Skip to main content
Glama

websex_idor_sweep_probe

Sweep object IDs through a URL template under one identity, build a status/shape oracle, and flag IDOR hits for replay validation.

Instructions

Sweep object ids through a {id} template under one identity to build a status/shape oracle, then replay hits with websex_idor_probe.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
idsYes
methodNoGET
headersYes
max_requestsNo
url_templateYes
engagement_idYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.0

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that all requests go out 'under one identity' and that output is a lightweight status/shape oracle rather than full bodies, but says nothing about safety, request volume/rate behavior, or what happens on errors/hits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the analysis step front-loaded and the follow-up action last; nothing is wasted. The 'status/shape oracle' phrasing is slightly jargon-heavy but earns its place by describing the output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value documentation is not required, and the workflow role is clear. However, for a 6-parameter, nested-object probe with zero schema coverage, the description is thin on the parameters needed to actually invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, so the description must compensate. It explains the {id} placeholder semantics of url_template and the single-identity constraint, but leaves method, headers, ids, max_requests, and engagement_id completely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (sweep) and resource (object ids through a {id} template) and frames the tool as the enumeration step that feeds websex_idor_probe. This lets an agent distinguish it from the sibling idor_probe without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly sequences the workflow: sweep under one identity first, then 'replay hits with websex_idor_probe'. That is real when-to-use guidance naming the alternative, though no exclusions or preconditions (e.g., when to skip the sweep) are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools