VulnTracker MCP

create_jira_issue

Idempotent

Open a Jira issue for a CVE on the team's board (the card is created first if missing) using the team's Jira integration. Returns the issue key and URL; if the card already has an issue, returns that one with existing=true. Only when the user asks.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cve_id": "<cve_id>"
    },
    "name": "create_jira_issue"
  }
}

Input Schema

Name	Required	Description	Default
`note`	No	Optional note for the issue description, e.g. which dependency and version it came from
`cve_id`	Yes	CVE id

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 10, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses the side effect of creating a board card when one is missing, states the return payload (issue key and URL), and gives concrete semantics for idempotentHint by explaining that an existing issue is returned with existing=true rather than a duplicate being filed. That is exactly the mutation/repeat-call behavior an agent needs before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action and side effect, then return values, then the invocation guard. No redundant restatement of the name or title; every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by describing the return value and the existing=true flag, and it covers the card-creation side effect plus the idempotency behavior. For a two-parameter write tool this leaves no material gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, and the description adds only the framing that cve_id identifies the CVE the issue is opened for. The optional 'note' parameter is not mentioned in the description at all, so no meaning is added beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Open a Jira issue for a CVE on the team's board') and the parenthetical 'the card is created first if missing' implicitly routes away from a separate add_to_board step, so an agent can distinguish it from board-management siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Only when the user asks' is an explicit gating condition that prevents proactive invocation, which is the main misuse risk for a write tool. It does not name an alternative tool or describe the preconditions (e.g. whether the CVE must already be tracked), so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All VulnTracker MCP tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?