QualityMax Cloud

Start Dependency & CVE Scan

start_dependency_scan

Queue an OSV dependency/CVE scan of a UTF-8 lockfile for Free Beta Plus or Studio and above. Pass file contents, not a local path or URL. Lockfiles run in isolated E2B sandboxes. Package names and versions are sent to public OSV; do not include secrets. Returns a scan id; poll get_dependency_scan. One active scan and ten MCP submissions per hour per user. Checks known dependency advisories, not application code or exploitability.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "filename": "<filename>",
      "content": "<content>"
    },
    "name": "start_dependency_scan"
  }
}

Input Schema

Name	Required	Description
`content`	Yes	UTF-8 lockfile text, up to 2 MiB.
`context`	No	Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."
`filename`	Yes	Original lockfile basename.

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 2, 2026

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, openWorldHint=true and destructiveHint=false, but the description adds substantial context beyond them: execution in isolated E2B sandboxes, external data egress of package names and versions to public OSV, a secrets warning, and rate limits. It does not describe what happens to a queued scan that fails or how long results are retained, so it falls just short of the top mark.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Six tight sentences, front-loaded with the action and input format, then egress and rate-limit constraints. No filler and no repetition of the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by stating the return value (a scan id) and the polling path. Tier eligibility, egress, sandboxing, limits and scope boundaries are all covered, leaving nothing an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the enum of lockfile basenames and the 2 MiB content limit are already documented. The description still adds real meaning by clarifying that content must be the file text rather than a path or URL, which is the most common misuse of a parameter like this.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: queue an OSV dependency/CVE scan of a UTF-8 lockfile. It also scopes the input (file contents, not a path or URL) and explicitly bounds what is checked (known dependency advisories, not application code or exploitability), which separates it cleanly from get_dependency_scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete preconditions (Free Beta Plus or Studio and above), an explicit input rule (pass contents, not a local path or URL), and names the follow-up tool get_dependency_scan for polling. It also sets the operational constraints of one active scan and ten MCP submissions per hour per user.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All QualityMax Cloud tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?