Skip to main content
Glama

find_security_patches

Read-onlyIdempotent

Surface release notes likely to contain security or CVE fixes. Canton-specific. Heuristic: matches release bodies containing security / CVE / vulnerability / patch keywords.

Input Schema

NameRequiredDescriptionDefault
limitNoMax rows (default 10).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  2. First observed

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful context beyond that: matching is a keyword heuristic over release bodies, so results are probable rather than authoritative and may miss rewording or false-positive on incidental mentions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with what the tool surfaces before moving to scope then mechanism. No filler, no repetition of the title, and the heuristic caveat arrives last where it belongs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, annotation-covered read tool with no output schema, the description supplies the essentials: subject matter, domain, and the matching mechanism. It leaves the agent guessing about result shape, ordering, and whether zero matches means "no security releases" or "keyword miss," which is a minor but real gap given there is no output schema to fall back on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single `limit` parameter is fully described in the schema (max 30, min 1, default 10), so the schema does the heavy lifting. The description contributes nothing about the parameter, which is the correct baseline of 3 for near-total schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Surface release notes") scoped to security/CVE fixes, with "Canton-specific" narrowing the domain. It never names a sibling such as search_release_notes, so an agent must infer the boundary between this narrow filter and the general release-note search on its own.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the security/CVE framing and the stated keyword heuristic, which tells the agent this is the targeted lookup rather than a broad search. However, there is no explicit when-to-use, no when-not-to-use, and no named alternative to route to when this heuristic surfaces nothing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.