HallucC — Hallucination & Safety Guardian

Audit CUA Code

check_cua_code_audit

Read-onlyIdempotent

CUA 代码审计：静态分析 Agent 源码，检测危险导入（subprocess/os.system 等）、权限边界（eval/exec）、注入面（字符串拼接 shell）、危险默认值、沙箱缺失。纯规则扫描，不调 LLM、不耗额度。支持单文件或多文件扫描。

Input Schema

Name	Required	Description
`code`	No	单文件模式：要扫描的源代码文本（≤50000 字符），与 files 二选一
`files`	No	多文件模式：[{path, content, language?}] 数组，与 code 二选一
`filename`	No	单文件模式：文件名，用于报告中标识（默认 input.py）
`language`	No	语言提示，auto 时按 filename 扩展名推断（默认 auto）

Output Schema

Name	Required	Description	Default
`summary`	No
`findings`	No
`disclaimer`	No
`privacy_note`	No
`ruleset_version`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 19, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "disclaimer": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "findings": {
+      "anyOf": [
+        {
+          "items": {
+            "additionalProperties": {},
+            "properties": {
+              "category": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "detail": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "file": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "line": {
+                "anyOf": [
+                  {
+                    "maximum": 9007199254740991,
+                    "minimum": -9007199254740991,
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "raw": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "severity": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "high",
+                      "medium",
+                      "low"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "privacy_note": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "ruleset_version": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "summary": {
+      "anyOf": [
+        {
+          "additionalProperties": {},
+          "properties": {
+            "by_category": {
+              "anyOf": [
+                {
+                  "additionalProperties": {},
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "by_severity": {
+              "anyOf": [
+                {
+                  "additionalProperties": {},
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "type": "object"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "capability_level": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "dangerous_import_count": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "injection_surface_count": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "tool_count": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "total": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "type": "object"
+}

First observedOct 8, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly=true, destructive=false, idempotent=true, so the safety profile is covered. The description adds genuinely useful context beyond them: the scan is pure rule-based with no LLM calls and no quota consumption, which matters for cost-sensitive agent planning. It stops short of describing output/pagination, but with annotations covering safety a 4 is warranted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then a detection list, then behavioral/cost notes, then file-mode support. Every clause earns its place except the 'CUA 代码审计' prefix, which merely restates the name/title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only static-analysis tool with an output schema and full annotation coverage, the description supplies purpose, detection scope, cost model, and supported input modes. Nothing critical is missing, though sibling disambiguation would complete the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description's mention of single-file vs multi-file modes loosely maps to the code/files mutual exclusivity but adds no syntax or constraint detail. Baseline 3 is correct when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('静态分析 Agent 源码') and enumerates exactly what it detects (dangerous imports, eval/exec, injection surfaces, dangerous defaults, missing sandbox). This is far more specific than a tautology. However, it never differentiates itself from siblings like check_safety or verify_agent, so an agent cannot tell them apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'支持单文件或多文件扫描' and '纯规则扫描，不调 LLM、不耗额度' imply the contexts where this is the cheap, deterministic choice. But there is no explicit when-to-use-vs-alternatives or when-not guidance relative to check_safety/verify_agent. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All HallucC — Hallucination & Safety Guardian tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.