Zephex
Server Details
MCP gateway with 10 tools for code analysis, architecture, package audit & security.
- Status
- Unhealthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 4.8/5 across 10 of 10 tools scored.
Each tool targets a distinct purpose: URL auditing, package verification, test execution, architecture mapping, code search, project context, multi-step reasoning, persistent notes, code reading, and knowledge base. No two tools have overlapping responsibilities, making selection unambiguous.
Most tools follow a verb_noun pattern (e.g., audit_headers, check_package, find_code), but project_memory and Zephex_dev_info are noun phrases without verbs, and keep_thinking uses a verb+gerund structure. This reduces overall consistency.
With 10 tools covering diverse analysis and development tasks, the count is well-scoped for a developer assistant server. Each tool earns its place without feeling redundant or overwhelming.
The set covers essential developer needs: code search, project context, testing, package verification, URL auditing, architecture analysis, memory, and knowledge base. Missing write or modification tools, but the read-only focus seems intentional and the coverage is broad.
Available Tools
10 toolsaudit_headersAudit HTTP HeadersARead-onlyIdempotentInspect
Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health (ALIVE/DEGRADED/BROKEN), exposed secrets, tech stack. Read plain_summary first; only drill into security_headers or secrets if grade is poor. quick ~1–3s; scan_depth=deep for secret scan (~8–12s). 6 credits hosted. Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys. Blocks localhost/private IPs. NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context). Example: audit_headers({ url: 'https://myapp.vercel.app' }). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public https:// URL to audit — e.g. https://myapp.vercel.app or https://zephex.dev | |
| path | No | Optional subpath (e.g. /checkout) — appended to url | |
| focus | No | Trim output layers (default: all) | |
| check_ssl | No | Check SSL certificate validity, expiry, and protocol (default: true) | |
| scan_mode | No | quick=~1-3s (default); thorough=DNS+APIs+secrets ~5-12s | |
| check_apis | No | Probe /api/health and common API paths — adds ~1-2s (default: false) | |
| check_tech | No | Tech stack: framework, hosting, CDN, third-party (default: true) | |
| scan_depth | No | quick=light scan, 3 bundles (default); deep=full supply URL phase with JWT decode, source maps, verification (~8-12s) | |
| timeout_ms | No | Max scan time in ms (default: 8000, max: 15000) | |
| check_health | No | Site health: verdict, trust score, load time, page title (default: true) | |
| probe_engine | No | fetch=HTTP only (default); browser=headless Chrome on Zephex servers for console errors + browser network (falls back to fetch with warning if unavailable) | |
| check_cookies | No | Check cookie Secure/HttpOnly/SameSite flags (default: true) | |
| check_headers | No | Grade all security headers and return fix snippets when include_fix_snippets=true (default: true) | |
| check_network | No | HTTP network timing table — slow requests, API probes (default: true) | |
| check_secrets | No | Secret scan: HTML/JS keys, exposed .env/.git, GraphQL (default: true; depth via scan_depth) | |
| security_depth | No | basic=fast (default); full adds DNS SPF/DMARC/DKIM + HSTS preload lookup | |
| check_redirects | No | Follow and audit the full redirect chain (default: true) | |
| include_fix_snippets | No | Include Nginx/Vercel/Next fix snippets — token-heavy (default: false) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/idempotent, so the bar for added transparency is lower. The description adds substantial behavioral context beyond annotations: 'Blocks localhost/private IPs' is a critical safety disclosure; 'quick ~1–3s; scan_depth=deep for secret scan (~8–12s)' discloses timing; '6 credits hosted' discloses cost; 'Read plain_summary first; only drill into security_headers or secrets if grade is poor' gives a workflow behavior. All traits are consistent with the readOnly hint, so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: state purpose, list outputs, provide reading strategy, timings, credit cost, when-to-call, safety block, exclusions, an example, and read-only reminder. It is front-loaded with the most important information and uses semicolons to keep it tight. For a tool with 18 parameters, this is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential context needed to safely and effectively invoke the tool: input constraints (public HTTPS URL), output summary (security grade, SSL, etc.), safety (blocks localhost/private IPs), cost (6 credits), performance expectations (quick vs. deep), usage flow (read plain_summary first), and a concrete example. Since there is no output schema, the description appropriately outlines the key return categories. The 18-parameter schema plus rich annotations make this complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (18/18 parameters have descriptions), so the baseline is 3. The tool description mentions 'scan_depth=deep for secret scan' but the schema already explains deep scan behavior in the 'scan_depth' parameter description. No additional parameter semantics are provided beyond what is already in the schema, so the score stays at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Audit a public HTTPS URL the user deployed — security grade A–F, SSL, headers, cookies, health, exposed secrets, tech stack.' This clearly states what the tool does and enumerates its outputs. It also distinguishes from siblings with explicit exclusions: 'NOT for repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context).' This is a model of purpose clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives precise when-to-use guidance: 'Call when user pastes a live URL — post-deploy check, is it secure, what framework, exposed keys.' It also provides an example call and explicitly names alternatives for non-matching cases, such as 'repo code (find_code), packages (check_package), tests (check_test), or project layout (get_project_context).' This is comprehensive usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_packageCheck PackageARead-onlyIdempotentInspect
