Skip to main content
Glama
Sign In

VulKill Security

by io.github.dytredline
OverviewDiscussionsAdmin

search

Read-only

Bağlı hesabın raporları ve güvenlik yetenek kataloğunda düz metin query ile arama yapar; örnek: SQL veya CWE-89. Dönen kimliği fetch ile açın. Tüm raporların listesi için vulkill_list_reports kullanın. Yeni tarama başlatmaz; kredi harcamaz.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "query": "<query>"
    },
    "name": "search"
  }
}

Input Schema

NameRequiredDescriptionDefault
queryYesall: tüm 260 kontrol; source/semantic/infrastructure/web/auto: mod kapsamı; VK-001, SQL veya CWE-89: kontrol araması.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / query / description
      Previous value: -"Düz metin araması; SQL, CWE-89 veya rapor/hedef adı gibi bir ifade."New value: +"all: tüm 260 kontrol; source/semantic/infrastructure/web/auto: mod kapsamı; VK-001, SQL veya CWE-89: kontrol araması."
  2. Changed1 schema field changed
    • addedInput schema / properties / query / description
      Added value: +"Düz metin araması; SQL, CWE-89 veya rapor/hedef adı gibi bir ifade."
  3. Added

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, destructiveHint false, openWorldHint false), so the bar is lower. The description still adds real value by disclosing the credit-cost and no-scan side-effect profile, plus the hint that results are identifiers that must be resolved via fetch. It stops short of saying anything about result volume, ranking, or empty-result behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the core action, then routing, then the side-effect disclaimer. Slightly deductive because the SQL/CWE-89 example is duplicated from the schema and could have carried new information instead.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter and no output schema, the description supplies exactly what is missing: what gets searched, how to resolve results ('open the returned ID with fetch'), the enumeration alternative, and the cost/side-effect contract. Nothing an agent needs in order to call this correctly is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single query parameter already documents the 'all' keyword, the mode scopes (source/semantic/infrastructure/web/auto), and the VK-001 / SQL / CWE-89 examples. The description only repeats the SQL and CWE-89 examples, adding no matching syntax, casing, or quoting rules beyond the schema. Baseline 3 applies since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and scope: a plain-text query search across the connected account's reports and the security capability catalog, with concrete query examples. It is clearly separable from the nearby 'list all' sibling and the 'open one item' sibling, so an agent can pick it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It routes explicitly: use fetch to open a returned ID, and use vulkill_list_reports when the goal is enumerating every report. It also states the negative case (this does not launch a new scan and does not spend credits), which is exactly the kind of when-not guidance that prevents mis-selection against vulkill_start_scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All VulKill Security toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources