Skip to main content
Glama

HefestoAI

by io.github.artvepa80
OverviewDiscussionsAdmin

Server Details

HefestoAI checks AI-generated code before you ship it.

Ownership verified
Status
Healthy
Uptime
100.0% over 75 days
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
artvepa80/Agents-Hefesto
GitHub Stars
7
Server Listing
HefestoAI

TDQS

A4.4/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clearly distinct role: analyze inspects code, compare returns a competitor comparison, install returns setup commands, and pricing returns cost info. An agent can trivially decide which to call based on intent, with no overlapping behavior.

Naming Consistency4/5

Three of four tools use bare imperative verbs (analyze, compare, install) with a consistent style, but 'pricing' is a noun noun-phrase that breaks the verb pattern. The convention is still readable and minor divergence only.

Tool Count4/5

Four tools is lean but each covers a distinct user intent (analysis, comparison, installation, cost) and the server's scope is narrow. It sits at the low end of the comfortable 3-15 range but does not feel artificially padded or dangerously thin.

Completeness3/5

The analysis surface covers single and multi-file scanning plus severity/format options, but there is no way to list supported rules, retrieve past results, or get fix/remediation guidance, and whole-repo scanning is explicitly delegated to local execution. Comparison, install, and pricing are static info tools that round out the lifecycle but do not compensate for the limited analysis workflow.

Available Tools

4 tools
analyzeAnalyze codeA
Read-onlyIdempotent
Inspect

Runs the open-source hefesto-ai engine (hefesto analyze --no-config, free tier) on the files you send to the hosted analyzer and returns its findings: rule id, severity, file, line, message and the SARIF hefestoFingerprint/v1 fingerprint (format "sarif" adds the full SARIF 2.1.0 log). Use it to check a file or snippet the user shares (for example "analyze this file") for security and quality issues before committing. Try it: {"code":"password = "Sup3rS3cret!2026""} returns a HARDCODED_SECRET finding. Minimum call: {"code": ""}. Add path (e.g. "app/run.py") so the language comes from the extension; without path or language the language is inferred from the content, else python. For several files send files=[{"path", "content"}] instead. severity and format are optional. Covers Python, COBOL, the DevOps/IaC formats hefesto analyze routes, and TypeScript, JavaScript, Java, Go, Rust and C# through the multilang tree-sitter grammars (the first such request on a fresh server instance downloads the grammars and can take a few seconds longer). Limits: 20 files, 100 KB per file, 256 KB in total, 20 seconds, 10 requests per minute per IP, shared across server instances. No .hefesto.yaml is read. Files are deleted after the run; nothing is stored. For a whole repository, run hefesto analyze . locally.

NameRequiredDescriptionDefault
codeNoContents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs.
pathNoOptional file name for code, e.g. "app/run.py" or "Dockerfile". The extension picks the language. Same rules as files[].path. Ignored when files is set.
filesNoSeveral files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, "_", "." or "-" and must not start with "-"; no "..", no absolute paths, no ".git" or ".hefesto.yaml". content: UTF-8 text, no NUL bytes, at most 100 KB.
formatNoOptional. json (default): findings only; sarif: also the full SARIF 2.1.0 log.
languageNoOptional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead.
severityNoOptional minimum severity to report (default LOW).

Output Schema

NameRequiredDescription
okYestrue when the engine returned analyzed: true.
errorNoFailure code when ok is false. invalid_json when the analyzer body was not JSON.
messageNoSame string as content[0].text when ok is false.
analysisNoAnalyzer JSON. The content text is a one-line summary plus this object.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, non-destructive, idempotent behavior, and the description adds substantial context: hosted analyzer, free tier, no .hefesto.yaml read, files deleted after the run, no storage, rate limits, and first-request grammar download latency. This is rich behavioral disclosure beyond structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but warranted for a tool with many constraints, and it front-loads purpose and key usage. Some details duplicate schema descriptions, but the sentences generally earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for a complex hosted analysis tool: it covers limits, supported languages, output modes, privacy behavior, and the local alternative. With an output schema and annotations also present, nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all parameters. The description still adds practical semantics: path extension drives language, language is inferred from content with python fallback, files replaces code, and severity/format are optional.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (runs the hefesto-ai engine on submitted code) and concrete outputs (rule id, severity, file, line, message, SARIF fingerprint), with an example invocation. It is unmistakably a code-analysis tool rather than compare, install, or pricing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use it for a file or snippet a user shares before committing, gives the minimum call and example, and directs whole-repository analysis to the local CLI. It also distinguishes code vs files and notes which parameters are optional.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compareCompare toolsA
Read-onlyIdempotent
Inspect

