Skip to main content
Glama

coderegistry

by io.github.hellosg

get-security-issues

Returns deduplicated security findings for a project (all vaults) or a single vault. Provide exactly one of project_id or vault_id. Requires full data access (a paid plan; verification-only plans are not included). Requires X-API-Key (existing users can generate an API key in the web app). If headers aren't supported, pass api_key in arguments.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
tagNoFilter: triage tag name.
fileNoFilter: substring match on file path.
limitNoMax results to return (default 50, max 200).
offsetNoNumber of results to skip, for pagination.
statusNoFilter: triage status (e.g. open, resolved, ignored).
api_keyNoOptional API key for clients that cannot set X-API-Key headers.
check_idNoFilter: exact match on the security check id.
issue_idNoReturn only this specific issue id.
severityNoFilter to one or more severities (e.g. ERROR, WARNING, INFO).
vault_idNoVault id (from create-code-vault or list_vaults). Returns data for this vault only.
project_idNoProject id (from create_project). Returns data aggregated across all vaults in the project.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses deduplication, scope behavior (all vaults vs one vault), plan requirements, and API-key handling. It stops short of describing potential errors, rate limits, or return structure, but it provides substantial behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose first, then the critical selection rule, then the necessary auth context. Every sentence earns its place and there is no redundant restating of the tool name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only security findings tool with 11 parameters and no annotations or output schema, the description covers the essential selection and auth concerns clearly. It could mention pagination limits or error behavior, but the schema already documents limit/offset and the description covers the core invocation requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by condensing the oneOf constraint into clear guidance and by explaining project_id/vault_id consequences. It also clarifies the api_key param's role as a header fallback, which the schema only hints at.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Returns') and a specific resource ('security findings') with an explicit scope: aggregated across all vaults in a project or limited to a single vault. It also uses 'deduplicated' to add precision and distinguish the result set. This makes the tool's purpose unambiguous even among many sibling get-* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear invocation context: provide exactly one of project_id or vault_id, and explains the difference between the two scopes. It also states authentication requirements and the api_key fallback. It does not explicitly name alternatives or exclusion conditions, but the usage context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All coderegistry toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.7/5.0
Disambiguation3/5

Tools are mostly distinct by resource and action, but the three get-code-vault-* variants (summary, results, reports) plus get_vault create a cluster of similar-sounding retrieval tools. The use of both 'vault' and 'code-vault' in names increases the chance of misselection, though descriptions do clarify the differences.

Naming Consistency2/5

Naming convention is inconsistent: snake_case (create_account, get_vault, list_projects) is mixed with kebab-case (create-code-vault, get-code-vault-summary, reanalyze-code-vault). The same concept is referred to as 'vault' and 'code-vault' across tool names, breaking predictability.

Tool Count4/5

At 16 tools, the server is slightly over the ideal 3-15 range but still reasonable for the domain covering accounts, projects, vaults, and analysis retrieval. The count is justified by the distinct resources and operations, though a few vault-related tools could potentially be consolidated.

Completeness4/5

The server provides solid lifecycle coverage: account create/get/delete, project CRUD (minus update), vault create/read/delete/reanalyze, plus API key rotation. Minor gaps exist, such as no update methods for accounts or projects, but the core workflows are well-supported without dead ends.

Resources