Check a public registry package before install or version bump — frameworks (next, react, vite), payments (stripe), auth (next-auth, clerk), ORMs (prisma, drizzle). task=check: exists, slopsquat, deprecation, CVEs (pass version); task=upgrade|migrate: breaking_changes + migration_steps from release notes; task=security: CVEs for your version. Returns summary, data, next_calls, meta.credits (5 hosted). No project path — just package name + version. Call BEFORE npm install or bumping next/stripe/prisma. NOT for repo layout (get_project_context), import search (find_code), tests (check_test), architecture (explain_architecture), live URLs (audit_headers). Example: check_package({ package: 'next', task: 'upgrade', from_version: '14.2.0' }). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| task | No | check=safe to add? upgrade|migrate=bump plan; security=CVEs; debug=advisories+detail. | check |
| source | No | Optional. local = read pinned version from disk (stdio only). Prefer passing version/from_version directly. | |
| channel | No | INTERNAL: Zephex terminal CLI only. Agents must omit — returns richer fields than agent-safe JSON. | |
| package | Yes | Package name on the public registry — e.g. next, stripe, prisma, express, @supabase/supabase-js. | |
| version | No | Your installed/pinned version — required for CVE check on task=check|security. | |
| cli_depth | No | INTERNAL: CLI terminal depth. Agents must omit. | |
| ecosystem | No | Registry (default npm, auto-detected). Omit for next/stripe/prisma. | |
| from_version | No | Version you are upgrading FROM — required for task=upgrade|migrate. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and the description ends with 'Read-only' which aligns. Beyond annotations, it reveals return structure ('Returns summary, data, next_calls, meta.credits (5 hosted)'), task-specific behaviors (check/upgrade/security), and a key constraint ('No project path — just package name + version'). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but efficiently organized. It starts with a clear purpose, then lists task behaviors, return info, constraints, exclusions, and an example—all in a compact paragraph. Every sentence adds value, and the use of semicolons and em dashes keeps it readable despite the high information density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, no output schema, and moderate complexity, the description is thorough: it explains return values (summary, data, next_calls, meta.credits), task-specific output differences, the 'no project path' constraint, and explicitly names sibling tools for exclusions. The internal parameters (channel, cli_depth) are already documented in the schema, so no gap exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100%, the description adds significant meaning beyond field names. It explains task values in detail (e.g., 'task=check: exists, slopsquat, deprecation, CVEs (pass version); task=upgrade|migrate: breaking_changes + migration_steps from release notes') and clarifies which versions are needed for which task. The example invocation ties parameters together.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Check a public registry package before install or version bump' and enumerates common packages (next, react, stripe). It explicitly differentiates from siblings by stating what it's NOT for (repo layout, import search, tests, architecture, live URLs) and names those sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear when-to-use guidance is given: 'Call BEFORE npm install or bumping next/stripe/prisma.' It also provides explicit exclusions with alternative tool names: 'NOT for repo layout (get_project_context), import search (find_code), tests (check_test), architecture (explain_architecture), live URLs (audit_headers).' The example call further illustrates usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_testTest PulseARead-onlyInspect
Run tests and return structured health — fix_first, broken_areas, failure_clusters, coverage_by_area, blind_spots, deploy probes. Not for finding which files to edit (find_code). Workflow: task=detect (0 credits — framework, command, test file count, missing-test gaps) → task=run once (1 credit hosted on success) → task=failures|missing|why|status|fix_prompt on session_id (0 credits, cached session, no re-run). task=missing scans git diff for source files without tests (0 credits, no suite run). meta.credits and meta.charges_usage show billing. Read summary and fix_first first; detail_level=brief on PASS. Call after every substantive edit, when user asks if tests pass or if tests are missing, or before push. Pass diff_base: main for failures_in_diff. area/file_filter scopes re-runs after a full run. Local stdio: absolute project path (runs on your machine). Hosted: public GitHub URL or inline_files — not local disk paths. NOT for symbols (find_code), packages (check_package), stack brief (get_project_context), URL audit (audit_headers). Example: check_test({ task: "detect", path: "/abs/my-app" }) then check_test({ task: "missing", path: "/abs/my-app" }) then check_test({ task: "run", path: "/abs/my-app" }). Does not modify source.
