prisma.
from_versionNoVersion you are upgrading FROM — required for task=upgrade|migrate.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destruptiveHint=false. The description goes beyond by noting that no project path is needed (just package name + version), that credits are consumed (5 hosted), and that internal fields (channel, cli_depth) should be omitted by agents. It also describes the return structure (summary, data, next_calls, meta.credits). No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: core purpose first, then tasks, then usage guidance, then exclusions, then example. It is relatively long but every sentence adds value, including the explicit listing of not-for scenarios. Could be slightly shorter by merging some list items, but overall efficient for the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, multiple task types, and no output schema, the description covers all necessary aspects: purpose, tasks, parameter explanations, when-to-use, when-not-to-use, example, and return field hints (summary, data, next_calls, meta.credits). The high schema coverage and annotations complement the description, making it fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (all 8 parameters documented with descriptions). The description adds further meaning: for task, it details each enum value's purpose (check: exists/slopsquat/deprecation/CVEs; upgrade/migrate: breaking_changes+migration_steps; security: CVEs for your version). For version and from_version, it clarifies their required contexts. The examples (package: 'next', task: 'upgrade') add practical clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool checks a public registry package before install or version bump, listing specific frameworks (next, react, vite), payments (stripe), auth (next-auth, clerk), ORMs (prisma, drizzle). It enumerates tasks (check, upgrade, migrate, security) and their purposes, distinguishing it from sibling tools like get_project_context, find_code, etc., with explicit 'NOT for' exclusions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('Call BEFORE npm install or bumping next/stripe/prisma') and when not to use it ('NOT for repo layout (get_project_context), import search (find_code), tests (check_test), architecture (explain_architecture), live URLs (audit_headers)'). It also provides an example call with parameters, giving clear context for task=upgrade.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_testTest PulseA
Read-only
Inspect

Run tests and return structured health — fix_first, broken_areas, failure_clusters, coverage_by_area, blind_spots, deploy probes. Not for finding which files to edit (find_code). Workflow: task=detect (0 credits — framework, command, test file count, missing-test gaps) → task=run once (1 credit hosted on success) → task=failures|missing|why|status|fix_prompt on session_id (0 credits, cached session, no re-run). task=missing scans git diff for source files without tests (0 credits, no suite run). meta.credits and meta.charges_usage show billing. Read summary and fix_first first; detail_level=brief on PASS. Call after every substantive edit, when user asks if tests pass or if tests are missing, or before push. Pass diff_base: main for failures_in_diff. area/file_filter scopes re-runs after a full run. Local stdio: absolute project path (runs on your machine). Hosted: public GitHub URL or inline_files — not local disk paths. NOT for symbols (find_code), packages (check_package), stack brief (get_project_context), URL audit (audit_headers). Example: check_test({ task: "detect", path: "/abs/my-app" }) then check_test({ task: "missing", path: "/abs/my-app" }) then check_test({ task: "run", path: "/abs/my-app" }). Does not modify source.

