Skip to main content
Glama

quantakrypto pqc-tools

remediate_findings

Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
findingsYesFindings from a scan's JSON output.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the burden. It explicitly discloses that the tool calls no model, needs no key, is deterministic, and never auto-merges. The constraints around secrets and the verify-with-verify_fix step clarify side effects and validation behavior, though the phrasing blurs tool behavior and agent instructions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence provides distinct information: the output bundle, the no-model/no-key property, the usage workflow with verification, safety constraints, and input source. It is three sentences, front-loaded with purpose, and contains no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool, the description covers purpose, input source, usage steps, and output bundle composition sufficiently. While there is no output schema, the description enumerates the bundle's contents; some ambiguity exists about how the host agent consumes the bundle, but it is adequate for selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with detailed descriptions for `findings` and its items. The description adds value by instructing to pass findings from `scan_path --format json`, giving provenance beyond the schema's own text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Produce a deterministic remediation REQUEST bundle' – a specific verb and resource, listing components (rubric, fix schema, metadata, fingerprints). It distinguishes itself from sibling tools by referencing verify_fix as a downstream verification step, and the 'never auto-merge' constraint separates it from apply_verified_patch.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: findings come from scan_path --format json, and each finding should be verified with verify_fix before keeping the fix. It also gives exclusions ('Never touch files with secrets; never auto-merge'). It does not explicitly name alternatives, but the workflow is well-defined enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation4/5

Most tools target distinct parts of the PQC remediation workflow (explain, triage, fix, verify), but verify_fix and apply_verified_patch have overlapping purposes: both check code for remaining classical crypto. The latter adds patch-policy and blast-radius gates, making the boundary somewhat blurry.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (e.g., list_rules, triage_findings, verify_fix). There are no mixed conventions or unpredictable naming variations.

Tool Count5/5

11 tools is well within the ideal range for a specialized toolkit. Each tool addresses a distinct step in the migration process: understanding, triaging, remediating, verifying, and scoring.

Completeness4/5

The set covers the core lifecycle: rule discovery, finding explanation, triage, remediation bundling, patch verification, and progress measurement. The only notable gap is that it relies on an external scan_path to provide findings—no scan tool is included—but this appears to be an intentional separation of concerns.