Return a short static comparison of HefestoAI with one named tool. Use it when the user asks how HefestoAI differs from another scanner. No live lookup and no code is inspected. All arguments are optional: {} compares with sonarqube. Known values: sonarqube (the default when tool is omitted), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, qodo. Any other value is answered as sonarqube.

NameRequiredDescriptionDefault
toolNoOptional. Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo.

Output Schema

NameRequiredDescription
textYesComparison paragraph. Same string as content[0].text.
toolYessonarqube, snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond the annotations: the comparison is static, no live lookup occurs, no code is inspected, and invalid tool values fall back to sonarqube. Those are non-obvious behavioral facts an agent needs in order to trust and describe the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then usage, then defaults and accepted values — logical order with no filler. The known-values enumeration is repeated verbatim in the schema, which is mild redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single optional-enum tool with an output schema, the description covers scope, default behavior, fallback handling, and what is not done. Nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description goes further by spelling out that all arguments are optional, that {} defaults to sonarqube, and that unknown values are treated as sonarqube — semantics the schema does not encode. It does partly duplicate the enum list already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return a short static comparison of HefestoAI with one named tool') and immediately scopes it as static, so an agent can distinguish it from the analyze/install/pricing siblings without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use it when the user asks how HefestoAI differs from another scanner') and clarifies it is not a live lookup, which rules out a plausible misfire. It stops short of naming an alternative tool to use instead, so it is clear but not a full when/when-not/alternative statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

installInstallA
Read-onlyIdempotent
Inspect

Return install commands for the open-source package (pip install hefesto-ai, Python 3.10+). Use it when the user wants to run HefestoAI locally, in a pre-commit hook or on a whole repository. Does not install anything on the caller's machine. No parameters: call it with {}.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
stepsYesQuickstart steps, in order.
commandYespip install command.
requiresYesPython version required.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely non-redundant context the annotations cannot express: it only returns commands and 'Does not install anything on the caller's machine' — a critical clarification that prevents an agent from reporting a completed install. It omits any mention of what the returned command set contains, but the output schema covers return structure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose and the actual command, then usage, then the key non-effect caveat. Nothing is padded or repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with a declared output schema, the description covers everything an agent needs: what it returns, when to reach for it, that it performs no installation, and how to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the baseline is 4, and the description reinforces the empty-object contract explicitly with 'No parameters: call it with {}', which removes any chance of an agent inventing arguments despite additionalProperties=false.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — 'Return install commands for the open-source package' — and even names the concrete command (pip install hefesto-ai) and required runtime (Python 3.10+). This is unmistakably different from the sibling tools analyze, compare and pricing, which an agent can tell apart without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete invocation contexts: run HefestoAI locally, in a pre-commit hook, or on a whole repository. It does not name a sibling as an alternative or state when NOT to use it, but the usage envelope is clear enough that mis-selection against analyze/compare/pricing is unlikely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pricingPricingA
Read-onlyIdempotent
Inspect

