Security Audit MCP Ver
Provides read-only GitHub repository access via GitHub read APIs, enabling repository metadata inspection, bounded repository tree listing, and reading individual text files for source-code security audits. Supports an optional fine-grained read-only GitHub token for higher API limits or private repositories.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Security Audit MCP Verrun a security audit on github.com/acme/app and generate a report"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Security-Audit-MCP-Ver
Read-only, evidence-led source-code security audit tools exposed through the Model Context Protocol (MCP).
This is an independent implementation inspired by the workflow in Cloudflare Security Audit Skill. It is not affiliated with or endorsed by Cloudflare.
Current status
v0.3.0-dev — MCP SDK v2, structured workflow primitives, and upstream Cloudflare validators.
The server currently exposes:
Tool | Workflow phase | Purpose |
| Recon | Read GitHub repository metadata |
| Recon | List bounded repository paths |
| Recon | Read one bounded text file |
| 1 | Inventory and classify repository files |
| 3 | Generate heuristic candidate leads |
| 2 | Validate the coverage ledger |
| 4 | Validate structured finding records |
| 5 | Compare findings with separately supplied reviewer checks |
| 6 | Validate final gates and generate JSON/Markdown reports |
| 1 | Build run metadata, architecture summary, and canonical coverage ledger from four caller-supplied scout reports |
| 2 | Validate, rank, assign, and explicitly defer canonical coverage units for a bounded hunting wave |
| 2 | Validate ownership and structured hunter results, then consolidate only assigned ledger units |
| 1–2 | Validate canonical coverage ledgers with Cloudflare's upstream validator |
| 4–5 | Validate findings against Cloudflare's upstream report schema and semantic rules |
The Phase 1 adapter follows the upstream reconnaissance contract: four distinct scout-report categories, a pre-recon budget gate, architecture summary, scope-aware canonical coverage units, and explicit prior-run limitations. Phase 2 adds deterministic priority ranking, bounded assignments, explicit deferred states, structured result consolidation, ownership checks, and parent-confirmed artifact promotion checks. Neither phase spawns agents; scout and hunter results are caller-supplied. The cloudflare_*_validate tools run upstream validators and schema preserved under vendor/cloudflare-security-audit-skill/. Upstream methodology, companion guidance, validator tests, and notices are also preserved there under MIT.
The workflow is intentionally explicit: reconnaissance inventory is not a completed review; heuristic matches are not confirmed vulnerabilities; a separate reviewer must provide verification checks; and incomplete coverage or verification keeps the run marked incomplete.
Related MCP server: Shield IA
Requirements
Node.js 20.11 or newer
An MCP-compatible host
Optional GitHub fine-grained token for higher API limits or private repositories
Install and build
npm install
npm run typecheck
npm test
npm run build
npm startFor local development:
npm run devMCP host configuration
Example for a host that launches a local Node process:
{
"mcpServers": {
"security-audit-mcp-ver": {
"command": "node",
"args": ["/absolute/path/to/Security-Audit-MCP-Ver/dist/index.js"],
"env": {
"GITHUB_TOKEN": "OPTIONAL_READ_ONLY_TOKEN"
}
}
}
}Use a fine-grained GitHub token with read-only repository Contents and Metadata permissions. Do not use a token with write permissions for this read-only server.
Safety model
GitHub access uses read APIs only.
The server never clones or executes target repository code.
No deployed endpoint, production service, or third-party infrastructure is probed.
Repository URL parsing accepts GitHub HTTPS URLs only.
Source pattern matches are candidate leads, not proof of exploitability.
Potential credential evidence is redacted before candidate output.
Only confirmed records may contain severity;
needs_validationrecords cannot.The server does not spawn independent sub-agents. The upstream validation tools validate record structure and semantics; they do not independently re-read repository source or establish a vulnerability by themselves. Phase 5 requires separately supplied reviewer checks.
Reports are marked
incompleteunless coverage and independent-verification gates pass.Do not submit secrets or private source code unless you are authorized to share them.
A future sandboxed runner would require OS-enforced isolation, no external network access, restricted environment variables, resource limits, and scratch-only writes. This project does not implement such a runner.
Workflow model
Reconnaissance: use
cloudflare_reconnaissance_preparewith four source-cited scout reports and coverage-unit candidates; it emitsrun-metadata.json,architecture.md, and a canonicalcoverage-ledger.jsonvalidated by Cloudflare's upstream validator. It does not spawn agents.Coverage-led hunting: prepare a bounded wave with
cloudflare_hunting_wave_prepare; return one structured result per assigned coverage ID; consolidate withcloudflare_hunter_results_consolidate; then run a fresh source-reading coverage critic before another wave. The planner does not spawn hunters. Local checks are accepted only when the parent explicitly supplies paths already promoted through a trusted sandbox procedure.Candidate generation: inspect source and produce heuristic leads with file/line evidence.
Structured findings: validate records, verdicts, evidence and unique fingerprints.
Independent verification: compare findings against a separate reviewer’s checks.
Reporting: generate
findings.json,REPORT.md,FINDINGS-DETAIL.md, andNEEDS-VALIDATION.md; disclose incomplete runs.
The current implementation provides workflow primitives, not an autonomous six-phase audit agent. It does not claim that a complete audit has occurred merely because tools were called.
License
GNU Affero General Public License v3.0 or later. See LICENSE.
Upstream inspiration and attribution details: ATTRIBUTIONS.md.
Available Tools
14 toolsaudit_coverage_validateC
Phase 2: validate that every in-scope path has exactly one coverage-ledger entry.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| scope_paths | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the entire behavioral burden. "Validate" implies a pure read, but the description never says whether it mutates anything, whether violations are returned as a list or raised as an error, how duplicates/missing paths are reported, or what the result shape looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the phase label leads. It is terse to the point of under-specification rather than being padded, so it scores well on efficiency but not perfectly on sufficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The input is a nested ledger structure with enums, required fields and size limits, there is no output schema and no annotations, yet the description is one clause long. For a tool whose entire value is the failure-reporting semantics, an agent cannot tell what a successful versus failing invocation looks like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only loosely maps its wording to the two parameters ("in-scope path" → scope_paths, "coverage-ledger entry" → ledger) and says nothing about the required status/category enums, the mandatory rationale field, or the 5000-item cap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb plus resource: validate that every in-scope path has exactly one coverage-ledger entry, which is a precise, checkable invariant. It does not, however, distinguish this tool from its sibling cloudflare_coverage_ledger_validate, whose name suggests an overlapping function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Phase 2:" implies sequencing (run after the reconnaissance/ledger phase), which is useful implied guidance. There is no explicit when-to-use/when-not, no statement of prerequisites, and no pointer to the sibling validate tool as an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_findings_validateB
Phase 4: validate finding structure, evidence fields and unique fingerprints. Needs-validation records cannot carry severity.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden. It discloses a validation rule (needs-validation records cannot carry severity) but never says whether the tool reads or mutates the records, what happens when validation fails, or how results are surfaced — critical for a tool named 'validate' with no annotation hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the phase and the validation targets, with the constraint sentence second. No filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should say what a validation call returns (counts of invalid records, error list) and whether it aborts on first failure. It covers scope and one rule but leaves the return behavior and failure mode undefined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter at 0% schema description coverage and the item schema is an empty object, so the schema conveys nothing about record shape. The description partly compensates by naming the fields validated (structure, evidence, fingerprints) and the maxItems cap is visible in schema, but the required record format remains undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (validate) and enumerates the concrete aspects checked: finding structure, evidence fields, and unique fingerprints. The 'Phase 4' prefix signals pipeline position. It does not distinguish this from sibling validators such as audit_coverage_validate or cloudflare_findings_validate, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Phase 4' implies this runs after earlier audit phases, which is useful implied ordering, and the severity rule gives one actionable constraint. There is no explicit when-not guidance and no reference to the sibling validation tools, so the agent must infer which validator applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_independent_verifyB
Phase 5: compare findings against separately supplied reviewer checks. This tool does not spawn reviewers or claim independence by itself.
| Name | Required | Description | Default |
|---|---|---|---|
| checks | Yes | ||
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses an important non-capability: this tool does not spawn reviewers or claim independence by itself, which prevents a critical misconception. It does not disclose read-only versus mutating behavior, output shape, error handling, or side effects, leaving substantial gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences with no filler, and the phase marker plus the key limitation are front-loaded. Its brevity is a completeness issue rather than a verbosity problem. Every sentence carries useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a large nested input schema, no output schema, and no annotations, so the description should do more to explain the verification result and matching behavior. It conveys only the phase, the comparison purpose, and one limitation. It does not explain what the tool returns, how checks are evaluated, or what constitutes successful independent verification.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only identifies 'findings' and 'checks' conceptually. It does not explain the structure of findings, how reviewer checks map to findings via fingerprints, or the meaning of fields such as agrees and evidence_matches. This is minimal compensation for two complex required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource relationship: compare findings against separately supplied reviewer checks. It also adds a negative scope statement clarifying that the tool does not spawn reviewers or claim independence by itself. It does not explicitly distinguish itself from sibling validation tools, so it stops short of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Phase 5' and the requirement for 'separately supplied reviewer checks' imply when in the workflow this tool applies and what must already exist. The statement that it does not spawn reviewers excludes a plausible misuse. However, it does not name alternatives such as audit_findings_validate or cloudflare_findings_validate, so guidance is not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_reconnaissanceC
Phase 1: map repository metadata and paths, classify files, and create an initial not-yet-reviewed inventory.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| repository | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It does disclose one behavioral trait — it creates an inventory whose entries start as "not-yet-reviewed" — but says nothing about whether the repository is only read, where the inventory is persisted, whether reruns overwrite prior state, or what permissions are needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the phase label and then lists the operations. There is no filler, though the comma-list style is terse enough that some meaning (what "classify" means) is compressed away.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and two undocumented parameters, the description would need to explain inputs and the produced inventory. It instead describes only the internal activity, leaving the agent to guess at argument formats and the shape of the result before calling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across two parameters. The phrase "repository metadata" loosely gestures at the required `repository` argument, but the `ref` parameter (branch/tag/commit?) is never mentioned, and no format, length, or default guidance is added beyond the bare schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names concrete operations — map repository metadata and paths, classify files, build an inventory — and labels itself "Phase 1," which separates it from sibling readers like repository_tree and repository_read_file. It is clear what the tool does, though the boundary with repository_inspect is only implied by the extra classification/inventory step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Phase 1" implies this is the entry point of an audit workflow, which is real usage signal. However, there is no explicit statement of when to prefer it over repository_inspect or repository_tree, and no exclusions or prerequisites (e.g., whether a prior snapshot must exist).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_report_generateC
Phase 6: validate coverage and separate reviewer checks, then generate target-neutral Markdown reports.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | Yes | ||
| findings | Yes | ||
| repository | Yes | ||
| scope_paths | Yes | ||
| coverage_ledger | Yes | ||
| requested_status | Yes | ||
| independent_checks | Yes | ||
| inventory_complete | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It says reports are "generated" but not whether anything is written to disk, where output lands, whether the call fails on invalid coverage or low-quality reviewer checks, or whether it is idempotent — all critical for a mutation-flavored generation step.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the phase marker front-loaded and no filler. It is efficient, though its brevity is also the source of the missing detail rather than a model of disciplined density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, all-required tool with nested arrays, zero schema documentation, no annotations and no output schema, the one-line description leaves far too much unresolved — notably what the tool emits, where, and how its internal validation differs from the dedicated validator siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 required parameters, including structurally complex ones like coverage_ledger, independent_checks and the three-variant findings union. The description only obliquely gestures at two of them ("coverage", "reviewer checks") and adds no meaning about required contents, verdict variants, or what requested_status/inventory_complete control.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete output ("target-neutral Markdown reports") and places itself as "Phase 6", which is more specific than a tautology. But it also claims to "validate coverage and separate reviewer checks", which is the apparent job of siblings like audit_coverage_validate, audit_findings_validate and audit_independent_verify, so an agent cannot tell from the text what is unique to this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Phase 6" implies an ordering constraint relative to earlier audit phases, which is real usage guidance not present in the schema. However, there is no explicit statement of when to prefer this tool over the several validate/verify siblings, nor any precondition such as what state the ledger and findings must be in first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudflare_coverage_ledger_validateC
Validate a canonical coverage-ledger.json document with Cloudflare Security Audit Skill's upstream validator.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden. It does not say whether validation is read-only, whether it returns a pass/fail verdict, what error shape is produced on invalid input, whether partial ledgers are tolerated, or whether it has side effects on the referenced document — all critical for a validation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler or redundancy. It is efficient, though its brevity is part of why semantics are missing elsewhere rather than a virtue in itself.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, 0% parameter documentation, and an unconstrained array payload, the description is the only source of information and it is insufficient. An agent needs to know the expected ledger element structure and the validation result format, neither of which is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single parameter is an untyped array with items: {} and maxItems: 10000, so the schema conveys almost nothing. The description says 'canonical coverage-ledger.json document' but never explains that the parameter must be an array, what element shape is expected, or which canonical fields are required — an agent cannot construct a valid call from this.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Validate') and resource ('canonical coverage-ledger.json document') plus the validator used ('Cloudflare Security Audit Skill's upstream validator'). It does not, however, distinguish itself from closely named siblings such as audit_coverage_validate, cloudflare_findings_validate, and audit_findings_validate, so an agent cannot tell from the text alone which validate tool to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus the three sibling validate tools, no prerequisite (must the ledger already exist? be canonical-formatted?), and no mention of what to do when validation fails. The only implicit cue is the word 'upstream validator', which hints at ordering but gives no actionable routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudflare_findings_validateC
Validate findings.json against Cloudflare Security Audit Skill's upstream report-schema.json and semantic checks.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full disclosure burden. It reveals that there are two validation layers (upstream JSON Schema plus semantic checks), but says nothing about whether the call is read-only, what happens on failure, whether errors are returned or thrown, or how many issues are reported.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with the verb first and no filler. The only friction is dense compound terminology ('upstream report-schema.json and semantic checks') that a reader must unpack, but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should explain what a caller gets back (pass/fail, list of violations, exit semantics) and what the input findings are expected to contain. Neither is covered, leaving an agent unable to predict the result of the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'findings' is declared with an untyped items schema (0% coverage), so the schema conveys nothing about the shape of a finding. The description compensates only partially by pointing at report-schema.json as the authoritative shape; it never states that the value is parsed findings.json content or what fields trigger semantic failures.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Validate findings.json') and pins the target of validation to 'Cloudflare Security Audit Skill's upstream report-schema.json and semantic checks', which distinguishes it from the other validate siblings (audit_findings_validate, cloudflare_coverage_ledger_validate) by naming the exact contract it enforces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use statement, no prerequisites, and no mention of the near-identical sibling audit_findings_validate, which an agent would have difficulty telling apart from this tool. Usage is only inferable from the name and the word 'Validate'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudflare_hunter_results_consolidateB
Cloudflare Skill Phase 2 parent-side consolidator: validate structured hunter unit results, ownership, source/local checks and parent-promoted artifact paths, then update only assigned ledger units. Does not execute targets or promote artifacts.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| results | Yes | ||
| promoted_artifacts | No | ||
| assigned_coverage_ids | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavior alone, and it does disclose the mutation scope ('update only assigned ledger units') and the non-actions ('does not execute targets or promote artifacts'), which is useful. It omits what happens when validation fails, whether the update is idempotent, and whether partial successes are applied, all critical for a ledger-mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the phase and side (parent-side) that determine behavior, followed by a scoping exclusion. Dense jargon but no wasted words; slightly compressed to the point that the exclusions could be confused with the positive behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex mutation tool with opaque untyped array items, no annotations, no output schema, and 0% parameter documentation. A two-sentence description cannot convey enough for correct invocation: the shape of results/ledger entries and the response or error semantics are all missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for four undocumented parameters. It gestures at each concept area (results, assigned/ownership, parent-promoted artifact paths, ledger units) but gives no item shape for `ledger` and `results`, whose schema is `items: {}` — an agent cannot construct valid payloads from this.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb+resource: 'parent-side consolidator' that validates hunter unit results and 'update[s] only assigned ledger units'. That is clearly distinct from preparation/validation siblings, though it never names a sibling tool. The 'Phase 2' framing plus the exclusion clause pins down what it is.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Phase 2 parent-side' qualifier implies this runs after hunter units have produced results, and 'Does not execute targets or promote artifacts' is genuine negative guidance. However, it never routes the agent to a named alternative (e.g. the hunting-wave prepare or ledger-validate siblings) for cases this tool excludes, so the when-to-use is inferred rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudflare_hunting_wave_prepareA
Cloudflare Skill Phase 2 parent-side planner: validate a canonical ledger, rank planned units deterministically, assign a bounded wave, and explicitly defer untouched units. Does not spawn hunters.
| Name | Required | Description | Default |
|---|---|---|---|
| ledger | Yes | ||
| max_hunters | Yes | ||
| changed_paths | No | ||
| prior_gap_ids | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description still discloses important behavior: deterministic ranking, bounded wave assignment, explicit deferral of untouched units, and no hunter spawning. It stops short of stating whether the tool is purely read-only, what the returned plan looks like, or how deferred units are represented.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Each clause contributes a distinct action or scope constraint, including the important negative scope at the end.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter planning tool with no annotations, no output schema, and zero schema description coverage, the description is too thin. It defines the high-level plan but omits parameter semantics and return-value expectations that an agent would need to invoke it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for four parameters, and the description only hints at 'ledger' and a 'bounded wave' for ledger and max_hunters. It says nothing about the meaning or format of changed_paths, prior_gap_ids, ledger item structure, or the max_hunters bound.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific role ('Phase 2 parent-side planner') and concrete actions: validate a ledger, rank planned units, assign a bounded wave, and defer untouched units. It also states a clear negative scope ('Does not spawn hunters'), which distinguishes it from a hunter-spawning phase.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Phase 2 parent-side planner' framing and the explicit 'Does not spawn hunters' exclusion provide clear stage context and a key when-not condition. However, it does not name alternative sibling tools such as ledger validation or reconnaissance preparation, so the agent must infer the routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cloudflare_reconnaissance_prepareB
Cloudflare Skill Phase 1 adapter: synthesize four caller-supplied read-only scout reports into run-metadata.json, architecture.md, and a canonical coverage-ledger.json validated by the upstream validator. Does not spawn agents or execute target code.
| Name | Required | Description | Default |
|---|---|---|---|
| budget | No | ||
| run_id | Yes | ||
| target | Yes | ||
| profile | No | standard | |
| repository | Yes | ||
| source_ref | Yes | ||
| scope_paths | No | ||
| scout_reports | Yes | ||
| coverage_units | Yes | ||
| prior_run_paths | No | ||
| selected_companion_files | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose real behavior: it writes three named artifacts and explicitly does not spawn agents or execute target code, which bounds the side effects. It omits where files land, what happens when the upstream validator rejects the ledger, and whether the operation is idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences with the action and the output artifacts front-loaded and no filler. Dense domain jargon is expected here, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter tool with nested objects, no output schema, and no annotations, the description is thin. Domain-specific fields like canonical_refs, ordinary_attack_class_block, excluded_blocks, and selected_companion_blocks are entirely unexplained, leaving an agent unable to construct a valid coverage_units entry from the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 11 parameters, including deeply nested scout_reports and coverage_units objects, so the description must compensate. It only maps loosely onto two of them ('four scout reports' → the four required keys, 'coverage-ledger' → coverage_units) and says nothing about run_id, repository, target, source_ref, budget, profile, scope_paths, prior_run_paths, or selected_companion_files.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: synthesize four caller-supplied scout reports into run-metadata.json, architecture.md, and coverage-ledger.json. The negation 'does not spawn agents or execute target code' separates it from a wave-preparation sibling, though it never names which sibling consumes or validates its output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Phase 1 adapter' plus 'caller-supplied' implies you must already hold four scout reports before calling, which is useful sequencing context. However, it never explicitly contrasts with audit_reconnaissance or cloudflare_coverage_ledger_validate, nor states what to do if validation fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repository_inspectB
Read GitHub repository metadata. Read-only; no code is executed.
| Name | Required | Description | Default |
|---|---|---|---|
| repository | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden, and it does add genuine safety context by declaring read-only behavior and that no code is executed. However, it omits permission/auth requirements, rate-limit behavior, and what the returned metadata covers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler, and the read-only guarantee is front-loaded alongside the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, the definition is minimally viable: purpose and safety are covered, but the parameter format and the shape of the returned metadata are left undefined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single 'repository' parameter is undocumented in both the schema and the description, leaving the expected identifier format (owner/repo slug, URL, or ID) ambiguous despite the 3-300 character bounds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Read GitHub repository metadata'), which is enough to distinguish it in spirit from siblings like repository_tree and repository_read_file, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'metadata' suggests use it for repo-level information rather than file contents or tree listings. There is no explicit when-to-use, no prerequisites, and no named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repository_read_fileB
Read one bounded text file from a GitHub repository. No code is executed.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| path | Yes | ||
| repository | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does add useful safety context ('No code is executed') and hints at a size bound ('bounded'), but never states that bound, whether private repositories require credentials, or how large files are handled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the operation and followed by the safety qualifier. Nothing is redundant, and no sentence could be removed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter tool with zero annotation coverage, no output schema, and 0% schema description coverage, the definition is too thin. It omits parameter formats, return shape, encoding/truncation behavior, and authentication expectations, all of which the agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for three parameters, so the description must compensate and does not. It never explains that 'repository' is likely an owner/name slug, that 'path' is relative to the repository root, or that 'ref' accepts a branch, tag, or commit SHA.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: read a single text file from a GitHub repository, with the scope qualifier 'one bounded text file'. An agent can distinguish it from the listing-oriented siblings repository_tree and repository_inspect, though the description never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and no alternative is named despite repository_tree and repository_inspect being close siblings. The agent must infer that this fetches file contents rather than listing or metadata.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repository_treeC
List bounded repository paths from GitHub's Git tree API.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| repository | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and mostly does not. It does disclose the backing API (Git tree API), implying a live GitHub call and suggesting truncation via 'bounded', but it never explains what 'bounded' means (depth cap, result cap, truncated flag), whether authentication is required, or what is returned. Return shape is undisclosed and there is no output schema to compensate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is efficient, though the brevity reflects under-specification rather than disciplined editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with zero schema coverage, no annotations, and no output schema, an agent needs to know the ref semantics, repository format, and what 'bounded' limits. None of that is present, so the definition is not sufficient to call the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain both parameters and does not. It implicitly maps to 'repository' but never states the expected format (owner/repo slug), and 'ref' is entirely unaddressed — no mention that it selects a branch, tag, or commit SHA, or that omitting it defaults to the default branch.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('repository paths') and names the upstream source ('GitHub's Git tree API'), so the agent knows this is a remote tree listing rather than a file read. The word 'bounded' is undefined and no sibling tool (repository_inspect, repository_read_file) is referenced to sharpen the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to choose this over repository_inspect or repository_read_file, which sit in the same family. There is no statement of prerequisites, no condition that selects this tool, and no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
source_security_reviewB
Phase 2/3: generate heuristic source-review candidates. Results are leads only and never confirmed automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| filename | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden; it does useful work by disclosing that output is heuristic and 'never confirmed automatically', which sets the reliability bar. It omits whether the tool is read-only, whether it processes content inline versus fetching a file, any size or cost limits, and what the leads look like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the action and followed by the caveat about result reliability; no wasted wording. The terseness costs a little, since 'Phase 2/3' is undefined jargon.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no annotations means the description should explain the input format, the shape of returned candidates, and the phase semantics; it does none of these. For a tool whose only real job is transforming a source blob into leads, the missing input/output contract is a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two parameters, and the description adds nothing about them. Critically, it never clarifies whether 'source' is raw source-code text (max 100000 chars suggests inline) or a path/identifier, nor what 'filename' is used for — this ambiguity can cause a failed invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource — 'generate heuristic source-review candidates' — plus a workflow anchor ('Phase 2/3'). It does not name any sibling tool, so the agent must infer that repository_read_file / repository_inspect are the alternatives that feed this step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Phase 2/3' implies pipeline placement, but the description never states when to call this versus repository_inspect, repository_read_file, or the audit_* validators. There are no explicit exclusions or prerequisites, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v0.3.0- First observed
audit_coverage_validate - First observed
audit_findings_validate - First observed
audit_independent_verify - First observed
audit_reconnaissance - First observed
audit_report_generate - First observed
cloudflare_coverage_ledger_validate - First observed
cloudflare_findings_validate - First observed
cloudflare_hunter_results_consolidate - First observed
cloudflare_hunting_wave_prepare - First observed
cloudflare_reconnaissance_prepare - First observed
repository_inspect - First observed
repository_read_file - First observed
repository_tree - First observed
source_security_review
TDQS
Scored across 14 tools
Several tools have overlapping or near-duplicate purposes: cloudflare_coverage_ledger_validate vs. audit_coverage_validate, and cloudflare_findings_validate vs. audit_findings_validate. An agent could easily pick the wrong validator or confuse the Cloudflare-specific adapter with the generic audit phase tool, even though descriptions provide some distinction.
Most names follow a verb_noun or resource_action pattern, but the set mixes four prefix families: cloudflare_, audit_, repository_, and a standalone source_security_review. The naming is readable but not predictable across the whole server.
Fourteen tools is reasonable for a multi-phase security audit workflow spanning reconnaissance, validation, review, verification, and reporting. The count is slightly inflated by parallel Cloudflare-specific and generic audit validators.
The surface covers the audit lifecycle from repository reconnaissance through findings validation, independent verification, and report generation. Minor gaps exist around remediation or code-diff inspection, but core workflows are covered.
Maintenance
Related MCP Connectors
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
GitHub security scanning, code audit, and workflow automation for repositories.
Audit and repair any public GitHub repo. Free survey; paid source, unified diffs and a pull request.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceScans GitHub repositories for security vulnerabilities by cloning, performing static analysis, secret detection, build verification, and AI-powered OWASP-aligned code review, producing a scored SECURITY.md report.-
- FlicenseNot gradedqualityDmaintenanceAutomated security audit assistant for GitHub repositories that detects static vulnerabilities (leaked credentials, vulnerable dependencies, bad Docker practices, excessive GitHub Actions permissions), calculates a security score, and provides risk explanations and mitigation recommendations via Cohere.-

repo-doctorofficial
AlicenseNot gradedqualityDmaintenanceMCP server that produces scored, evidence-cited audits of public GitHub repos via tools for fetching metadata, reading files, scanning git history, and checking hygiene.MIT- AlicenseNot gradedqualityCmaintenanceEnables auditing public GitHub repositories over MCP Streamable HTTP, including classifying URLs, cloning repositories, scanning manifests, CI workflows, and credential signals, and producing findings, file trees, summaries, and PDF reports.4 npmMIT