worklore

check_capability

Read-only

Disclose what an agent Skill or worklore story CAN DO before you run it: a capability tier T0-T4 bound to a content sha256, with findings that carry file:line evidence, PLUS a separate list of behavioral red flags (prompt-injection / deception / exfiltration-intent / safety-bypass phrasings) for a human to review. This is blast-radius disclosure and triage, never a 'safe' verdict. Prefer a url over pasting a file: a skill on GitHub (github.com or raw.githubusercontent.com, up to 200 KB) needs no sign-in, and you do not have to copy the whole file into the call. Other URLs need a signed-in session. If you paste text, also pass expected_sha256 (the file's sha256, e.g. shasum -a 256 SKILL.md): a copy that changed on the way is reported instead of scanned. received says exactly what was scanned.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "check_capability"
  }
}

Input Schema

Name	Required	Description
`url`	No	A URL to fetch and scan. GitHub URLs need no sign-in; a github.com/…/blob/… link works.
`text`	No	The skill/story text to scan.
`expected_sha256`	No	sha256 (hex) of the file you mean, when you paste `text`. A mismatch is an error, not a scan.

Output Schema

Name	Required	Description	Default
`tier`	Yes
`sha256`	Yes
`findings`	No
`received`	No
`endpoints`	No
`behavioral`	No
`disclaimer`	No
`tier_label`	No
`behavioral_note`	No
`scanner_version`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed15 schema fields changedOct 15, 2026

addedOutput schema / properties / behavioral / items / properties / evidence / maxLength
```
Added value: +200
```

changedOutput schema / properties / behavioral / items / properties / line / anyOf

Previous value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "minimum": 0,
+    "type": "integer"
+  },
+  {
+    "type": "null"
+  }
+]

addedOutput schema / properties / behavioral / maxItems
```
Added value: +12
```
addedOutput schema / properties / findings / items / properties / evidence / maxLength
```
Added value: +200
```

changedOutput schema / properties / findings / items / properties / line / anyOf

Previous value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "minimum": 0,
+    "type": "integer"
+  },
+  {
+    "type": "null"
+  }
+]

addedOutput schema / properties / findings / items / properties / severity / enum

Added value: +[
+  "elevated",
+  "info",
+  "local",
+  "network",
+  "opaque"
+]

addedOutput schema / properties / findings / maxItems
```
Added value: +12
```
addedOutput schema / properties / received / properties / bytes / minimum
```
Added value: +0
```
addedOutput schema / properties / received / properties / lines / minimum
```
Added value: +0
```
addedOutput schema / properties / received / properties / matches_expected / const
```
Added value: +true
```
addedOutput schema / properties / received / properties / text_sha256 / pattern
```
Added value: +"^[0-9a-f]{64}$"
```
addedOutput schema / properties / received / properties / via / enum
```
Added value: +[
+  "text",
+  "url"
+]
```
addedOutput schema / properties / sha256 / pattern
```
Added value: +"^[0-9a-f]{64}$"
```

addedOutput schema / properties / tier / enum

Added value: +[
+  "T0",
+  "T1",
+  "T2",
+  "T3",
+  "T4"
+]

addedOutput schema / properties / tier_label / enum

Added value: +[
+  "Inert — no scanned capability strings; instructional text only",
+  "Local — runs bundled code / writes files, no network",
+  "Network — makes outbound calls (endpoints listed)",
+  "Elevated — persistence, secrets, privilege, or destructive actions",
+  "Opaque — fetches/decodes code at runtime; cannot be statically reviewed"
+]

Changed3 schema fields changedOct 15, 2026

addedInput schema / properties / expected_sha256

Added value: +{
+  "description": "sha256 (hex) of the file you mean, when you paste `text`. A mismatch is an error, not a scan.",
+  "type": "string"
+}

changedInput schema / properties / url / description

Previous value: -"A URL to fetch and scan."New value: +"A URL to fetch and scan. GitHub URLs need no sign-in; a github.com/…/blob/… link works."

addedOutput schema / properties / received

Added value: +{
+  "properties": {
+    "bytes": {
+      "type": "integer"
+    },
+    "lines": {
+      "type": "integer"
+    },
+    "matches_expected": {
+      "type": "boolean"
+    },
+    "text_sha256": {
+      "type": "string"
+    },
+    "via": {
+      "type": "string"
+    }
+  },
+  "type": "object"
+}

First observedOct 6, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover readOnly/openWorld/destructive, and the description adds substantial context beyond them: GitHub fetch is capped at 200 KB, non-GitHub URLs require a signed-in session, a sha256 mismatch is reported rather than scanned, and `received` reports exactly what was scanned. For a network-fetching read tool, this is rich operational disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but well-ordered: purpose and scope caveat first, then input guidance, then the sha256 safety note and the `received` return hint. Nearly every sentence carries information, though the description is long and packs multiple concerns into single sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-param, no-required-arg tool with an output schema, it covers what matters: mutual use of url vs text, the integrity guard for pasted text, auth boundaries per URL class, size limits, and the explicit 'not a safe verdict' caveat. An agent can call it correctly without opening the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: it explains when to prefer url vs text, the 200 KB GitHub limit and sign-in requirement, and couples expected_sha256 to text with a concrete `shasum -a 256 SKILL.md` example plus the mismatch-as-error semantic. That is meaningful guidance beyond the schema strings.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('disclose') and resource ('what an agent Skill or worklore story CAN DO') with a concrete output shape: capability tier T0-T4 bound to a content sha256, findings with file:line evidence, plus behavioral red flags. It also draws a clear scope boundary ('blast-radius disclosure and triage, never a safe verdict') that distinguishes it from verdict-style siblings like report_check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit timing ('before you run it') and a strong input-selection preference ('Prefer a url over pasting a file'), including the condition that GitHub URLs need no sign-in while other URLs need a session. It lacks explicit routing against named siblings (get_story, report_check), so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All worklore tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.