Skip to main content
Glama

VulKill Security

vulkill_complete_scan

Çalışan MCP tarama görevinin sonucunu veya iptal/iade uygunluğunu yetkili motordan kontrol eder. Yeni görev başlatmaz. İade yalnızca yetkili motorun görevin başlamadığını doğruladığı durumda atomik ve tek seferlik yapılır.

Input Schema

NameRequiredDescriptionDefault
scanIdYes
startedNo
sourceFilesNo
cancelRequestedNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed4 schema fields changed
    • addedInput schema / properties / cancelRequested
      Added value: +{
      +  "type": "boolean"
      +}
    • removedInput schema / properties / findings
      Removed value: -{
      -  "type": "array"
      -}
    • addedInput schema / properties / sourceFiles
      Added value: +{
      +  "items": {
      +    "additionalProperties": false,
      +    "properties": {
      +      "content": {
      +        "maxLength": 200000,
      +        "type": "string"
      +      },
      +      "path": {
      +        "maxLength": 260,
      +        "type": "string"
      +      }
      +    },
      +    "required": [
      +      "path",
      +      "content"
      +    ],
      +    "type": "object"
      +  },
      +  "maxItems": 5000,
      +  "type": "array"
      +}
    • removedInput schema / properties / summary
      Removed value: -{
      -  "maxLength": 600,
      -  "type": "string"
      -}
  2. Added

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose meaningful behavior beyond the name: the refund is atomic and single-shot and only happens after the authorized engine verifies the task did not start, which is genuinely useful for a mutation-capable tool. It does not say whether the refund is irreversible, what permissions are required, or what the tool returns on success versus ineligible-cancel.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, no filler, with the core action and the 'does not start a new task' constraint front-loaded. Efficient for the amount of content, though it spends a full sentence on refund atomicity while omitting any parameter explanation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a four-parameter tool with no annotations, no output schema, and 0% schema coverage, and it can trigger a refund. Given that complexity, the description is under-specified: the semantics of three of four parameters and the shape of the response are unaddressed. It covers the refund precondition well but leaves too much for the agent to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it largely does not: 'started', 'cancelRequested', and especially the 'sourceFiles' array (up to 5000 path/content objects) are entirely unexplained. Only 'scanId' is indirectly implied by the reference to checking a task's result. An agent would not know why source files must be supplied to a result/refund check.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action and resource: it queries the authorized engine for the result of an already-running scan task, or for cancel/refund eligibility. It also explicitly negates a scope ('Yeni görev başlatmaz'), which separates it from vulkill_start_scan. However, the tool name 'complete_scan' suggests finalizing a scan, while the description describes a read/verification action, leaving a slight naming mismatch an agent must reconcile.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies when not to use it (not for launching new tasks) and states the precondition for a refund (engine confirms the task never started). But it never names the alternative sibling (e.g. vulkill_start_scan) nor distinguishes itself from vulkill_list_reports for retrieving results, so routing is left partly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.