Return current HefestoAI prices (Free $0, PRO $8/month per user, OMEGA $19/month). Use it when the user asks what HefestoAI costs. Static text. Does not look up or change a subscription. No parameters: call it with {}.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
proYesPRO $8/month per user.
freeYesFree tier, $0/month.
omegaYesOMEGA $19/month.
checkoutYesCheckout URL.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely new behavioral context: the payload is 'static text', it performs no lookup and no mutation, and it is parameterless so invocation is guaranteed side-effect free. It does not discuss rate limits or caching, but for a constant-return tool that is minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with what is returned and the actual price data, followed by the usage trigger, the exclusion, and the calling convention. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value shape need not be described, and annotations carry the safety profile. The description supplies the remaining essentials: trigger condition, negative scope, and empty-argument invocation, leaving nothing an agent needs in order to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, which sets the baseline at 4. The description reinforces this with 'No parameters: call it with {}', removing any ambiguity about whether an argument is required, though it adds nothing beyond that confirmation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return current HefestoAI prices') and immediately names the concrete contents (Free $0, PRO $8, OMEGA $19). It also carves out what it is not ('Does not look up or change a subscription'), so an agent can separate it from siblings like analyze or compare without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use it when the user asks what HefestoAI costs') and an explicit exclusion ('Does not look up or change a subscription'), which routes subscription-lookup intents elsewhere. Nothing is left to inference about when to call this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedanalyze1 field changed
      • changedInput schema / examples
        Previous value: -[
-  {
-    "code": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n"
-  },
-  {
-    "code": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n",
-    "path": "app/run.py",
-    "severity": "MEDIUM"
-  },
-  {
-    "files": [
-      {
-        "content": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n",
-        "path": "src/run.py"
-      }
-    ]
-  }
-]New value: +[
+  {
+    "code": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n"
+  },
+  {
+    "code": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n",
+    "path": "app/users.py",
+    "severity": "MEDIUM"
+  },
+  {
+    "files": [
+      {
+        "content": "import sqlite3\n\npassword = \"Sup3rS3cret!2026\"\n\n\ndef find_user(db, name):\n    return db.execute(\"SELECT * FROM users WHERE name = '\" + name + \"'\")\n",
+        "path": "src/users.py"
+      }
+    ]
+  }
+]
  2. 3 tool updates
    • Changedanalyze9 fields changed
      • changedInput schema / description
        Previous value: -"Provide files, or code (language optional, default python). severity and format are optional."New value: +"Send code (one file; path and language optional) or files (several). Everything else is optional."
      • addedInput schema / examples
        Added value: +[
+  {
+    "code": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n"
+  },
+  {
+    "code": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n",
+    "path": "app/run.py",
+    "severity": "MEDIUM"
+  },
+  {
+    "files": [
+      {
+        "content": "import subprocess\n\ndef run(cmd):\n    return subprocess.call(cmd, shell=True)\n",
+        "path": "src/run.py"
+      }
+    ]
+  }
+]
      • changedInput schema / properties / code / description
        Previous value: -"A single snippet, used only when files is omitted (written as e.g. snippet.py for language python). At most 100 KB."New value: +"Contents of one file or snippet, used when files is omitted. At most 100 KB. This is the only argument a first call needs."
      • changedInput schema / properties / files / description
        Previous value: -"Files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, \"_\", \".\" or \"-\" and must not start with \"-\"; no \"..\", no absolute paths, no \".git\" or \".hefesto.yaml\". content: UTF-8 text, no NUL bytes, at most 100 KB."New value: +"Several files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, \"_\", \".\" or \"-\" and must not start with \"-\"; no \"..\", no absolute paths, no \".git\" or \".hefesto.yaml\". content: UTF-8 text, no NUL bytes, at most 100 KB."
      • changedInput schema / properties / files / items / properties / path / description
        Previous value: -"Relative POSIX path."New value: +"Relative POSIX path. The extension picks the language."
      • changedInput schema / properties / format / description
        Previous value: -"json (default): findings only; sarif: also the full SARIF 2.1.0 log."New value: +"Optional. json (default): findings only; sarif: also the full SARIF 2.1.0 log."
      • changedInput schema / properties / language / description
        Previous value: -"Language of code when files is omitted. Default python. Ignored when files is set. An unknown language is rejected; send files instead."New value: +"Optional language of code. Ignored when files or path is set. When omitted it is inferred from the content (python if unsure). An unknown language is rejected; send path or files instead."
      • addedInput schema / properties / path
        Added value: +{
+  "description": "Optional file name for code, e.g. \"app/run.py\" or \"Dockerfile\". The extension picks the language. Same rules as files[].path. Ignored when files is set.",
+  "type": "string"
+}
      • changedInput schema / properties / severity / description
        Previous value: -"Minimum severity to report (default LOW)."New value: +"Optional minimum severity to report (default LOW)."
    • Changedcompare2 fields changed
      • addedInput schema / examples
        Added value: +[
+  {},
+  {
+    "tool": "semgrep"
+  }
+]
      • changedInput schema / properties / tool / description
        Previous value: -"Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."New value: +"Optional. Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
    • Changedpricing2 fields changed
      • changedOutput schema / properties / omega / description
        Previous value: -"OMEGA: $19/month."New value: +"OMEGA $19/month."
      • changedOutput schema / properties / pro / description
        Previous value: -"PRO: $8/month."New value: +"PRO $8/month per user."
  3. 1 tool update
    • Changedcompare2 fields changed
      • changedInput schema / properties / tool / description
        Previous value: -"Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, or claude-code-security."New value: +"Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
      • changedOutput schema / properties / tool / description
        Previous value: -"sonarqube, snyk, github-advanced-security, semgrep, or claude-code-security."New value: +"sonarqube, snyk, github-advanced-security, semgrep, claude-code-security, coderabbit, or qodo."
  4. 1 tool update
    • Changedanalyze1 field changed
      • changedOutput schema / description
        Previous value: -"ok true carries the hosted analyzer body in analysis. ok false carries error and message. On success the content text is the summary, the analyzer JSON, and one PRO price line. On failure the content text is the error sentence only."New value: +"ok true carries the hosted analyzer body in analysis. ok false carries error and message. On success the content text is the summary and the analyzer JSON. On failure the content text is the error sentence only."
  5. 2 tool updates
    • Changedanalyze1 field changed
      • changedOutput schema / description
        Previous value: -"ok true carries the hosted analyzer body in analysis. ok false carries error and message. The content text is unchanged either way."New value: +"ok true carries the hosted analyzer body in analysis. ok false carries error and message. On success the content text is the summary, the analyzer JSON, and one PRO price line. On failure the content text is the error sentence only."
    • Changedpricing5 fields changed
      • removedOutput schema / properties / founding_member
        Removed value: -{
-  "description": "Founding-member price note.",
-  "type": "string"
-}
      • changedOutput schema / properties / omega / description
        Previous value: -"OMEGA tier, $19/month."New value: +"OMEGA: $19/month."
      • changedOutput schema / properties / pro / description
        Previous value: -"PRO tier, $8/month."New value: +"PRO: $8/month."
      • removedOutput schema / properties / trial
        Removed value: -{
-  "description": "Trial terms.",
-  "type": "string"
-}
      • changedOutput schema / required
        Previous value: -[
-  "free",
-  "pro",
-  "omega",
-  "trial",
-  "founding_member",
-  "checkout"
-]New value: +[
+  "free",
+  "pro",
+  "omega",
+  "checkout"
+]
  6. 4 tool updates
    • Changedanalyze1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
+  "additionalProperties": false,
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": true
+          }
+        },
+        "required": [
+          "ok"
+        ],
+        "type": "object"
+      },
+      "then": {
+        "required": [
+          "ok",
+          "analysis"
+        ]
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": false
+          }
+        },
+        "required": [
+          "ok"
+        ],
+        "type": "object"
+      },
+      "then": {
+        "required": [
+          "ok",
+          "error",
+          "message"
+        ]
+      }
+    }
+  ],
+  "description": "ok true carries the hosted analyzer body in analysis. ok false carries error and message. The content text is unchanged either way.",
+  "properties": {
+    "analysis": {
+      "additionalProperties": true,
+      "description": "Analyzer JSON. The content text is a one-line summary plus this object.",
+      "properties": {
+        "analyzed": {
+          "description": "true on this branch.",
+          "type": "boolean"
+        },
+        "engine": {
+          "additionalProperties": true,
+          "type": "object"
+        },
+        "findings": {
+          "items": {
+            "additionalProperties": true,
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "stored": {
+          "description": "false. Nothing is stored.",
+          "type": "boolean"
+        },
+        "summary": {
+          "additionalProperties": true,
+          "properties": {
+            "critical": {
+              "type": "number"
+            },
+            "files_analyzed": {
+              "type": "number"
+            },
+            "files_received": {
+              "type": "number"
+            },
+            "high": {
+              "type": "number"
+            },
+            "low": {
+              "type": "number"
+            },
+            "medium": {
+              "type": "number"
+            },
+            "total_issues": {
+              "type": "number"
+            }
+          },
+          "type": "object"
+        }
+      },
+      "required": [
+        "analyzed",
+        "summary",
+        "findings",
+        "stored"
+      ],
+      "type": "object"
+    },
+    "error": {
+      "description": "Failure code when ok is false. invalid_json when the analyzer body was not JSON.",
+      "type": "string"
+    },
+    "message": {
+      "description": "Same string as content[0].text when ok is false.",
+      "type": "string"
+    },
+    "ok": {
+      "description": "true when the engine returned analyzed: true.",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "ok"
+  ],
+  "type": "object"
+}
    • Changedcompare1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
+  "additionalProperties": false,
+  "description": "Static comparison. tool is the known value actually answered (unknown names are sonarqube). text is the content text.",
+  "properties": {
+    "text": {
+      "description": "Comparison paragraph. Same string as content[0].text.",
+      "type": "string"
+    },
+    "tool": {
+      "description": "sonarqube, snyk, github-advanced-security, semgrep, or claude-code-security.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "tool",
+    "text"
+  ],
+  "type": "object"
+}
    • Changedinstall1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
+  "additionalProperties": false,
+  "description": "Install commands for the open-source package. Does not install anything. The content text is the same prose as before.",
+  "properties": {
+    "command": {
+      "description": "pip install command.",
+      "type": "string"
+    },
+    "requires": {
+      "description": "Python version required.",
+      "type": "string"
+    },
+    "steps": {
+      "description": "Quickstart steps, in order.",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "command",
+    "requires",
+    "steps"
+  ],
+  "type": "object"
+}
    • Changedpricing1 field changed
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
+  "additionalProperties": false,
+  "description": "Current HefestoAI prices. Static. The content text is this object as JSON.",
+  "properties": {
+    "checkout": {
+      "description": "Checkout URL.",
+      "type": "string"
+    },
+    "founding_member": {
+      "description": "Founding-member price note.",
+      "type": "string"
+    },
+    "free": {
+      "description": "Free tier, $0/month.",
+      "type": "string"
+    },
+    "omega": {
+      "description": "OMEGA tier, $19/month.",
+      "type": "string"
+    },
+    "pro": {
+      "description": "PRO tier, $8/month.",
+      "type": "string"
+    },
+    "trial": {
+      "description": "Trial terms.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "free",
+    "pro",
+    "omega",
+    "trial",
+    "founding_member",
+    "checkout"
+  ],
+  "type": "object"
+}
  7. 4 tool updates
    • Changedanalyze10 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • addedInput schema / description
        Added value: +"Provide files, or code (language optional, default python). severity and format are optional."
      • changedInput schema / properties / code / description
        Previous value: -"A single snippet, used when files is not given (written as e.g. snippet.py for language python)."New value: +"A single snippet, used only when files is omitted (written as e.g. snippet.py for language python). At most 100 KB."
