Skip to main content
Glama
GuardBee

@guardbee/mcp-security-proxy

Official

agent_graph_auditor__scan_text

Scan Python multi-agent orchestration (LangGraph, CrewAI, AutoGen) for excessive agency: detect indirect access to dangerous tools via delegation.

Instructions

Scan a Python snippet defining a multi-agent orchestration (LangGraph, CrewAI, or AutoGen/ag2) for excessive agency reachable through delegation or group membership — an agent with no dangerous tool of its own that can still reach one (shell/code-exec/file-write/network/credentials) through another agent it can hand off to.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
labelNoOptional label shown in findings (e.g. filename)
contentYesThe Python source to scan

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.1.1

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose the substantive analysis logic in detail — what the graph is checked for (an agent with no dangerous tool of its own that reaches shell/code-exec/file-write/network/credentials through a handoff). It omits return shape and performance traits, but the safety profile (a pure text read) is self-evident from 'Scan'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence: the core action and target come first, and the em-dash clause economically explains the detection logic. It is somewhat long, but no sentence is filler. Slightly dense for one sentence, hence not a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description still gives an agent enough to call it correctly and understand what it checks. It stops short of describing the finding/return structure, which would be the main remaining gap for a scanner with no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters ('label', 'content') are already documented in the schema. The description's mention of the Python snippet aligns with the 'content' param but adds no syntax, format, or handling detail beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb-resource pair ('Scan a Python snippet defining a multi-agent orchestration') plus the target frameworks (LangGraph, CrewAI, AutoGen/ag2) and the precise defect sought (excessive agency reachable via delegation/group membership). An agent can distinguish it from scan_file/scan_directory siblings and from other auditors like a2a_auditor or toxic_flow_auditor without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context (inline Python snippet for multi-agent frameworks) but never states when to use this over the sibling scan_file or scan_directory, nor any exclusion. The text-vs-file distinction is only inferable from the tool name, leaving usage implied rather than guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools