Skip to main content
Glama

validate_env

Validate .env files for mistakes—placeholders, empty values, bad types, syntax errors, and exposed secrets—without printing any values.

Instructions

Check env files for mistakes, from names and shapes only (no value is ever printed). Flags: placeholders (changeme, your_key_here), empty values, trailing whitespace, unquoted spaces, CRLF, a BOM, values wrapped in literal quotes, undefined ${REF}s, duplicates, syntax errors; names that promise a type but disagree (*URL not a URL, *PORT out of range, booleans, integers, emails, JWTs, *PATH that does not exist); localhost URLs in production files; real-looking secrets inside a template; and secret-looking names with a browser-exposed prefix (VITE, NEXT_PUBLIC, REACT_APP, ...).

path: folder to scan. file: validate only this env file (relative to path).

Input Schema

NameRequiredDescriptionDefault
fileNo
pathNo.

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it discloses the key non-obvious behavioral guarantee: no secret value is ever printed, making this effectively a safe read. It also reveals deeper checks (localhost URLs in production files, real-looking secrets in templates, browser-exposed prefixes) that an agent could not guess from the name. It omits whether the scan is recursive or how findings are reported, though an output schema exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead sentence is front-loaded with the purpose and the no-print guarantee before the check inventory. The inventory is a dense wall of semicolon-separated flags, but every item describes a distinct detectable condition rather than restating the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The brief matches the tool's low complexity: two optional parameters are both explained, the privacy behavior is stated, and the categories of findings are enumerated while the output schema handles return shape. The only real gap is scan scope (recursive vs top-level) and how path/file interact when both are given.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does define both parameters in the trailing lines: 'path' as the folder to scan and 'file' as a single env file relative to 'path'. That covers the parameters but adds no detail on formats, defaults, or what happens when both are supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Check env files for mistakes') and narrows it with 'from names and shapes only (no value is ever printed)', which an agent can read as the core promise. The long list of checks further pins down what 'mistakes' means. It never names a sibling (env_overview, compare_env) for contrast, so the boundary with them is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clarifies how the two parameters divide the work — 'path: folder to scan' versus 'file: validate only this env file (relative to path)' — which implies the two usage modes. It gives no guidance on when to prefer this over compare_env or env_overview, and no exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.