| Name | Required | Description | Default |
|---|---|---|---|
| area | No | Scope to module/area name derived from test paths (e.g. proxy, auth, handlers) | |
| path | No | Project root — absolute path (stdio) or public GitHub URL (hosted). Required for run/detect/missing (or session_id for missing). | |
| task | No | detect=0 credits (inventory+gaps); missing=0 credits (test gaps only); run=1 credit hosted; failures|why|status=0 credits on session_id. | run |
| limit | No | Max rows for task:history (1–20) | |
| command | No | Override auto-detected test command | |
| question | No | Natural-language follow-up for task:why (e.g. "what failed in proxy?") | |
| diff_base | No | Git branch for patch coverage and failures_in_diff (e.g. main) — use after edits | |
| session_id | No | Pass back from prior response (ts_*) for session tasks without re-running | |
| timeout_ms | No | Max run time ms (default 1800000 stdio, capped 600000 hosted) | |
| failed_only | No | Re-run only tests that failed in the prior session | |
| file_filter | No | Substring or glob fragment to filter test_files (e.g. auth, handlers) | |
| coverage_top | No | Max files in coverage slice | |
| detail_level | No | Token budget: brief <500 tokens on PASS; agent default; full=all slices | agent |
| inline_files | No | Hosted fallback when github is unavailable: { "package.json": "...", "src/foo.test.ts": "..." }. Supports task detect and task run (temp dir on Railway). Include package.json with scripts.test. | |
| include_flaky | No | Include flaky test hints from local history | |
| with_coverage | No | Collect lcov coverage (default true) | |
| include_missing | No | Git-diff scan for source files without matching tests (default true on detect and when diff_base set) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds 'Does not modify source'. It further discloses billing (meta.credits, meta.charges_usage), session caching with no re-run, hosted vs. local stdio execution, and path restrictions — all beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and front-loaded, with the key purpose and outputs first. It contains an example and organized workflow, but it is quite long; some credit/billing detail could be condensed. Still, every sentence contributes value, so it earns a 4 rather than a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 17 parameters, no output schema, and a complex multi-task tool, the description is remarkably complete. It explains the task lifecycle, return fields, credit costs, path modes, scoping parameters, and exclusions — sufficient for an agent to select and invoke the tool correctly in most situations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description enriches parameter semantics significantly: e.g., 'Pass diff_base: main for failures_in_diff', 'area/file_filter scopes re-runs after a full run', 'task=missing scans git diff', 'session_id for session tasks', and inline_files as a hosted fallback. This guidance goes well beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run tests') with a clear list of structured outputs (fix_first, broken_areas, failure_clusters, coverage_by_area, blind_spots, deploy probes). Explicitly distinguishes from siblings by saying 'Not for finding which files to edit (find_code)' and lists other exclusions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a concrete workflow (detect → run → failures|missing|why|status|fix_prompt), explicit call triggers ('after every substantive edit', 'when user asks if tests pass or if tests are missing', 'before push'), and clear alternatives/don'ts (find_code, check_package, get_project_context, audit_headers). Also explains credit costs for when to use which task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_architectureExplain ArchitectureARead-onlyIdempotentInspect
Maps how files connect across a subsystem — roles and import edges, not file bodies. Ripgrep + import-graph analyzers; detects framework, language, architecture_type. Envelope: focus, summary, hint, data, related_focus, next_calls, meta (meta.cache_hit, meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 7 credits per success; failures free. Cheapest path: mode overview + concern or seed_files — ~1.5–4k tokens, replaces 10+ blind read_code file opens. Repeat identical calls hit server cache (meta.cache_hit) until force:true. Expensive: mode deep or audit on whole monorepo — use subpath. >10k files auto-degrades to overview. data: entry_points, layer_map, concern_cluster (with concern or seed_files[]), integration_map, auth_flow, dependency_graph; deep adds request_flows + Mermaid; audit adds anti_patterns + health_score. dimension_confidence per slice; warnings on low confidence. focus: api|auth|integrations|database|security|data_flow|error_handling|full. Pass concern (any label) or seed_files[] (1–20 from find_code). subpath scopes monorepos. Call BEFORE cross-cutting edits — how a feature spans modules, where to patch. Do NOT for stack (get_project_context), search (find_code), bodies (read_code), tests, packages, live URL. After: next_calls → read_code outline on hub files. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | overview=fast wiring map (no AST flow trace), deep=request_flows + sequenceDiagram, audit=anti_patterns + health_score. Default: overview | |
| path | No | Where the project lives. Stdio MCP: absolute path to the project directory on disk. Hosted transport without local disk: use inline_files (10–50 source files + package.json). | |
| focus | No | Wiring slice. Default: api. auth=validation chain, integrations=external SDK touchpoints, database=ORM, security=auth+errors, full=all analyzers. | |
| force | No | Bypass architecture result cache. Default false. | |
| concern | No | Any subsystem label (folder name, feature codename, module). Uses find_code concept search + import graph — not a fixed keyword list. Returns roles, edges, symbols (no file bodies). | |
| exclude | No | Optional glob patterns to exclude from ripgrep (vendor, build, etc.). | |
| subpath | No | Monorepo scope — analyze only this subdirectory (e.g. apps/api). Faster than whole repo. | |
| verbosity | No | Output size. minimal=core only, standard=default, full=adds constraints + state_management. Alias: detail_level | |
