Skip to main content
Glama
Sign In

Systemores AI Agent & MCP Security Auditor

by io.github.bobcar0
OverviewDiscussionsAdmin

Audit Multi-Agent Execution Topology

systemores_audit_agent_graph
Read-onlyIdempotent

Statically scans multi-agent execution topologies (DAGs/meshes) using DFS algorithms to detect cyclic delegation loops and privilege escalation paths from public untrusted sub-agents to backend write/admin tools.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "graphTopologyJson": "<graphTopologyJson>"
    },
    "name": "systemores_audit_agent_graph"
  }
}

Input Schema

NameRequiredDescriptionDefault
maxDepthNoMaximum depth to traverse during cycle and privilege path search.
graphTopologyJsonYesJSON-serialized graph topology object containing 'nodes' (id, privilegeLevel) and 'edges' (source, target).
strictPrivilegeCheckNoWhen true, flags any path from 'public'/'user' nodes to 'admin'/'system' nodes as a breach.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so safety is covered. The description usefully adds that analysis is static (no execution of the agents) and names the DFS traversal basis, but says nothing about the form of the findings, severity levels, or any cost/depth limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the verb first and no filler; algorithm choice and detection targets are packed in efficiently. It is dense but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With three well-documented parameters and full annotation coverage, the main remaining gap is the return value: there is no output schema and the description never says whether the result is a list of cycles, a path graph, or a pass/fail verdict. For an audit tool whose entire value is its findings, that omission is material.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so maxDepth, graphTopologyJson and strictPrivilegeCheck are already documented at the field level. The description contributes context for the privilege rule ('public untrusted sub-agents to backend write/admin tools') but adds no syntax or format detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('statically scans multi-agent execution topologies') plus the two concrete findings it produces (cyclic delegation loops and privilege escalation paths). That is enough to distinguish it from siblings like audit_tool_integrity or analyze_trace_telemetry, though it never states the contrast explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use/when-not guidance and no mention of alternatives. The only implicit cue is 'statically,' which hints it works on a supplied topology rather than live traffic, but an agent must infer that it should use a different sibling for live or trace-based auditing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Systemores AI Agent & MCP Security Auditor toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources