Skip to main content
Glama
GuardBee

@guardbee/mcp-security-proxy

Official

unbounded_consumption_auditor__scan_text

Scan LLM and agent code for unbounded consumption anti-patterns like missing token limits, timeouts, and iteration caps to prevent denial-of-wallet attacks.

Instructions

Scan LLM/agent application code for Unbounded Consumption ("denial of wallet") anti-patterns from OWASP LLM Top 10 2026's #6 category: LLM calls with no output token limit, hand-rolled HTTP calls to an LLM endpoint with no timeout, agent tool-calling or retry loops with no iteration cap, framework safety limits (LangChain max_iterations, openai-agents max_turns) explicitly disabled, and MCP tool handlers that make billable calls with no visible rate limiting.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
labelNoOptional label shown in findings (e.g. filename)
contentYesThe code content to scan

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.1.1

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, yet it discloses nothing operational: it does not say whether the scan is read-only, whether it makes any LLM/network calls itself, how findings are returned, or performance/rate-limit characteristics. It details detection scope, which is useful context, but not behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single front-loaded sentence that opens with verb+resource before the enumeration. The list of detected anti-patterns is dense but each clause earns its place by defining detection scope; only the sheer length keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter scanner with no output schema, the description adequately covers what is scanned and what is detected. It omits usage routing against sibling scanners and any operational/return behavior, leaving meaningful gaps an agent must guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters ('label' and 'content') are already documented in the schema. The description adds nothing about parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (Scan) and resource (LLM/agent application code) and enumerates exactly which anti-patterns it detects, leaving no ambiguity about the tool's job. It does not, however, differentiate itself from the sibling scan_file/scan_directory variants — the text-vs-file distinction rests entirely on the name, not the description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the required 'content' parameter and the 'scan_text' name suggest this is for code already in hand, while scan_file/scan_directory handle paths. The description never states when to choose this tool over those siblings or any exclusions, so the routing must be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools