HSTS check: a domain's HTTP Strict Transport Security configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain name, e.g. deinkunde.com |
| Name | Required | Description | Default |
|---|---|---|---|
| ok | No | ||
| raw | No | ||
| domain | No | ||
| maxAge | No | ||
| preload | No | ||
| present | No | ||
| warnings | No | ||
| preloadReady | No | ||
| httpsRedirect | No | ||
| includeSubDomains | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Output schema / (root)Previous value: -nullNew value: +{
+ "$schema": "http://json-schema.org/draft-07/schema#",
+ "additionalProperties": {},
+ "properties": {
+ "domain": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "httpsRedirect": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "includeSubDomains": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "maxAge": {
+ "anyOf": [
+ {
+ "type": "number"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "ok": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "preload": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "preloadReady": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "present": {
+ "anyOf": [
+ {
+ "type": "boolean"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "raw": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "warnings": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "type": "object"
+}Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safe read-only nature is known. The description adds little behavioral context beyond what's implied by 'check'—it does not mention network calls, failure conditions, or what happens with domains lacking HSTS. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that restates the tool name ('HSTS check') and adds the resource. It is concise but somewhat under-informative; it earns its place by specifying the resource, but could be more structured without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and an output schema exists. The description sufficiently defines the purpose for a basic check tool, and the annotations cover the read-only safety. It doesn't need to explain return values since output schema presumably handles that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'domain' parameter with an example. The description doesn't add further semantic context, but since the schema fully documents the parameter, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks a domain's HTTP Strict Transport Security configuration, which is specific and distinct from sibling tools like check_ssl or http_headers. The verb 'check' plus the resource 'domain's HSTS configuration' makes the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for checking HSTS configuration, but it does not explicitly state when to use it over alternatives or provide exclusions. It is clear from context that it's for security header checks, but no explicit guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Several tools cluster around overlapping diagnostics, such as asn_lookup vs ip_geolocation and website_status vs response_time/redirect_check/http_headers. Descriptions generally clarify the differences, but the boundaries between some tools are not immediately obvious.
Naming conventions are mixed: check_dns and check_ssl use verb-first, while dkim_check, spf_check, and hsts_check use noun-first. There are also varied styles like dns_propagation, domain_expiry, and whois, making the pattern inconsistent but still readable.
At 20 tools, the server falls into the borderline heavy range. Most tools address a distinct diagnostic need, but some could be consolidated, such as website_status overlapping with response_time and redirect_check.
The toolkit covers the core read-only network/domain diagnostic domain well: DNS, email authentication, SSL/TLS, WHOIS, IP intelligence, and website availability. Minor gaps like traceroute or DNSSEC validation exist, but there are no critical missing operations for the apparent purpose.