ClevSec EU compliance tools

MCP tool list and A2A Agent Card check

mcp_tools_check

Read-onlyIdempotent

Use before enabling an MCP server or connecting to an A2A agent ('is this MCP server safe to add?', 'check these tool descriptions'). Pass the server's tools/list response or the agent's Agent Card as document. Returns flags for hidden or manipulative text in descriptions (tool poisoning), risky capabilities (running code, sending data out, an exfiltration path), annotations that do not match, secrets in parameters and missing Agent Card security fields, with a level per tool and a SHA-256 fingerprint to detect later changes. Reads declared metadata only; it does not connect to the server.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "document": "<document>"
    },
    "name": "mcp_tools_check"
  }
}

Input Schema

Name	Required	Description	Default
`public`	No	A2A only: true if the agent is deliberately public (no authentication by design).
`document`	Yes	The JSON to check: a tools/list response (JSON-RPC response, its result, or the tools array) or an A2A Agent Card.

Schema Changelog

Changes observed during successful MCP inspections.

AddedNov 4, 2026

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is largely covered. The description still adds real value by clarifying 'Reads declared metadata only; it does not connect to the server', which is stronger than openWorldHint alone, and by disclosing that it emits per-tool levels plus a SHA-256 fingerprint for change detection. It does not discuss size limits or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The trigger condition and example queries are front-loaded ahead of the return-value summary, and the closing sentence on read-only scope is well placed. It is a single dense block with some list-like enumeration that could have been split for scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the return-value burden and does it: flags for manipulative text, risky capabilities, annotation mismatches, secrets, missing Agent Card security fields, a level per tool and a SHA-256 fingerprint. Combined with the explicit read-only scope, an agent has enough to call it and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the schema. The description restates the accepted document shapes (JSON-RPC response, result, or tools array; Agent Card) but adds no format or error-handling nuance beyond that, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it checks an MCP server's tools/list response or an A2A Agent Card for tool poisoning, risky capabilities, annotation mismatches and missing security fields. It is clearly distinguishable from analysis-style siblings such as mcp_tools_report, though the description never names that sibling to draw the contrast explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use before enabling an MCP server or connecting to an A2A agent') plus representative user questions ('is this MCP server safe to add?'), which tells the agent when to reach for it. It stops short of stating when NOT to use it or naming the alternative tool for the report-style follow-up.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ClevSec EU compliance tools tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?