Scans a single file for OWASP MCP10 context-oversharing issues, helping you detect and address unintended exposure of sensitive context before it leaks.
Scan a single file for OWASP MCP10 context-oversharing issues
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to the file to scan |
Changes observed during successful MCP inspections.
v0.1.5Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"v0.1.1Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral-disclosure burden. It indicates a scan of a file for a specific issue class, but does not state that the operation is read-only, what the scan checks, whether files are modified, or what the result looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no filler. Every word contributes to identifying the scan target and issue domain.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter file-scanning tool, the description is sufficient to invoke it correctly. However, with no output schema and no explanation of returned findings or what constitutes an oversharing issue, it leaves some contextual gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully documents the single path parameter, including that it can be absolute or relative. The description adds no further parameter meaning beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ("Scan") and resource ("single file") and scopes it to OWASP MCP10 context-oversharing issues. It implicitly distinguishes itself from scan_text and scan_directory siblings by specifying a single file, though it does not name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "single file" implies when to use this tool rather than the text or directory variants. However, it provides no explicit when-to-use guidance, prerequisites, or named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.