Returns the list of all implemented security checks/rules with their IDs, categories, severity levels, and descriptions.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Filter rules by category (manifest, gradle, source, xml-config, secret). Leave empty for all rules. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly indicates the tool returns a list, but it does not explicitly state that this is a read-only operation or that it has no side effects. This is minimal transparency for a listing tool, but not rich enough to warrant a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that directly states the action and the output fields. It is concise, front-loaded, and contains no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter, the description covers the return fields sufficiently, even without an output schema. It lacks explicit context about when to use it relative to sibling tools, which slightly reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides a full description of the 'category' parameter with enum values and filtering semantics, so schema coverage is 100%. The tool description adds no additional parameter information, which aligns with the baseline of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Returns') and identifies the resource ('all implemented security checks/rules') with the exact output fields (IDs, categories, severity levels, descriptions). It clearly distinguishes itself from sibling tools like analyze_android_project and explain_finding, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states what the tool does but provides no guidance on when to use it versus alternatives. It does not mention scenarios, prerequisites, or exclusions. With siblings like analyze_android_project and explain_finding, explicit differentiation is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Each tool has a clearly distinct purpose: analyzing a project, explaining a finding, listing security checks, and checking server health. There is no overlap or ambiguity between them.
Three tools follow the verb_noun pattern (analyze_android_project, explain_finding, list_android_security_checks), while 'health' is a noun-only name. This minor deviation is common and does not reduce clarity.
With only 4 tools, the server is tightly scoped for its purpose. Each tool earns its place, covering analysis, explanation, rule enumeration, and status checking.
The tool surface covers the complete workflow: analyze a project, explain any findings, list available security rules, and verify server status. There are no obvious gaps for the stated purpose.