      • changedInput schema / properties / files / description
        Previous value: -"Files to analyze. path: relative POSIX path (letters, digits, '_', '.', '-'; no '..', no absolute paths); content: UTF-8 text."New value: +"Files to analyze. Used instead of code when present. path: relative POSIX, at most 200 characters and 8 levels; each segment is letters, digits, \"_\", \".\" or \"-\" and must not start with \"-\"; no \"..\", no absolute paths, no \".git\" or \".hefesto.yaml\". content: UTF-8 text, no NUL bytes, at most 100 KB."
      • addedInput schema / properties / files / items / additionalProperties
        Added value: +false
      • addedInput schema / properties / files / items / properties / content / description
        Added value: +"UTF-8 source text. At most 100 KB. No NUL bytes."
      • addedInput schema / properties / files / items / properties / path / description
        Added value: +"Relative POSIX path."
      • changedInput schema / properties / language / description
        Previous value: -"Language of code: python (default), cobol, yaml, dockerfile, terraform, shell, sql, javascript, typescript, java, go, rust, csharp."New value: +"Language of code when files is omitted. Default python. Ignored when files is set. An unknown language is rejected; send files instead."
      • addedInput schema / properties / language / enum
        Added value: +[
+  "python",
+  "py",
+  "cobol",
+  "yaml",
+  "yml",
+  "dockerfile",
+  "docker",
+  "terraform",
+  "hcl",
+  "shell",
+  "bash",
+  "sh",
+  "sql",
+  "javascript",
+  "js",
+  "typescript",
+  "ts",
+  "java",
+  "go",
+  "rust",
+  "csharp",
+  "c#"
+]
      • removedInput schema / required
        Removed value: -[]
    • Changedcompare2 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • changedInput schema / properties / tool / description
        Previous value: -"Tool to compare with (sonarqube, snyk, github-advanced-security, semgrep, claude-code-security)"New value: +"Tool to compare with: sonarqube (default), snyk, github-advanced-security, semgrep, or claude-code-security."
    • Changedinstall3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • removedInput schema / properties
        Removed value: -{}
      • removedInput schema / required
        Removed value: -[]
    • Changedpricing3 fields changed
      • addedInput schema / additionalProperties
        Added value: +false
      • removedInput schema / properties
        Removed value: -{}
      • removedInput schema / required
        Removed value: -[]
  8. 1 tool update
    • Changedanalyze5 fields changed
      • changedInput schema / properties / code / description
        Previous value: -"Ignored. Accepted for backward compatibility; run hefesto analyze locally to analyze code."New value: +"A single snippet, used when files is not given (written as e.g. snippet.py for language python)."
      • addedInput schema / properties / files
        Added value: +{
+  "description": "Files to analyze. path: relative POSIX path (letters, digits, '_', '.', '-'; no '..', no absolute paths); content: UTF-8 text.",
+  "items": {
+    "properties": {
+      "content": {
+        "type": "string"
+      },
+      "path": {
+        "maxLength": 200,
+        "type": "string"
+      }
+    },
+    "required": [
+      "path",
+      "content"
+    ],
+    "type": "object"
+  },
+  "maxItems": 20,
+  "type": "array"
+}
      • addedInput schema / properties / format
        Added value: +{
+  "description": "json (default): findings only; sarif: also the full SARIF 2.1.0 log.",
+  "enum": [
+    "json",
+    "sarif"
+  ],
+  "type": "string"
+}
      • changedInput schema / properties / language / description
        Previous value: -"Ignored. Accepted for backward compatibility."New value: +"Language of code: python (default), cobol, yaml, dockerfile, terraform, shell, sql, javascript, typescript, java, go, rust, csharp."
      • addedInput schema / properties / severity
        Added value: +{
+  "description": "Minimum severity to report (default LOW).",
+  "enum": [
+    "LOW",
+    "MEDIUM",
+    "HIGH",
+    "CRITICAL"
+  ],
+  "type": "string"
+}
  9. 1 tool update
    • Changedanalyze3 fields changed
      • changedInput schema / properties / code / description
        Previous value: -"Code snippet to analyze"New value: +"Ignored. Accepted for backward compatibility; run hefesto analyze locally to analyze code."
      • changedInput schema / properties / language / description
        Previous value: -"Programming language (python, javascript, etc)"New value: +"Ignored. Accepted for backward compatibility."
      • changedInput schema / required
        Previous value: -[
-  "code"
-]New value: +[]

Related MCP Connectors

Related MCP Servers

Try in Browser
Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources