Skip to main content
Glama

SiteGuardian

by io.github.gweber

scan_domain

Read-onlyIdempotent

Runs a free one-off security scan of the given domain and returns its grade (A–F), scan timestamp, and up to three top-priority issues with a permalink to the full report on siteguardian.io.

Use this when the user asks for a quick security check of a domain that is NOT yet under SiteGuardian monitoring, or when they want a fresh assessment before subscribing. Results are cached for two hours, so repeated calls about the same domain return the same snapshot and mark it with cached=True.

Do NOT use this for domains already under monitoring by the user — call get_domain_status instead for the account-scoped view with framework tags. Do NOT use this to batch-scan many domains as a competitive-intelligence tool; per-source-IP and per-target rate limits bound usage. This tool does not require authentication.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
gradeYes
scoreYes
cachedYesTrue when the result was served from the 2-hour ScanLog cache.
domainYes
report_urlYesPermalink to the full scan report on siteguardian.io.
scanned_atYes
top_issuesYesUp to 3 top-priority issues found. Sorted high → medium → low.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, open-world, idempotent, and non-destructive hints. The description adds meaningful behavior beyond these: two-hour caching with cached=True flag, per-source-IP and per-target rate limits, and no authentication required. These are non-obvious traits that help the agent anticipate results and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: action/results, when-to-use, caching behavior, explicit exclusions with alternatives. The most critical information is front-loaded, and no fluff or repetition exists. Despite being longer than two sentences, it is appropriately sized for the behavioral nuances it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simple signature (one parameter), the description is complete: purpose, outputs, use cases, exclusions, alternative, caching, rate limits, auth requirement, and the output schema exists for return details. Sibling tool names in context also help disambiguation. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has only one string parameter 'domain' with 0% description coverage. The description adds context by referring to 'the given domain' and clarifying it should be a non-monitored domain in the usage section. It doesn't specify format constraints (e.g., with/without scheme), but for a single obvious parameter, this is adequate and above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Runs a free one-off security scan of the given domain' and lists exact outputs (grade, timestamp, top issues, permalink). It also differentiates from siblings by explicitly noting when to use this versus get_domain_status, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ('NOT yet under SiteGuardian monitoring', 'fresh assessment before subscribing') and when-not-to-use ('already under monitoring', 'batch-scan as competitive-intelligence tool'), naming the alternative tool get_domain_status. This is textbook-grade usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteGuardian toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.9/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: listing monitored domains, checking current status, reviewing drift history, getting fix recommendations, and scanning unmonitored domains. The descriptions explicitly cross-reference and warn against misuse, making selection unambiguous.

Naming Consistency5/5

All tool names follow a predictable verb_noun pattern: get_domain_status, get_drift_events, get_fix_recommendations, list_monitored_domains, and scan_domain. The use of 'list_' for the collection and 'scan_' for the action is consistent and intuitive.

Tool Count5/5

The five tools are well-scoped for a security monitoring API, covering inventory, current state, change history, remediation, and one-off scanning. Each tool earns its place without unnecessary bloat.

Completeness4/5

The tool set covers the primary read-side and scanning workflows, but lacks an explicit tool to add a domain to continuous monitoring, which is a natural next step from scan_domain. This is a minor lifecycle gap that agents can work around by directing users to the website.

Resources