Skip to main content
Glama

Zambo

provibe_audit

Read-onlyIdempotent

AI code audit for any public GitHub repository. Returns Provibe Score (0–100), security vulnerability list, dead code map, and an actionable execution plan. Free teaser gives score + top 3 issues. Full audit: $49 one-time OR included in Zambo Pass ($49/mo — 5 audits/month, $245 value). Pass Zambo Pass email in request for full audit. No auth required for teaser. When to use: call provibe_audit when the user's request matches this capability. When not to use: do not call it for unrelated work, missing required inputs, or when a safer read-only route is more appropriate.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
emailNoZambo Pass email for full audit (optional — without it you get the free teaser: score + top 3 issues). Get pass: https://zambo.dev/#zambo-pass
repo_urlYesPublic GitHub repository URL. Example: https://github.com/owner/my-saas
vibe_contextNoOptional context: language, framework, specific concerns, or what the project does

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
dead_codeNo
provibe_scoreNo
execution_planNo
vulnerabilitiesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, and non-destructive; the description adds the paid vs free mode, the Zambo Pass email requirement for full results, and the 'no auth required for teaser' detail. It also previews the output contents, which is useful context beyond the annotations, and nothing contradicts them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core behavior is front-loaded and the two-mode pricing is scannable. The when-to-use sentence is a tautology and some pricing detail is marketing-flavored, so not every sentence earns its place, though overall length is reasonable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the full output schema, safe annotations, and complete input schema, the description covers the required public-repo input, the optional email mode, and what the tool returns. It is only slightly incomplete because it never names a specific sibling alternative or gives a concrete rule for choosing audit over review.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are already fully described in the input schema, including repo_url's example and email's optional effect, so the high schema-coverage baseline applies. The description reinforces the email/full-audit relationship but doesn't add new meaning for repo_url or vibe_context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: AI code audit of any public GitHub repository. The next sentence enumerates concrete outputs (Provibe Score, vulnerability list, dead code map, execution plan), making the function clear. It doesn't explicitly differentiate from code_review, but its unique score and audit framing make it identifiable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a when-to-use and when-not-to-use block and explains the teaser vs full-audit switch based on whether an email is supplied. However, the guidance is mostly generic or tautological ('when the user's request matches this capability', 'unrelated work') and never names an alternative tool, so it does little to disambiguate from similar siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.