Skip to main content
Glama
Sign In

VulKill Security

by io.github.dytredline
OverviewDiscussionsAdmin

vulkill_get_scan_status

vulkill_start_scan sonucundaki scanId için yetkili motordan durum ve rapor günceller. Yeni tarama başlatmaz. Motor başlamadığını doğrularsa ayrılmış kredi uzlaştırılır; zaman aşımı tek başına iade kanıtı değildir. Bulunmayan kimlik not_found, başka hesaba ait kimlik forbidden döner. running ise sonra yeniden sorgulayın; completed ise findings/coverage/summary inceleyin. Büyük raporda findingsTotal toplamı ve findingsNextCursor sonraki sayfayı gösterir; tüm bulguları görmek için findingsCursor ile sayfaları sırayla isteyin.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "scanId": "<scanId>"
    },
    "name": "vulkill_get_scan_status"
  }
}

Input Schema

NameRequiredDescriptionDefault
scanIdYesBaşlatma yanıtından veya rapor listesinden alınan, bu hesaba ait görev kimliği.
findingsCursorNoBüyük raporda önceki yanıttaki findingsNextCursor; her çağrıda en fazla 100 bulgu getirir.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / properties / findingsCursor
      Added value: +{
+  "description": "Büyük raporda önceki yanıttaki findingsNextCursor; her çağrıda en fazla 100 bulgu getirir.",
+  "minimum": 0,
+  "type": "integer"
+}
  2. Changed1 schema field changed
    • addedInput schema / properties / scanId / description
      Added value: +"Başlatma yanıtından veya rapor listesinden alınan, bu hesaba ait görev kimliği."
  3. Added

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond the annotations: reserved credits are reconciled only when the engine confirms the scan never started, and a timeout alone is not proof of refund. It documents concrete error outcomes (not_found, forbidden for another account's ID) and the running-vs-completed follow-up paths. This is exactly the kind of side-effect and failure-mode context the readOnlyHint=false / destructiveHint=false pair cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded, leading with what the tool does and immediately with what it does not do. Every clause carries information (credit reconciliation, error codes, status branches, pagination), though the run-on sentences make the status-handling rules slightly harder to scan than a short bulleted structure would.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return burden and does so: it names the report sections (findings/coverage/summary), the total counter, and the next-cursor field. For a two-parameter status/pagination tool, nothing an agent needs to call it correctly or interpret the response is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description ties the parameters to a workflow: scanId originates from the start response, and findingsCursor drives sequential paging until all findings are retrieved. This adds procedural meaning even though the per-call limit of 100 is restated from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: refreshes status/report for a scanId produced by vulkill_start_scan, and explicitly negates the sibling action ("Yeni tarama başlatmaz"). An agent can distinguish this from vulkill_start_scan and vulkill_list_reports without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear usage context: call it with the scanId returned by the start tool, re-query while status is running, and read findings/coverage/summary once completed. It also prescribes the pagination loop for large reports. It stops short of naming an alternative tool for cases outside this flow (e.g. listing reports), so it is not a full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All VulKill Security toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources