Skip to main content
Glama
Sign In
kr.ai.vdb/vdb

kr.ai.vdb/vdb

by 0pstech
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

vdb_vex

Filter a project's vulnerability scan by tracing which advisories are reachable via attacker-controlled data. Provide a source directory and lockfile to generate an OpenVEX document and shareable URL, prioritizing findings for triage.

Instructions

Given a project directory and its lockfile, work out which of its known advisories can actually be reached by attacker-controlled data, and return an OpenVEX document plus a shareable URL. Use this when a scan produced more findings than anyone can triage. Point path at the SOURCE TREE, not one file: a not_affected determination is only as wide as the code behind it, and a single-file run withholds them all. Reachability is decided at package granularity from static summaries — good for triage order, not proof of non-exploitability.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "path": "<path>",
      "manifest_path": "<manifest_path>"
    },
    "name": "vdb_vex"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathYesProject source directory.
manifest_pathYesResolved lockfile for the same project.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and excels. It discloses that reachability is decided at package granularity from static summaries, that a single-file run withholds not_affected results, and that output is for triage order, not proof of non-exploitability. No side effects or mutation are implied, and nothing contradicts structured metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single paragraph with three sentences, each earning its place: purpose, usage trigger, and a critical caveat. It is slightly longer than minimal, but every clause adds value; no redundancy or filler. The most actionable instruction (source tree vs single file) is front-loaded in the middle, which is acceptable given the flow.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no output schema, the description covers everything an agent needs: what it returns (OpenVEX document plus URL), when to use it, how to set parameters correctly, and the limitations of the analysis. It is self-contained and leaves no critical ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are described, but the description adds critical semantics beyond the schema: path must be the SOURCE TREE, not a single file, and this choice affects the breadth of not_affected determinations. This is exactly the kind of parameter-level context an agent needs that the schema does not provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb-resource pair: it 'works out' which advisories are reachable and returns an OpenVEX document plus a URL. It clearly distinguishes the tool's triage purpose from siblings by stating the trigger ('when a scan produced more findings than anyone can triage') and contrasts it with a single-file run, making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use context ('Use this when a scan produced more findings than anyone can triage') and detailed how-to-use guidance: point path at the source tree, not a single file, and explains why (not_affected determinations are as wide as the code behind it). It also clarifies the tool's limitation (good for triage order, not proof), giving clear boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools