OMENZ agent tools

secret_scan

Secret-Leak Preflight: before a handoff, prompt or payload leaves your boundary, scan it for API keys (Anthropic, OpenAI, AWS, GitHub, Stripe, Slack, Google...), PEM keys, wallet private keys, recovery phrases, DB passwords, JWTs and card numbers. CLEAN / REVIEW / BLOCK with JSON path + offset and redacted previews. Scanned in memory, never stored or logged. By OMENZ. (MCP calls run in AYNE, the free playzone; production: POST https://www.omenz.org/api/tollbooth/v1/secret-scan, $0.002 via x402.)

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "payload": "<payload>"
    },
    "name": "secret_scan"
  }
}

Input Schema

Name	Required	Description	Default
`payload`	Yes	String or JSON (<=256 KB) to check

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 14, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses verdict tiers (CLEAN / REVIEW / BLOCK), the shape of findings (JSON path + offset with redacted previews), and the retention policy ('scanned in memory, never stored or logged'). It loses a point for the trailing deployment/pricing parenthetical ('MCP calls run in AYNE ... production: POST ... $0.002 via x402'), which muddies which endpoint this invocation targets and whether BLOCK actually halts an action or merely reports a verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The front-loaded 'Secret-Leak Preflight' clause plus the enumeration of detectable secrets and the verdict/retention sentences all earn their place. The closing 'By OMENZ' attribution and the AYNE/tollbooth pricing note are extraneous metadata that dilute an otherwise tight definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no annotations and no output schema, the description covers the essential ground: what is scanned, the three-level verdict, the finding fields, and the data-handling guarantee. The one remaining gap is what an agent should do differently on REVIEW versus BLOCK, which is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage, so the schema already defines 'payload' and its 256 KB ceiling. The description's phrase 'handoff, prompt or payload' adds only marginal framing and no format, encoding, or error semantics beyond what the schema states — baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Secret-Leak Preflight ... scan it for API keys') and enumerates the exact secret classes detected (Anthropic/OpenAI/AWS keys, PEM keys, wallet private keys, recovery phrases, JWTs, card numbers). An agent can immediately tell this is a secret-detection scanner rather than a general preflight or handoff tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear triggering condition: 'before a handoff, prompt or payload leaves your boundary,' which tells the agent exactly when to call it. It stops short of naming when-not to use it or pointing at the sibling 'preflight' tool as an alternative for non-secret checks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All OMENZ agent tools tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?