Skip to main content
Glama

values_review

Review Helm values.yaml for insecure defaults such as untagged images, empty resources or securityContext, committed credentials, exposed Services, single replicas, and privileged settings.

Instructions

Review a Helm values.yaml (K8S4001-K8S4007): :latest or untagged image defaults, resources left empty, credentials committed in values (key name and length only, value redacted), empty securityContext, Services exposed as LoadBalancer/NodePort by default, replicaCount 1, and insecure defaults like privileged or runAsUser 0. Reviews the inputs of a chart; use render_helm or helm template output with lint_manifests to review what a chart actually produces.

Input Schema

NameRequiredDescriptionDefault
pathYes

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does reasonably well: it discloses the exact check categories, notes that credential values are redacted and only key name and length are reported (an important privacy behavior an agent could not infer), and frames the operation as a review rather than a mutation. It stops short of explicitly stating read-only semantics or any failure behavior on unreadable/invalid files.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the verb and resource, then a compact checklist of checks, then the sibling-routing sentence. Dense but every clause carries information; the parenthetical about redaction is slightly heavy but justified by its privacy significance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-style reviewer with an output schema available, the description covers what is checked, how credentials are handled, and when to use alternatives instead. The remaining gap is the meaning/format of `path`, which is the only thing an agent could get wrong when calling it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter `path` is undocumented in the schema. The description only implies it via 'Review a Helm values.yaml' — it never says whether path is a file, a chart directory, or how relative paths are resolved, so it adds only marginal meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Review a Helm values.yaml') and enumerates the exact rule set it applies (K8S4001-K8S4007: latest/untagged images, empty resources, committed credentials, empty securityContext, LoadBalancer/NodePort services, replicaCount 1, privileged/runAsUser 0). It also explicitly contrasts itself with render_helm and lint_manifests, so an agent can distinguish it from siblings without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit routing rule: this tool reviews chart inputs, while render_helm or `helm template` output plus lint_manifests should be used to review what the chart actually produces. Both the when-to-use and the named alternatives with their selecting condition are present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.