Skip to main content
Glama

Scan a site

scan_site

Queue a launch-readiness scan of a URL and return at once; the crawl runs in the background. The project comes from the URL (same site → that project; none → a new one). Poll get_report after pollAfterMs until status is completed or failed. On Free, the first custom domain answers binding_required with proposedDomain: the workspace then checks that one site for good (subdomains and preview URLs stay open). Ask the user before repeating with confirmDomain: true. Never confirm on their behalf. A redirect to another site answers target_mismatch with redirectedTo. Scan a deploy only once it is live.

Input Schema

NameRequiredDescriptionDefault
urlYesThe deployed address to check, e.g. https://staging.client.com/.
scanModeNoDefault never spends. Full requires subscription or explicit credit consent.
projectIdNoOnly when project_ambiguous lists candidates.
allowCreditNoExplicitly allow reserving one Full Scan Credit; requires idempotencyKey.
environmentNoOverride what the host implies. Production on a preview URL reports preview-only settings as blockers.
confirmDomainNoFree only: true once the user agreed to bind the workspace to proposedDomain.
idempotencyKeyNoCommit SHA or deploy id, so a retry returns the same scan instead of queuing another.
acknowledgeWithdrawalNoNeeded when the credit spent is a purchased one: the account holder asks for the Full Scan now and accepts that the right of withdrawal from that purchase ends once the report is delivered. Ask them first.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond the annotations: background execution with required polling, Free-plan binding_required flow, credit-spending and subscription gating, withdrawal acknowledgment, and target_mismatch on redirects. It also explains that the idempotencyKey is what makes retries safe, which is consistent with (not contradictory to) idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what the tool does and the async contract, then layers operational rules; nearly every sentence carries information an agent needs. A few clauses are dense or loosely worded ('checks that one site for good'), but there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-param, mutation-flagged, no-output-schema tool it covers the polling loop, error outcomes, and consent preconditions well. It stops short of describing the queued response itself (scan identifier, pollAfterMs shape) and does not address the start_scan sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage the baseline is 3, but the description adds real meaning for the trickiest params: when confirmDomain may be set ('ask the user before repeating', 'never confirm on their behalf') and how project resolution proceeds from the URL. scanMode and allowCredit guidance still largely restates the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Queue a launch-readiness scan of a URL') plus the key async trait ('return at once; the crawl runs in the background'). The distinction from the sibling start_scan is left unexplained, so it does not fully separate itself from the other scanning entry point.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives sequencing ('Poll get_report after pollAfterMs until status is completed or failed') and when-not conditions ('Scan a deploy only once it is live'), plus consent rules for confirmDomain. It does not, however, clarify when to pick this over the near-identically named start_scan sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources