VulnTracker MCP

add_to_board

Idempotent

Add CVEs to the team's board (the API key's team) as cards, or update their status if a card already exists. Use after a scan when the user asks to put the findings on the board; write which dependency and version each CVE came from into notes. Up to 50 CVE ids per call, counted as one tool call. Ask the user before adding; never add unmatched or needs_confirmation findings without saying so.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cve_ids": "<cve_ids>"
    },
    "name": "add_to_board"
  }
}

Input Schema

Name	Required	Description
`notes`	No	Note written on every card, e.g. 'found by dependency scan of repo X: lodash 4.17.20'
`status`	No	Card status for all listed CVEs: new (default), acknowledged, in_progress, resolved, dismissed
`cve_ids`	Yes	CVE ids, e.g. ["CVE-2026-1234", "CVE-2026-2345"] (max 50)

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 10, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, it discloses important behavior: cards are upserted if they already exist, the board belongs to the API key's team, up to 50 CVE ids are processed per call, and the batch counts as one tool call. It also adds confirmation and caveat requirements around unmatched or needs_confirmation findings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and then adds usage context, batching limit, and safety constraints. Each sentence contributes operational guidance without unnecessary wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no output schema but rich annotations and complete parameter descriptions, the definition covers auth scope, upsert behavior, batching, note content, confirmation requirements, and caveats. An agent has enough information to decide when and how to call it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the schema carries most parameter meaning. The description still adds useful guidance by saying notes should record which dependency and version each CVE came from, and by reinforcing the 50-CVE limit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: adding CVEs to the team's board as cards, with an upsert behavior for existing cards. It is clear overall, but the overlapping 'update their status if a card already exists' clause could make an agent wonder when to use this versus update_board_card.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear when-to-use guidance: after a scan when the user asks to put findings on the board. It also includes a strong safety instruction to ask the user before adding and to never add unmatched or needs_confirmation findings without saying so, though it does not name alternative tools for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All VulnTracker MCP tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?