| seed_files | No | 1–20 paths from find_code — graph expands to related modules. Use with or without concern. | |
| detail_level | No | Legacy alias for verbosity | |
| inline_files | No | Fallback for remote transports. Shape: { "": "" }. Include 10-50 SOURCE files (entry points, routes, middleware, auth, DB setup) plus package.json. For local stdio, prefer 'path'. | |
| project_path | No | Alias for 'path' (some clients pass this name). Accepts the same values. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and idempotent, and the description adds 'Read-only.' It discloses critical behavioral details: 'Hosted: 7 credits per success; failures free,' caching behavior ('Repeat identical calls hit server cache (meta.cache_hit) until force:true'), and performance degradation ('>10k files auto-degrades to overview'). It also documents the output envelope and data fields since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and information-packed, with the core purpose in the first sentence. Every section adds value—cost, caching, output structure, usage boundaries—but the length is substantial. A more condensed layout could improve scannability, though the complexity of the tool justifies the detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and a complex tool (12 params, 3 modes, 8 focus values), the description thoroughly covers return data fields, envelope structure, cost behavior, caching, degradation, and explicit usage exclusions. It also notes confidence warnings and auto-degrade behavior, leaving minimal gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Though schema coverage is 100%, the description adds meaningful context: concern is 'not a fixed keyword list' and uses 'find_code concept search + import graph'; seed_files are '1–20 paths from find_code'; mode cost implications are explained ('deep or audit on whole monorepo — use subpath'); focus values are expanded (auth=validation chain, etc.). This goes well beyond schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's specific function: 'Maps how files connect across a subsystem — roles and import edges, not file bodies.' This distinguishes it from siblings like read_code (bodies) and find_code (search). It also provides concrete use cases like 'Call BEFORE cross-cutting edits — how a feature spans modules, where to patch.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use and when not to: 'Do NOT for stack (get_project_context), search (find_code), bodies (read_code), tests, packages, live URL.' Names alternatives directly and suggests follow-up: 'After: next_calls → read_code outline on hub files.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_codeFind CodeARead-onlyIdempotentInspect
PREFER over native Grep when location is unknown. Ripgrep + AST ranking across web, mobile, CLI, and monorepos. Envelope: intent, focus, summary, data.matches, files_hit, next_calls, meta.credits (5 hosted). intent: snippet=pasted line; symbol=known name; concept=topic+also_try synonyms; everywhere=rename map (whole_word). include docs|config|data when markdown, JSON, or SQL matter. Call when: where is X, usages, rename prep. DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers). After: read summary + next_calls → read_code on top hit. path=absolute dir (stdio) or public Git URL / inline_files (hosted). Token-capped vs raw grep. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Project folder to search. Local MCP: absolute path (/Users/jane/myapp). Hosted MCP: public GitHub URL or inline_files. | |
| query | Yes | Required. Text to find: pasted editor line, symbol name (validateToken), or topic keyword (encrypt). | |
| intent | No | Search mode. snippet=paste exact line. symbol=find definition. concept=topic hunt. everywhere=all hits before rename. | |
| include | No | Limit file types. code=src. docs=md/readme. config=json/yaml. data=sql/prisma. all=default. | |
| also_try | No | Extra keywords merged in parallel. concept=topic synonyms. everywhere=rename variants (crystal, CRYSTAL, crystal-app). | |
| whole_word | No | With intent everywhere. true = whole word only (Crystal not Crystalline). Use before renames. | |
| file_pattern | No | Custom glob; overrides include. Examples: src/**/*.ts, **/*.md. | |
| inline_files | No | Hosted MCP only: {"path/to/file.ts": "file contents"}. Use when path disk is unavailable. | |
| case_sensitive | No | true = match exact casing (Crystal vs crystal). Default false. | |
| response_format | No | concise=line preview per hit. detailed=full function/class block when AST available. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond annotations by disclosing the response envelope ('Envelope: intent, focus, summary, data.matches, files_hit, next_calls, meta.credits (5 hosted)'), token-capped behavior, AST ranking, and read-only nature. It also explains intent-specific behavior with examples like 'snippet=pasted line; symbol=known name; concept=topic+also_try synonyms; everywhere=rename map'. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries meaning. It is front-loaded with the primary directive ('PREFER over native Grep when location is unknown'), then organizes usage, exclusions, and output structure in a compact, scannable format. Despite its length, there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, 4 intents, hosted vs stdio modes, no output schema), the description is remarkably complete. It covers response envelope, after-call workflow ('read summary + next_calls → read_code on top hit'), path/inline_files handling, and dependency on credits. It fully equips an agent to invoke and interpret the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter described, so baseline is 3. The description adds value by explaining how to choose intent values ('snippet=pasted line; symbol=known name'), when to use include ('include docs|config|data when markdown, JSON, or SQL matter'), and path semantics for stdio vs hosted. This clarifies parameter choices beyond the schema, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Ripgrep + AST ranking across web, mobile, CLI, and monorepos' – a code search tool with scope and mechanism. It explicitly differentiates from native Grep and sibling tools via 'PREFER over native Grep' and the 'DO NOT' list naming alternatives like read_code and get_project_context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use ('Call when: where is X, usages, rename prep') and when-not-to-use ('DO NOT: known symbol+file (read_code), stack/scripts (get_project_context), wiring (explain_architecture), tests (check_test), packages (check_package), URL audit (audit_headers)') with named alternative tools. This is exemplary usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_project_contextProject Stack & ScriptsARead-onlyIdempotentInspect
Scans manifests and config — one topic slice per call. Detects stack, scripts, monorepo, API routes, auth/DB providers, integrations, env vars. Secret-sanitized. Workflow: topic=identity first on new repo → follow next_calls (framework, run, structure). Topics: identity, framework, backend, frontend, database, auth, deploy, run, structure, integrations, security, overview. brief ≤500 tokens; standard adds version health; full adds file tree. 7 credits hosted. Every response: topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits. Use data and next_calls — never invent commands. Call when: new session; user asks stack, scripts, or how to run/test/build. Do NOT: symbol search (find_code), file bodies (read_code), wiring (explain_architecture), tests (check_test). Pass path (absolute project dir) or inline_files (package.json + 2-4 source files). force:true refreshes cache. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Absolute path to the project root. Stdio MCP reads manifests from disk directly. Omit on stdio when editor cwd is the project root. | |
| force | No | Set true to re-detect even if cached (use when project changed) | |
| topic | No | Which slice to return (one per call). identity=project name/type + which topics apply; run=dev/test/build/lint commands; framework=language/runtime/package manager; backend=API routes and server entry points; frontend=UI framework and pages; database=ORM and providers; auth=login/session providers; deploy=hosting and CI; structure=monorepo layout; integrations=Stripe/Sentry/etc.; security=env and auth surface. | |
| focus_on | No | Subdirectory to focus the file tree scan on (e.g. 'src/tools') | |
| detail_level | No | Output tier: "brief" (default, ≤500 tokens), "standard" (full fields), "full" (all fields + file tree) | |
| inline_files | No | Primary way to supply code. Shape: { "": "", ... }. The VALUE is the actual file body — never a filename, path, or placeholder. Example: { "package.json": "{\"name\":\"my-app\",\"dependencies\":{...}}" }. Always include the project-definition file (package.json / pyproject.toml / Cargo.toml / go.mod / pom.xml / Gemfile / composer.json / pubspec.yaml) plus tsconfig.json / framework config if present, plus 2-4 representative source files. Works on Mac, Windows, Linux, private repos, unsaved folders. | |
| structure_depth | No | Max folder depth for file tree scan (default: 3, max: 6) | |
| include_structure | No | When true, includes file tree in response (also triggered by detail_level: full) |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds substantial behavioral context: 'Secret-sanitized', '7 credits hosted', a guaranteed response contract ('Every response: topic, focus, summary, data.key_paths, hint, related_topics, next_calls, meta.credits'), cache-refresh behavior via force:true, and a final 'Read-only' confirmation. It enriches the safety profile without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but every sentence earns its place. It is front-loaded with the core purpose, then workflow, topic enumeration, output contract, usage conditions, and exclusions — structured with semicolons and lists that make it scannable. There is no fluff or repetition of schema field definitions; it only adds details not already in the structured data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool: 8 parameters, nested inline_files object, 11 topics, no output schema, and multiple sibling tools that could be confused. Despite that, the description covers the response format (since there is no output schema), the topic set, input modes, cost/credits, caching, and exclusions — effectively compensating for every complexity. It is as complete as one could hope for without the actual output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, but the description adds meaningful nuance beyond the schema: it explains detail_level behavior ('brief ≤500 tokens; standard adds version health; full adds file tree'), clarifies inline_files usage ('Pass path ... or inline_files (package.json + 2-4 source files)'), and documents force:true semantics. It also provides guidance on choosing path vs inline_files. This is exactly the kind of added value the dimension calls for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Scans manifests and config — one topic slice per call.' It enumerates what it detects (stack, scripts, monorepo, API routes, auth/DB providers, integrations, env vars) and explicitly distinguishes itself from siblings with a 'Do NOT' list (symbol search via find_code, file bodies via read_code, wiring via explain_architecture, tests via check_test). This is a clear, specific purpose that is easy to differentiate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit 'Call when' conditions (new session; user asks stack, scripts, or how to run/test/build) and explicit exclusions with named alternative tools. It also provides a recommended workflow: 'topic=identity first on new repo → follow next_calls'. This goes well beyond basic usage and is exactly what an agent needs to select the right tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keep_thinkingStructured ReasoningARead-onlyInspect
Structure multi-step debugging and planning across tool calls — not a one-shot think. Tracks hypotheses, observations, plans; detects loops via lastActions; riskLevel high/critical blocks dangerous edits (drop table, prod deploy). Loads projectBrief (stack, key_paths, project_memory recall) on local project. On close, suggestedRemember → call project_memory remember. 4 credits hosted. Hard cap 10 thoughts/session. Call when: stuck after 2+ failed debug attempts, auth/billing/schema change spans 3+ files, flaky test you cannot explain, or you need a plan before editing. Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem. NOT when fix is known, single typo, repeating without new evidence, or session ended (nextThoughtNeeded:false). Read thoughtConfirmed and shouldContinue first. Legacy alias: thinking. Example: keep_thinking({ thought: 'Hypothesis: refresh token not rotated in middleware', thoughtType: 'hypothesis', thoughtNumber: 1, totalThoughts: 5, nextThoughtNeeded: true, confidence: 0.6, goalAnchor: 'Fix auth logout loop', lastActions: ['find_code(query=refreshToken)', 'read_code(target=authMiddleware)'], area: 'auth' }). Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| area | No | Subsystem (auth, billing, api) — scopes project_memory recall. | |
| revises | No | Thought number this revision replaces. | |
| thought | Yes | Reasoning (20–2000 chars) — file names, symbols, error messages. | |
| sessionId | No | Resume prior session; restores checkpoint on thought 1. | |
| confidence | Yes | 0–1. Below 0.5 forces revision. Above 0.85 safe to proceed. | |
| goalAnchor | No | One sentence restating the task — required after thought 2. | |
| actionReady | No | true when done planning and about to execute edits. | |
| assumptions | No | Up to 5 assumptions; set invalidated:true when contradicted. | |
| lastActions | No | Last 2–5 tool calls as name(arg=val) — identical pair triggers boredLoopDetected. | |
| projectPath | No | Local project root (stdio defaults to cwd) for projectBrief. | |
| thoughtType | Yes | hypothesis|debug for investigation; plan|conclusion before acting. | |
| thoughtNumber | Yes | 1-based thought index in this session. | |
| totalThoughts | Yes | Estimated thoughts needed (revise upward if needed). | |
| nextThoughtNeeded | Yes | false ends session and writes checkpoint. | |
| toolOutputRelevance | No | Classify last tool result — 3+ noise/error in last 5 triggers loop. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond annotations by disclosing side effects and constraints: loop detection via lastActions, blocking dangerous edits under high risk, projectBrief loading, suggestedRemember triggering project_memory remember, credit costs, and a session cap of 10 thoughts. These are non-obvious behaviors that the agent needs to know.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and lengthy, but every sentence adds unique value. It is structured logically from purpose to behavior to usage to parameter guidance to an example. Though somewhat long, the complexity of the tool justifies the length, and the example aids comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 15 parameters, no output schema, and rich annotations, the description covers purpose, behavior, usage conditions, and parameter semantics substantially. It references response fields like thoughtConfirmed and shouldContinue, but doesn't spell out the full response structure, which is a minor gap given the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While schema coverage is 100%, the description enriches parameter meaning with a concrete example and contextual notes like 'Pass lastActions (2–5 recent tool calls), goalAnchor after thought 2, sessionId to resume, area for subsystem.' This adds practical usage nuance beyond the schema's individual field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Structure multi-step debugging and planning across tool calls.' It clearly distinguishes itself from a one-shot think and outlines concrete behaviors like tracking hypotheses and detecting loops, making the tool's unique purpose unmistakable relative to sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use criteria ('stuck after 2+ failed debug attempts...') and when-not-to-use conditions ('NOT when fix is known, single typo...'). This is a textbook example of usage guidance, including alternatives and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_memoryProject MemoryAInspect
Persists short notes about this project across chat sessions — facts you learned that are not in source code. Not a repo scanner (use get_project_context for stack). remember: saves title (max 80 chars), content (max 500 chars), type, optional area/tags — rejects API keys, tokens, and instruction-poisoning text. recall: keyword search over title/content/area/tags; returns up to 5 matches with content, type, area, age_days (~500 token cap). list: recent titles. forget: delete by uuid. Max 200 memories per project. Types: decision (why we chose X), gotcha (surprise bug), goal (current objective), preference (user style), area_fact (subsystem fact), convention (naming/rules). scope: project (default), personal (cross-project notes), all (search every project with warnings). Call when: user says remember/recall/last time; before auth/billing/deploy where past choices matter; after a non-obvious fix worth saving; new session on same repo. Do not call when: stack/scripts (get_project_context), finding code (find_code), fact already in this chat. After recall: apply matches directly — do not re-scan the repo. Use the same path on remember, recall, and list (stdio: optional, uses cwd). Stdio stores in ~/.zephex SQLite; hosted stores in cloud per user.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Required for forget. Memory uuid. | |
| area | No | Subsystem label (auth, billing, deploy) — included in search index for scoped recall. Max 64 chars. | |
| path | No | Project bucket — use the same absolute path on remember, recall, and list. Stdio: optional (defaults to editor cwd). Hosted: reuse normalized_path from the remember response. | |
| tags | No | Optional lowercase tags. Max 10. | |
| type | No | Required for remember. decision=chose an approach; gotcha=non-obvious bug; goal=what we are building toward; preference=user style; area_fact=fact about a subsystem; convention=naming or process rule. | |
| limit | No | recall/list cap. Default 5, max 10. | |
| query | No | Required for recall. Short keywords from the title or topic (e.g. auth middleware stripe). | |
| scope | No | project=current DB, personal=~/.zephex personal, all=cross-project with warnings. | project |
