Lets coding agents check their own code for leaked secrets, risky dependencies and AI-code mistakes
Scored across 1 tool
With only one tool, there is no possibility of misselection or overlap. An agent cannot confuse vibedoctor_connect with anything else because nothing else exists.
The single name follows a clear snake_case pattern with a server prefix (vibedoctor_connect), which is readable and predictable. However, with only one tool there is no repeated pattern to demonstrate genuine consistency across the set.
A single tool is very thin for a server named VibeDoctor, which implies ongoing diagnostics, status, or health-check functionality. The surface is effectively one onboarding action, leaving the server barely scoped as a standalone integration.
The connect/registration step is covered, including idempotency and next steps, but there are no companion operations such as checking connection status, disconnecting, or retrieving doctor results. The lifecycle is a single dead-end call rather than a full surface.
Register this repository with VibeDoctor and get the command that connects this MCP server to it. Zero questions: BEFORE calling, run git remote get-url origin (pass it as repoUrl) and git config user.email (pass it as gitEmail). Returns a paste-ready re-point command, a GitHub connect link and next steps. Safe to call again: the same repo and email return the same project.
| Name | Required | Description | Default |
|---|---|---|---|
| server | No | The name your MCP client registered this server under. In Claude Code it is the <name> in mcp__<name>__vibedoctor_connect. Omit it if you cannot tell. | |
| repoUrl | Yes | Output of `git remote get-url origin` (SSH or HTTPS form; GitHub only) | |
| gitEmail | No | Output of `git config user.email`. Optional; a GitHub noreply address is fine. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (idempotentHint=true, destructiveHint=false, openWorldHint=true). The description goes further by disclosing what is returned (a paste-ready re-point command, a GitHub connect link, next steps) and by qualifying idempotency ('same repo and email return the same project'), which is more precise than the bare hint. It stops short of describing failure modes or auth needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the action and the mandatory pre-call steps, then the return value, then the idempotency guarantee. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly takes on the burden of explaining return values, and it does. Combined with the preconditions and idempotency note, an agent has everything needed to call this correctly in one shot.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds genuinely new information: it tells the agent how to obtain two of the three values by shelling out to git commands, which the schema does not. Only the optional `server` parameter is left to the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Register this repository with VibeDoctor') and adds the outcome ('get the command that connects this MCP server to it'). There are no siblings to disambiguate from, and the purpose is unambiguous without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit pre-call steps ('BEFORE calling, run `git remote get-url origin`... and `git config user.email`') and says it is safe to call repeatedly. There are no alternative tools to route away from, so the absence of when-not guidance is not a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
vibedoctor_connect1 field changedInput schema / properties / serverAdded value: +{
+ "description": "The name your MCP client registered this server under. In Claude Code it is the <name> in mcp__<name>__vibedoctor_connect. Omit it if you cannot tell.",
+ "pattern": "^[A-Za-z0-9_][A-Za-z0-9_-]{0,299}$",
+ "type": "string"
+}vibedoctor_connectSecurity reviews for coding agents: diffs checked against your org policy and live infrastructure.
Lints + auto-fixes how AI coding agents discover any new product. 24 rules, 6 tools, score 0-100.
Open-source licence risk checks for AI coding agents and dependency trees.
Guardian agent for AI coding: four frontier models review risky diffs and commits before they ship.
Add one secure layer between your agents and this server.
