Check the health of your agent's external dependencies: uptime, SSL validity, blacklist status, and a trust score 0-100 (DepScan).
| Name | Required | Description | Default |
|---|---|---|---|
| endpoints | Yes | List of URLs your agent/skill depends on, e.g. ["https://api.openai.com", "https://api.stripe.com"] |
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It names the checks performed and the trust-score output, which is helpful. However, it does not explicitly mention that the tool will make network requests to the supplied endpoints, nor does it describe failure/availability behavior or consequences of the check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-formed sentence with the verb and resource first, followed by a compact list of concrete outputs. Every phrase adds information; nothing is redundant or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has a single required parameter, fully covered schema, and an output schema, so the description covers the essential invocation context. The main gap is that it does not explain how this tool relates to the sibling scanning/auditing tools, which could lead to suboptimal tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The endpoint parameter is fully described in the schema with an example and a clear list-of-URLs type. The description adds only the relational context ('your agent's external dependencies') but does not need to restate the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Check'), the target ('health of your agent's external dependencies'), and the specific outputs it produces ('uptime, SSL validity, blacklist status, and a trust score 0-100'). It is more specific than the tool name, but it does not explicitly differentiate itself from sibling tools such as network_scan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives like network_scan, scan_skill, or audit_mcp_server_config. The description implies a context—checking dependencies your agent relies on—but provides no exclusions or selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Most tools target distinct scan types (MCP config, dependencies, skills, network, secrets), but full_stack_audit deliberately overlaps with five of them, creating ambiguity about whether to call the umbrella tool or a focused scanner. The descriptions mitigate this by clarifying scope, but the redundant surface makes selection less crisp.
Names are mostly descriptive and action-oriented, but they mix conventions: scan_secrets and scan_skill use a verb_noun pattern, audit_mcp_server_config and check_dependencies use different verbs, network_scan and full_stack_audit are non-verb phrases, and securityscan_checkout/securityscan_pricing use a brand prefix. This is readable but not a consistent, predictable pattern.
With 8 tools, the server is well-scoped for its security-scanning purpose. Each focused tool covers a meaningful threat surface, and full_stack_audit adds value as a correlation layer rather than pure bloat.
The toolset covers the core security lifecycle for an agent environment: configuration auditing, dependency health, skill vetting, network scanning, and secret/PII redaction, plus a full-stack correlation option. Minor gaps exist around remediation actions and persistent scan history, but these are not clearly required by the server's stated purpose.