| title | No | Required for remember. Max 80 chars. | |
| action | Yes | remember=save a fact, recall=keyword search, list=recent titles, forget=delete by id | |
| content | No | Required for remember. Max 500 chars. Paraphrase, not file dumps. | |
| written_by | No | Who authored this memory. | agent |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is rich (limits, max 200 memories, ~500 token cap, rejects API keys) but directly contradicts the annotations: it describes 'forget: delete by uuid' (a destructive action) while destructiveHint=false. Per rubric, any contradiction yields a score of 1. Flagging as annotation contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-organized with action prefixes and usage bullets. Every sentence carries specific, non-redundant information (limits, types, storage). It earns a 4; a 5 would require tighter prose without losing the rich context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description covers purpose, actions, limits, types, scope, storage, and usage guidance well. Recall's return shape is partially described (content, type, area, age_days), but list and forget response details are sparse. Overall, it is nearly complete for a multi-action tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the description adds practical semantics beyond the schema: it clarifies path reuse ('Use the same path on remember, recall, and list'), scope distinctions (project vs personal vs all), and action-specific required fields. This goes beyond baseline (3) but is not exhaustive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool persists project notes across chat sessions and differentiates from siblings: 'Not a repo scanner (use get_project_context for stack)' and 'finding code (find_code)'. It enumerates the four actions (remember, recall, list, forget) with specifics, leaving no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit call-when conditions (user says remember/recall/last time; before auth/billing/deploy; after non-obvious fixes; new session) and do-not-call conditions (stack/scripts → get_project_context; finding code → find_code; facts already in chat). This is clear, actionable guidance with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_codeRead CodeARead-onlyIdempotentInspect
Extracts code surgically via tree-sitter AST — not repo-wide search. Eight modes; envelope: mode, focus, summary, data, hint, related_modes, next_calls, meta (meta.tokens_returned, meta.credits, meta.charges_usage). Hosted: 5 credits per success; failures free. Cheapest path: mode file or outline with files[] you already have — ~300–2000 tokens vs full-file Read (data.tokens_saved_vs_full_files). Expensive: mode symbol without find_code first on large repos (may scan many files). Free alternative: editor Read on files under ~50 lines. symbol: fuzzy match by name; symbol_id direct lookup; detail_level signature|body|context; targets[] batch (max 8). file: batch 1–20 paths, paginate offset_line. outline: TOC + plain-English overview before 300+ line files. scan/smell: keyword or bug patterns across known files[] only. callers|blast_radius|dead_code: local SQLite call-graph (index builds after first symbol call on that path) — not on hosted without disk; use find_code for remote usage search. Call when: symbol or files[] known (from find_code or explain_architecture next_calls). Do NOT when: location unknown (find_code); stack (get_project_context); wiring map (explain_architecture); repo-wide grep (find_code). Pass path (absolute dir) or inline_files. compact:true saves tokens; session_id dedupes across turns. After: summary + next_calls before paging. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | With mode:symbol. Filter to one symbol kind — disambiguate class vs method with same name. | |
| mode | No | symbol=AST extract by name (default). file=batch read files[] (all paths return). outline=file TOC. scan=keyword/pattern hits across files[] (use target or targets). smell=bug-pattern pass on files[] (empty catch, TODO, secrets). callers|blast_radius|dead_code=call graph (local path only). | |
| path | No | Project root. Stdio MCP: absolute path to the directory on disk. Hosted transport without local disk: use inline_files instead. Pair files[] paths from find_code. | |
| files | No | With mode:file|outline. Relative paths — from find_code hits. File mode: every path returns in one call (truncated per file if large, never dropped). | |
| target | No | mode:symbol|callers|blast_radius — symbol name (fuzzy). mode:scan — keyword or regex to find across files[]. | |
| compact | No | With mode:file|symbol. true = omit line numbers to save tokens. | |
| targets | No | mode:symbol — batch symbol names (max 8, set max_results:10). mode:scan — multiple keywords in one pass across files[]. | |
| symbol_id | No | With mode:symbol. Direct lookup ID from a prior hit (e.g. src/auth.ts::validateUser#function). Skips fuzzy search. | |
| max_tokens | No | Response size cap (default 2000, max 8000). File batch auto-shares across paths. Lower only if context is tight. | |
| session_id | No | Dedup across turns — symbols already returned get a stub with symbol_id instead of full body. | |
| limit_lines | No | With mode:file. Max lines per file. Default: budget-based; set for pagination slices. | |
| max_results | No | mode:symbol — max symbols (default 3, max 10). mode:scan|smell — max hits returned (default 30, max 100). | |
| offset_line | No | With mode:file. Start line (1-indexed). Use after batch read when data.hint says truncated. | |
| context_path | No | With mode:symbol. File path hint for ranking (e.g. src/auth.ts when repo has many auth symbols). | |
| detail_level | No | With mode:symbol. signature=~100 tokens. body=full implementation (default). context=body+imports. | |
| inline_files | No | When path disk is unavailable: {"src/auth.ts": ""}. Hosted/private transport fallback. | |