ParametersJSON Schema
NameRequiredDescriptionDefault
areaNoScope to module/area name derived from test paths (e.g. proxy, auth, handlers)
pathNoProject root — absolute path (stdio) or public GitHub URL (hosted). Required for run/detect/missing (or session_id for missing).
taskNodetect=0 credits (inventory+gaps); missing=0 credits (test gaps only); run=1 credit hosted; failures|why|status=0 credits on session_id.run
limitNoMax rows for task:history (1–20)
commandNoOverride auto-detected test command
questionNoNatural-language follow-up for task:why (e.g. "what failed in proxy?")
diff_baseNoGit branch for patch coverage and failures_in_diff (e.g. main) — use after edits
session_idNoPass back from prior response (ts_*) for session tasks without re-running
timeout_msNoMax run time ms (default 1800000 stdio, capped 600000 hosted)
failed_onlyNoRe-run only tests that failed in the prior session
file_filterNoSubstring or glob fragment to filter test_files (e.g. auth, handlers)
coverage_topNoMax files in coverage slice
detail_levelNoToken budget: brief <500 tokens on PASS; agent default; full=all slicesagent
inline_filesNoHosted fallback when github is unavailable: { "package.json": "...", "src/foo.test.ts": "..." }. Supports task detect and task run (temp dir on Railway). Include package.json with scripts.test.
include_flakyNoInclude flaky test hints from local history
with_coverageNoCollect lcov coverage (default true)
include_missingNoGit-diff scan for source files without matching tests (default true on detect and when diff_base set)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses extensive behavioral traits beyond annotations: non-destructive ('Does not modify source'), credit system for each task, caching behavior for session tasks, billing indicators (meta.credits), scope of task=missing (git diff scan), and detail_level token budgets. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured and front-loaded with the core purpose, then workflow, billing, usage guidance, and examples. Every sentence adds value, though it could be slightly more terse. Length is justified by tool complexity (17 parameters, multiple tasks).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema and high parameter count, the description is comprehensive. It covers local vs hosted modes, credit costs, workflow examples, and credit monitoring. No obvious gaps for an AI agent to misuse the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema description coverage is 100%, the description adds meaningful context: explains credit implications for each task, when parameters like path or session_id are required, how diff_base is used, and the purpose of area and inline_files. Examples illustrate parameter combinations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs tests and returns structured health data (fix_first, broken_areas, etc.). It explicitly distinguishes from siblings like find_code, audit_headers, check_package, and get_project_context. The verb+resource+scope pattern is precise.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Call after every substantive edit, when user asks if tests pass or if tests are missing, or before push.' Also specifies when-not-to-use with a list of alternative tools and gives a detailed workflow example with tasks, credits, and diff_base usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_architectureExplain ArchitectureA
Read-onlyIdempotent
Inspect

Maps how files connect across a subsystem — roles and import edges, not file bodies. Ripgrep + import-graph analyzers; detects framework, language, architecture_type. Envelope: focus, summary, hint, data, related_focus, next_calls, meta (meta.cache_hit, meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 7 credits per success; failures free. Cheapest path: mode overview + concern or seed_files — ~1.5–4k tokens, replaces 10+ blind read_code file opens. Repeat identical calls hit server cache (meta.cache_hit) until force:true. Expensive: mode deep or audit on whole monorepo — use subpath. >10k files auto-degrades to overview. data: entry_points, layer_map, concern_cluster (with concern or seed_files[]), integration_map, auth_flow, dependency_graph; deep adds request_flows + Mermaid; audit adds anti_patterns + health_score. dimension_confidence per slice; warnings on low confidence. focus: api|auth|integrations|database|security|data_flow|error_handling|full. Pass concern (any label) or seed_files[] (1–20 from find_code). subpath scopes monorepos. Call BEFORE cross-cutting edits — how a feature spans modules, where to patch. Do NOT for stack (get_project_context), search (find_code), bodies (read_code), tests, packages, live URL. After: next_calls → read_code outline on hub files. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNooverview=fast wiring map (no AST flow trace), deep=request_flows + sequenceDiagram, audit=anti_patterns + health_score. Default: overview
pathNoWhere the project lives. Stdio MCP: absolute path to the project directory on disk. Hosted transport without local disk: use inline_files (10–50 source files + package.json).
focusNoWiring slice. Default: api. auth=validation chain, integrations=external SDK touchpoints, database=ORM, security=auth+errors, full=all analyzers.
forceNoBypass architecture result cache. Default false.
concernNoAny subsystem label (folder name, feature codename, module). Uses find_code concept search + import graph — not a fixed keyword list. Returns roles, edges, symbols (no file bodies).
excludeNoOptional glob patterns to exclude from ripgrep (vendor, build, etc.).
subpathNoMonorepo scope — analyze only this subdirectory (e.g. apps/api). Faster than whole repo.
verbosityNoOutput size. minimal=core only, standard=default, full=adds constraints + state_management. Alias: detail_level
seed_filesNo1–20 paths from find_code — graph expands to related modules. Use with or without concern.
detail_levelNoLegacy alias for verbosity
inline_filesNoFallback for remote transports. Shape: { "": "" }. Include 10-50 SOURCE files (entry points, routes, middleware, auth, DB setup) plus package.json. For local stdio, prefer 'path'.
project_pathNoAlias for 'path' (some clients pass this name). Accepts the same values.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate read-only, idempotent, non-destructive. Description adds caching behavior, cost, auto-degrade for large repos, and confirms read-only nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but no wasted sentences; front-loaded with purpose. Slightly verbose but each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Thorough given 12 params, annotations, no output schema. Covers envelope, meta, data outputs, token estimates, and usage scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%. Description adds context beyond schema: explains concern usage, seed_files, inline_files fallback. Slightly above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Maps how files connect across a subsystem — roles and import edges, not file bodies.' Distinguishes from siblings by explicitly listing what not to use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Call BEFORE cross-cutting edits' and lists alternatives: 'Do NOT for stack (get_project_context), search (find_code), bodies (read_code)...'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_codeFind CodeA
Read-onlyIdempotent
Inspect

PREFER over native Grep when location is unknown. Ripgrep + AST ranking across web, mobile, CLI, and monorepos. Envelope: intent, focus, summary, data.matches, files_hit, next_calls, meta.credits (5 hosted). intent: snippet=pasted line; symbol=known name; concept=topic+also_try synonyms; everywhere=rename map (whole_word). include docs|config|data when markdown, JSON, or SQL matter. Call when: where is X, usages, rename prep. DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers). After: read summary + next_calls → read_code on top hit. path=absolute dir (stdio) or public Git URL / inline_files (hosted). Token-capped vs raw grep. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoProject folder to search. Local MCP: absolute path (/Users/jane/myapp). Hosted MCP: public GitHub URL or inline_files.
queryYesRequired. Text to find: pasted editor line, symbol name (validateToken), or topic keyword (encrypt).
intentNoSearch mode. snippet=paste exact line. symbol=find definition. concept=topic hunt. everywhere=all hits before rename.
includeNoLimit file types. code=src. docs=md/readme. config=json/yaml. data=sql/prisma. all=default.
also_tryNoExtra keywords merged in parallel. concept=topic synonyms. everywhere=rename variants (crystal, CRYSTAL, crystal-app).
whole_wordNoWith intent everywhere. true = whole word only (Crystal not Crystalline). Use before renames.
file_patternNoCustom glob; overrides include. Examples: src/**/*.ts, **/*.md.
inline_filesNoHosted MCP only: {"path/to/file.ts": "file contents"}. Use when path disk is unavailable.
case_sensitiveNotrue = match exact casing (Crystal vs crystal). Default false.
response_formatNoconcise=line preview per hit. detailed=full function/class block when AST available.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, but the description adds concrete behavioral details: token-capped vs raw grep, read-only nature, and envelope response structure. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat lengthy but well-structured and front-loaded with the key preference and summary. Every sentence adds value, though minor trimming could improve conciseness without loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters, no output schema, and sibling tools, the description covers usage context, parameter details, output structure (envelope fields), and clear don't-use cases. It is fully complete for an AI agent to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, yet the description adds significant meaning: explains intent values with examples (snippet=pasted line, symbol=known name), path format differences between local and hosted, and the purpose of include options. This goes well beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool finds code using ripgrep + AST ranking, and distinguishes itself from sister tools by naming specific alternatives (read_code, get_project_context, etc.). The verb 'find' and resource 'code' are specific, and the scope is well-defined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use ('PREFER over native Grep when location is unknown', 'Call when: where is X, usages, rename prep') and when not to use ('DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers)'). Alternatives are named for each exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_project_contextProject Stack & ScriptsA
Read-onlyIdempotent
Inspect

Scans manifests and config — one topic slice per call. Detects stack, scripts, monorepo, API routes, auth/DB providers, integrations, env vars. Secret-sanitized. Workflow: topic=identity first on new repo → follow next_calls (framework, run, structure). Topics: identity, framework, backend, frontend, database, auth, deploy, run, structure, integrations, security, overview. brief ≤500 tokens; standard adds version health; full adds file tree. 7 credits hosted. Every response: topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits. Use data and next_calls — never invent commands. Call when: new session; user asks stack, scripts, or how to run/test/build. Do NOT: symbol search (find_code), file bodies (read_code), wiring (explain_architecture), tests (check_test). Pass path (absolute project dir) or inline_files (package.json + 2-4 source files). force:true refreshes cache. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoAbsolute path to the project root. Stdio MCP reads manifests from disk directly. Omit on stdio when editor cwd is the project root.
forceNoSet true to re-detect even if cached (use when project changed)
topicNoWhich slice to return (one per call). identity=project name/type + which topics apply; run=dev/test/build/lint commands; framework=language/runtime/package manager; backend=API routes and server entry points; frontend=UI framework and pages; database=ORM and providers; auth=login/session providers; deploy=hosting and CI; structure=monorepo layout; integrations=Stripe/Sentry/etc.; security=env and auth surface.
focus_onNoSubdirectory to focus the file tree scan on (e.g. 'src/tools')
detail_levelNoOutput tier: "brief" (default, ≤500 tokens), "standard" (full fields), "full" (all fields + file tree)
inline_filesNoPrimary way to supply code. Shape: { "": "", ... }. The VALUE is the actual file body — never a filename, path, or placeholder. Example: { "package.json": "{\"name\":\"my-app\",\"dependencies\":{...}}" }. Always include the project-definition file (package.json / pyproject.toml / Cargo.toml / go.mod / pom.xml / Gemfile / composer.json / pubspec.yaml) plus tsconfig.json / framework config if present, plus 2-4 representative source files. Works on Mac, Windows, Linux, private repos, unsaved folders.
structure_depthNoMax folder depth for file tree scan (default: 3, max: 6)
include_structureNoWhen true, includes file tree in response (also triggered by detail_level: full)
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds details beyond annotations: 'Secret-sanitized', '7 credits hosted', response structure (topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits), 'force:true refreshes cache', and 'Read-only'. No contradiction with readOnlyHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Somewhat lengthy (multiple paragraphs) but front-loaded with core purpose, then details. Every sentence adds value, covering workflow, topics, detail levels, response fields, and constraints. Slightly verbose but well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description fully documents the response structure (topic, focus, summary, etc.) and explains all 8 parameters with usage examples. It also covers detail levels, topics, and workflow, making it self-contained for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description enriches all 8 parameters beyond the schema. For example, it expands on the topic values (identity='project name/type + which topics apply'), clarifies inline_files usage with a concrete example and required files, and explains detail_level outputs (brief ≤500 tokens; standard adds version health; full adds file tree).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly defines a specific action ('scans manifests and config') and resource ('project stack & scripts'), listing 11 topics. It explicitly distinguishes from sibling tools (find_code, read_code, check_test, explain_architecture) by stating what it does NOT do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-call (new session, user asks about stack/scripts/build) and when-not-to-call (symbol search, file bodies, wiring, tests). Also suggests a workflow ('topic=identity first on new repo → follow next_calls'), offering clear alternative tool references.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

keep_thinkingStructured ReasoningA
Read-only
Inspect

Structure multi-step debugging and planning across tool calls — not a one-shot think. Tracks hypotheses, observations, plans; detects loops via lastActions; riskLevel high/critical blocks dangerous edits (drop table, prod deploy). Loads projectBrief (stack, key_paths, project_memory recall) on local project. On close, suggestedRemember → call project_memory remember. 4 credits hosted. Hard cap 10 thoughts/session. Call when: stuck after 2+ failed debug attempts, auth/billing/schema change spans 3+ files, flaky test you cannot explain, or you need a plan before editing. Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem. NOT when fix is known, single typo, repeating without new evidence, or session ended (nextThoughtNeeded:false). Read thoughtConfirmed and shouldContinue first. Legacy alias: thinking. Example: keep_thinking({ thought: 'Hypothesis: refresh token not rotated in middleware', thoughtType: 'hypothesis', thoughtNumber: 1, totalThoughts: 5, nextThoughtNeeded: true, confidence: 0.6, goalAnchor: 'Fix auth logout loop', lastActions: ['find_code(query=refreshToken)', 'read_code(target=authMiddleware)'], area: 'auth' }). Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
areaNoSubsystem (auth, billing, api) — scopes project_memory recall.
revisesNoThought number this revision replaces.
thoughtYesReasoning (20–2000 chars) — file names, symbols, error messages.
sessionIdNoResume prior session; restores checkpoint on thought 1.
confidenceYes0–1. Below 0.5 forces revision. Above 0.85 safe to proceed.
goalAnchorNoOne sentence restating the task — required after thought 2.
actionReadyNotrue when done planning and about to execute edits.
assumptionsNoUp to 5 assumptions; set invalidated:true when contradicted.
lastActionsNoLast 2–5 tool calls as name(arg=val) — identical pair triggers boredLoopDetected.
projectPathNoLocal project root (stdio defaults to cwd) for projectBrief.
thoughtTypeYeshypothesis|debug for investigation; plan|conclusion before acting.
thoughtNumberYes1-based thought index in this session.
totalThoughtsYesEstimated thoughts needed (revise upward if needed).
nextThoughtNeededYesfalse ends session and writes checkpoint.
toolOutputRelevanceNoClassify last tool result — 3+ noise/error in last 5 triggers loop.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations confirm read-only; description adds stateful behavior details (tracks hypotheses, loop detection, riskLevel blocking, credit limits) without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but well-structured: front-loaded with core purpose, followed by features, usage conditions, and example. No redundancy; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers behavioral aspects, session handling, and limits but lacks explicit output description. Still sufficient for agent to understand tool behavior and response expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% parameters with descriptions; description adds usage context like lastActions format and goalAnchor requirement, enhancing understanding beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it structures multi-step debugging and planning, differentiating it from sibling tools. Provides specific examples of usage, making purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lists when to call (e.g., stuck after 2+ failed attempts, auth/billing/schema changes) and when not to (e.g., fix known, single typo). Includes alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_memoryProject MemoryAInspect

Persists short notes about this project across chat sessions — facts you learned that are not in source code. Not a repo scanner (use get_project_context for stack). remember: saves title (max 80 chars), content (max 500 chars), type, optional area/tags — rejects API keys, tokens, and instruction-poisoning text. recall: keyword search over title/content/area/tags; returns up to 5 matches with content, type, area, age_days (~500 token cap). list: recent titles. forget: delete by uuid. Max 200 memories per project. Types: decision (why we chose X), gotcha (surprise bug), goal (current objective), preference (user style), area_fact (subsystem fact), convention (naming/rules). scope: project (default), personal (cross-project notes), all (search every project with warnings). Call when: user says remember/recall/last time; before auth/billing/deploy where past choices matter; after a non-obvious fix worth saving; new session on same repo. Do not call when: stack/scripts (get_project_context), finding code (find_code), fact already in this chat. After recall: apply matches directly — do not re-scan the repo. Use the same path on remember, recall, and list (stdio: optional, uses cwd). Stdio stores in ~/.zephex SQLite; hosted stores in cloud per user.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoRequired for forget. Memory uuid.
areaNoSubsystem label (auth, billing, deploy) — included in search index for scoped recall. Max 64 chars.
pathNoProject bucket — use the same absolute path on remember, recall, and list. Stdio: optional (defaults to editor cwd). Hosted: reuse normalized_path from the remember response.
tagsNoOptional lowercase tags. Max 10.
typeNoRequired for remember. decision=chose an approach; gotcha=non-obvious bug; goal=what we are building toward; preference=user style; area_fact=fact about a subsystem; convention=naming or process rule.
limitNorecall/list cap. Default 5, max 10.
queryNoRequired for recall. Short keywords from the title or topic (e.g. auth middleware stripe).
scopeNoproject=current DB, personal=~/.zephex personal, all=cross-project with warnings.project
titleNoRequired for remember. Max 80 chars.
actionYesremember=save a fact, recall=keyword search, list=recent titles, forget=delete by id
contentNoRequired for remember. Max 500 chars. Paraphrase, not file dumps.
written_byNoWho authored this memory.agent
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are blank (none true), but the description fully discloses behaviors: rejects sensitive text, max 200 memories, storage mechanism (stdio: SQLite, hosted: cloud), recall output format (up to 5 matches with content/type/area/age_days, ~500 token cap). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-organized with clear sections (actions, types, when to call, storage). Every sentence is informative, though slightly verbose for a tool with 12 parameters. Structure is logical and front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 12 parameters, no output schema, and complex actions (remember/recall/list/forget), the description covers all critical aspects: action details, parameter semantics, usage guidelines, storage, limits, types, and post-call instructions. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds significant context: explains area is searchable, path must be consistent, scope meanings (project vs personal vs all), type detailed definitions, and after-call guidance for recall. Adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Persists short notes about this project across chat sessions' and distinguishes actions (remember, recall, list, forget). It explicitly contrasts with sibling tools like get_project_context and find_code, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-call (user says remember/recall/last time, before auth/billing/deploy, after non-obvious fix, new session) and when-not-to-call (stack/scripts use get_project_context, finding code use find_code, facts already in chat). This is comprehensive and practical.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_codeRead CodeA
Read-onlyIdempotent
Inspect

Extracts code surgically via tree-sitter AST — not repo-wide search. Eight modes; envelope: mode, focus, summary, data, hint, related_modes, next_calls, meta (meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 5 credits per success; failures free. Cheapest path: mode file or outline with files[] you already have — ~300–2000 tokens vs full-file Read (data.tokens_saved_vs_full_files). Expensive: mode symbol without find_code first on large repos (may scan many files). Free alternative: editor Read on files under ~50 lines. symbol: fuzzy match by name; symbol_id direct lookup; detail_level signature|body|context; targets[] batch (max 8). file: batch 1–20 paths, paginate offset_line. outline: TOC + plain-English overview before 300+ line files. scan/smell: keyword or bug patterns across known files[] only. callers|blast_radius|dead_code: local SQLite call-graph (index builds after first symbol call on that path) — not on hosted without disk; use find_code for remote usage search. Call when: symbol or files[] known (from find_code or explain_architecture next_calls). Do NOT when: location unknown (find_code); stack (get_project_context); wiring map (explain_architecture); repo-wide grep (find_code). Pass path (absolute dir) or inline_files. compact:true saves tokens; session_id dedupes across turns. After: summary + next_calls before paging. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNoWith mode:symbol. Filter to one symbol kind — disambiguate class vs method with same name.
modeNosymbol=AST extract by name (default). file=batch read files[] (all paths return). outline=file TOC. scan=keyword/pattern hits across files[] (use target or targets). smell=bug-pattern pass on files[] (empty catch, TODO, secrets). callers|blast_radius|dead_code=call graph (local path only).
pathNoProject root. Stdio MCP: absolute path to the directory on disk. Hosted transport without local disk: use inline_files instead. Pair files[] paths from find_code.
filesNoWith mode:file|outline. Relative paths — from find_code hits. File mode: every path returns in one call (truncated per file if large, never dropped).
targetNomode:symbol|callers|blast_radius — symbol name (fuzzy). mode:scan — keyword or regex to find across files[].
compactNoWith mode:file|symbol. true = omit line numbers to save tokens.
targetsNomode:symbol — batch symbol names (max 8, set max_results:10). mode:scan — multiple keywords in one pass across files[].
symbol_idNoWith mode:symbol. Direct lookup ID from a prior hit (e.g. src/auth.ts::validateUser#function). Skips fuzzy search.
max_tokensNoResponse size cap (default 2000, max 8000). File batch auto-shares across paths. Lower only if context is tight.
session_idNoDedup across turns — symbols already returned get a stub with symbol_id instead of full body.
limit_linesNoWith mode:file. Max lines per file. Default: budget-based; set for pagination slices.
max_resultsNomode:symbol — max symbols (default 3, max 10). mode:scan|smell — max hits returned (default 30, max 100).
offset_lineNoWith mode:file. Start line (1-indexed). Use after batch read when data.hint says truncated.
context_pathNoWith mode:symbol. File path hint for ranking (e.g. src/auth.ts when repo has many auth symbols).
detail_levelNoWith mode:symbol. signature=~100 tokens. body=full implementation (default). context=body+imports.
inline_filesNoWhen path disk is unavailable: {"src/auth.ts": ""}. Hosted/private transport fallback.
confidence_thresholdNoWith mode:symbol. Min match confidence 0–1 (default 0.5). Raise 0.8 for exact; lower 0.3 to explore.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds important behavioral details: 5 credits per success, free failures, token savings vs full-file Read, local-only call graph modes, and that every file in a batch returns. It explains truncation and pagination behavior, adding significant value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is comprehensive but verbose, running multiple paragraphs. It is well-structured with clear sections (purpose, modes, costs, when-to-use), but some redundancy exists (e.g., repeated 'Read-only'). It trades conciseness for completeness, which is acceptable for a complex tool but not optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (17 parameters, 8 modes, no output schema), the description covers every aspect: all modes with semantics, cost implications, parameter combinations, pagination, session dedup, and explicit alternatives for each scenario. It leaves no gap in understanding how to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptive parameter descriptions. The tool description goes further by explaining mode-specific parameter usage (e.g., 'mode:file|outline' for files[], 'mode:symbol' for target/targets), and provides practical tips like pairing with find_code and setting detail_level. This guidance adds meaningful clarity beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool extracts code via tree-sitter AST and explicitly contrasts with repo-wide search. It lists eight specific modes (symbol, file, outline, etc.) and distinguishes from siblings like find_code and explain_architecture, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Call when' and 'Do NOT when' guidance, referencing sibling tools (find_code, get_project_context, explain_architecture). It also gives cheapest and expensive paths, leaving no doubt about proper use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Zephex_dev_infoZephex Developer Knowledge BaseA
Read-onlyIdempotent
Inspect

Expert developer playbooks — not your repo. Stripe webhooks & checkout, Supabase RLS, Next.js auth (clerk, next-auth), payment flows, CSP/HSTS, deploy patterns. operation=search finds entries by question; operation=get returns full guidance by slug from search. Read summary and checklist first. 2 credits hosted. No project path. Call when standard patterns beat guessing — wiring stripe checkout, fixing auth middleware, Supabase RLS policies, hardening after audit_headers. Use AFTER repo tools if code context is still thin. NOT for user's codebase (get_project_context, find_code, read_code), registry packages (check_package), tests (check_test), live URL (audit_headers), or saving decisions (project_memory). Example: Zephex_dev_info({ operation: 'search', query: 'Stripe webhook raw body verification', category: 'payments' }) then get with returned slug. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoRequired for get — exact slug from a search hit.
queryNoRequired for search — e.g. 'Supabase RLS for multi-tenant' or 'Next.js middleware auth'.
categoryNoOptional search filter — payments, auth, security, databases, etc.
operationNosearch=find by query (first step); get=full entry by slug from search.search
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint, idempotentHint, destructiveHint), the description adds key behavioral details: '2 credits hosted', 'No project path', 'Read-only', and explains the two-operation workflow (search then get) with prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense and front-loaded with the core purpose. However, it is somewhat lengthy and could be broken into bullet points or shorter sentences for easier scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description adequately explains the tool's behavior, operations, and integration points. It covers prerequisites, examples, and error-avoidance guidance, making it fully actionable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema coverage is 100%, the description enriches parameter meaning by explaining how operation, query, slug, and category work together, including an example call. It clarifies that slug is required for 'get' and must come from a search hit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides expert developer playbooks, not a codebase, and distinguishes it from sibling tools like get_project_context, find_code, read_code, etc. It specifies the verb (search/get) and resource (knowledge base entries), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Call when standard patterns beat guessing'), gives concrete examples (wiring Stripe checkout, fixing auth middleware), and advises order ('Use AFTER repo tools'). Also lists what it is NOT for, referencing sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Try in Browser

Your Connectors

Sign in to create a connector for this server.

Resources