Hokmah

Find Code Missing a Protection

hokmah_risky_code

Read-onlyIdempotent

Lists current code of an imported repository that lacks a protection the project's own fixes keep adding, learned from the diffs of its past fixes: unguarded access to structures fixes had to guard, including an entry checked to exist but read at [0] without checking it has an element, or passed to a function that dereferences it (R1); results of functions that fixes had to null-check, called the way the fixes checked them and declared nullable, used unchecked (R7); plain objects used as dictionaries keyed by request input and written through the looked-up value, obj[k].x = v (R2, prototype pollution; a one-level write is only a hardening note); template variables inserted unescaped where another file sanitizes them (R3). Optional zone (path prefix or words) and kind (R1, R2, R3, R7). kind="UI" lists the interface instead: translation keys missing from the base locale or called without the values their text needs (U1), screens that await a request on opening without handling its failure (U4), and, not validated on history, accessibility notes (U5). Each site says why it was flagged; measured_on_history gives, per kind, how often such sites turned out to need a fix when the detectors were run on the code of a year earlier. Candidates are not confirmed bugs.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "repo_url": "<repo_url>"
    },
    "name": "hokmah_risky_code"
  }
}

Input Schema

Name	Required	Description	Default
`kind`	No
`zone`	No
`repo_url`	Yes

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 4, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that this is a read-only, idempotent, open-world, non-destructive operation. The description adds meaning that is genuinely new: each flagged site explains why it was flagged, measured_on_history reports the per-kind rate at which such sites proved to need a fix on year-old code, and the results are explicitly unconfirmed candidates rather than bugs. That precision framing is exactly what an agent needs before acting on output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and no sentence is pure filler, but the body is a dense wall of run-on sentences packed with parenthetical rule codes (R1, R7, R2, R3) and embedded clauses such as the 'entry checked to exist but read at [0]' example. It is hard to scan, and the rule-code shorthand would be better as a structured list.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high complexity, the presence of an output schema, and the fact that the description still explains the semantics of measured_on_history and the per-site justification, coverage is strong. Gaps remain around prerequisites (must the repository be imported first?), result volume or limits, and how to act on borderline classes like the 'hardening note', but nothing critical to calling it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description has to justify every parameter. It defines zone as a path prefix or words and defines kind as R1, R2, R3, R7, or the special value 'UI' with its own rule set, which is important because the schema declares no enum. Only repo_url goes unexplained, though its meaning is obvious from the name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it lists current code sites in an imported repository that lack a protection, learned from the diffs of past fixes. It is far more specific than the title alone because it enumerates the risk classes (R1, R2, R3, R7) and the separate UI mode (U1, U4, U5). It does not, however, distinguish itself from siblings such as hokmah_analyze or hokmah_similar_fixes, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the mention of 'an imported repository' hints the repository must already be imported, and the closing note that 'candidates are not confirmed bugs' tells the agent how to interpret results. There is no explicit statement of when to choose this tool over hokmah_analyze or hokmah_similar_fixes, and no exclusions or prerequisites are spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Hokmah tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.