| confidence_threshold | No | With mode:symbol. Min match confidence 0–1 (default 0.5). Raise 0.8 for exact; lower 0.3 to explore. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations already declaring readOnly/idempotent, the description adds substantial behavioral context: credit costs per success, hosted vs local disk limitations, SQLite call-graph index build behavior, file batch truncation ('never dropped'), and token-saving options like compact. It explicitly states 'Read-only' and does not contradict any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: it front-loads the core purpose, then systematically covers modes, costs, usage boundaries, and post-call behavior. The conditional and imperative structure ('Call when', 'Do NOT when', 'Cheapest path') makes the information actionable without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 17 parameters, 8 modes, no output schema, and complex behavioral nuances (hosted vs local disk, pagination, batch limits, credit costs), the description covers all essential decision points. It even addresses return context via the envelope and next_calls, making it complete for agent selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the schema already describes all 17 parameters, the description adds cross-mode semantics and strategies: which params pair with which modes (e.g., 'file: batch 1–20 paths, paginate offset_line'), performance trade-offs (symbol without find_code may scan many files), and envelope-level advice ('session_id dedupes across turns'). This goes beyond raw schema definitions and materially improves parameter selection.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Extracts code surgically via tree-sitter AST — not repo-wide search.' It names eight modes and explicitly distinguishes itself from siblings like find_code, explain_architecture, and get_project_context. This is a clear, resource-specific purpose that eliminates ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use and when-not-to-use guidance: 'Call when: symbol or files[] known... Do NOT when: location unknown (find_code); stack (get_project_context); wiring map (explain_architecture); repo-wide grep (find_code).' It also offers cost/benefit guidance (cheapest path vs expensive modes) and a free alternative (editor Read on files under ~50 lines).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Zephex_dev_infoZephex Developer Knowledge BaseARead-onlyIdempotentInspect
Expert developer playbooks — not your repo. Stripe webhooks & checkout, Supabase RLS, Next.js auth (clerk, next-auth), payment flows, CSP/HSTS, deploy patterns. operation=search finds entries by question; operation=get returns full guidance by slug from search. Read summary and checklist first. 2 credits hosted. No project path. Call when standard patterns beat guessing — wiring stripe checkout, fixing auth middleware, Supabase RLS policies, hardening after audit_headers. Use AFTER repo tools if code context is still thin. NOT for user's codebase (get_project_context, find_code, read_code), registry packages (check_package), tests (check_test), live URL (audit_headers), or saving decisions (project_memory). Example: Zephex_dev_info({ operation: 'search', query: 'Stripe webhook raw body verification', category: 'payments' }) then get with returned slug. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Required for get — exact slug from a search hit. | |
| query | No | Required for search — e.g. 'Supabase RLS for multi-tenant' or 'Next.js middleware auth'. | |
| category | No | Optional search filter — payments, auth, security, databases, etc. | |
| operation | No | search=find by query (first step); get=full entry by slug from search. | search |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, deceptiveHint, and idempotentHint. The description adds valuable context: credit cost ('2 credits hosted'), no project path, the need to use search before get (slug must come from search), and 'Read-only' reinforces safety. No contradiction detected; it supplements annotations with operational constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense yet every sentence adds value: scope, operations, use cases, exclusions, and an example. It is front-loaded with the core concept ('Expert developer playbooks — not your repo') and structured logically. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, workflow, limitations, cost, timing, and explicit exclusions. Despite no output schema, it clarifies that get returns 'full guidance by slug' and search returns entries. It is sufficiently complete for an agent to select and invoke correctly in varied scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter described. The description adds workflow semantics by explaining operation sequence (search first, get with returned slug) and provides a concrete usage example (Zephex_dev_info({ operation: 'search', query: 'Stripe webhook...', category: 'payments' })). This goes beyond the schema's static descriptions, earning a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as 'Expert developer playbooks' with specific operations (search by query, get by slug) and scope ('not your repo'). It explicitly contrasts with repo tools and lists concrete use cases like 'wiring stripe checkout' and 'Supabase RLS policies', making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance ('Call when standard patterns beat guessing'), when-to-use-after ('Use AFTER repo tools if code context is still thin'), and a detailed NOT list naming sibling tools (get_project_context, find_code, read_code, check_package, check_test, audit_headers, project_memory). This is exemplary usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- Alicense-qualityBmaintenanceMCP gateway adding per-tool RBAC, tenant isolation, audit export, and PII redaction to any server.MIT
- Flicense-qualityDmaintenanceMCP server for automated architectural mapping, security vulnerability detection, ML asset tracking, and code metrics in local repositories.
- Flicense-qualityDmaintenanceA centralized gateway and router that integrates multiple MCP servers into a single endpoint with built-in policy enforcement and secret management. It features a Web GUI for managing tool access, audit logs, and multi-environment configurations across various sub-servers.
- AlicenseAqualityDmaintenanceComprehensive dependency audit MCP server supporting 9 languages and 23 tools for scanning, updating, security auditing, and migration detection.259MIT