apex_run_agent_secret_scannerRun the allowlisted permissionless bounded secret scanner over supplied text/file content. DATA ONLY, read-only, no HMAC required; returns redacted findings, hashes, and line numbers only, never raw secret values.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| files | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, but the description adds significant behavioral transparency beyond that: it promises redacted findings, hashes, and line numbers only, never raw secret values. This directly addresses a critical concern—secret leakage—and explicitly states the tool will not expose sensitive data. It also clarifies 'no HMAC required', which is a meaningful operational trait. There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that front-load the action ('Run...') and immediately state key attributes (permissionless, bounded, DATA ONLY, read-only). Every clause adds value: safety, scope, and output format. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description tells the agent exactly what to expect: redacted findings, hashes, line numbers, and never raw secret values. Input parameters are simple and optional, and the description covers the main input mode (text/file content). For a tool with this complexity, the description is sufficiently complete to invoke correctly and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has two parameters (text, files) with zero textual description. The description mentions 'text/file content', which aligns with the parameter names and gives a basic hint of what they accept. However, it does not explain the structure of the 'files' array (name, path, text/content) or indicate whether both parameters can be used together or are mutually exclusive. The description adds some semantic value but does not fully compensate for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb 'Run' and clearly identifies the resource: 'secret scanner'. It explicitly states the scope 'over supplied text/file content', which differentiates it from sibling run agents (e.g., data profiling, API contract diff). The purpose is unambiguous and immediately distinguishes this tool from all others.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: it is 'allowlisted permissionless bounded', 'DATA ONLY, read-only, no HMAC required'. This tells the agent that this tool requires no special permissions or HMAC authentication, making it safe for low-risk scanning tasks. It does not explicitly name alternatives or when not to use it, but the strong context about permissions and data constraints gives practical guidance for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools have clearly distinct purposes, and descriptions provide sufficient boundaries. Some run_* analytics tools (e.g., deflated_sharpe vs empyrical_metrics) could be conceptually confused, but their specific inputs and outputs minimize ambiguity.
All tools share the apex_ prefix, and the verb_noun pattern is consistent (get, query, run, submit). The 'agent_' subgroup within run tools introduces a minor irregularity, but it remains readily comprehensible.
With 24 tools, the server is on the heavy side, falling into the 16-25 range. Many run_* tools are similar in nature (pure calculations), but each appears to serve a specific purpose, so the count is borderline rather than excessive.
The server name implies a card store, yet the tool surface only supports reading and querying cards, with no create, update, or delete operations. This is a significant gap that prevents full lifecycle management, though the analytics side is fairly comprehensive.