Skip to main content
Glama

agent_scan

Destructive

Run a multi-project health pass to gather secret decay, audit anomalies, and manifest gaps, then optionally rotate expired credentials. Returns a per-project JSON report.

Instructions

[agent] Run a multi-project health pass that gathers decay status, audit anomalies, and .q-ring.json manifest gaps across one or more project paths and (optionally) auto-rotates expired secrets with freshly generated values. Use as the canonical 'agent maintenance loop' across a portfolio of repos; prefer health_check for a single read-only scope, detect_anomalies for audit-only triage, and check_project for a single-project manifest check. With autoRotate=false (default) this is read-only. With autoRotate=true it OVERWRITES expired secret values in the keyring with generated replacements — credential changes that may break upstream integrations until they are propagated. Subject to tool policy. Returns a JSON report of per-project findings and any rotations performed.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
autoRotateNoIf true, replace expired secrets with newly generated values (using each secret's `rotationFormat`/`rotationPrefix`). Only enable when intentional rotation is desired — this is destructive on the upstream side.
projectPathsNoList of absolute project roots to scan. Defaults to `[server.cwd]` when omitted.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv0.11.7
    • changedInput schema / properties / autoRotate / description
      Previous value: -"Auto-rotate expired secrets with generated values"New value: +"If true, replace expired secrets with newly generated values (using each secret's `rotationFormat`/`rotationPrefix`). Only enable when intentional rotation is desired — this is destructive on the upstream side."
    • changedInput schema / properties / projectPaths / description
      Previous value: -"Project paths to monitor"New value: +"List of absolute project roots to scan. Defaults to `[server.cwd]` when omitted."
  2. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it discloses that autoRotate=false (default) is read-only, that autoRotate=true OVERWRITES expired secret values with generated replacements, and that this may break upstream integrations until propagated. It also flags 'Subject to tool policy' and describes the return payload, adding real behavioral context over the destructiveHint/readOnlyHint flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The sentence is long but front-loads the core action and scoping, then layers alternatives and the destructive caveat. Density is high with little filler, though the single-sentence structure is heavy and could be broken up.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description still states what is returned ('a JSON report of per-project findings and any rotations performed'). Combined with the safety, scope, and alternative guidance, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning beyond the schema: it clarifies that autoRotate's default keeps the call read-only and that enabling it is destructive on the upstream side, reinforcing the schema's own note. projectPaths defaults are already documented in the schema, so the gain is modest.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('multi-project health pass' gathering decay status, audit anomalies, manifest gaps) with an explicit optional mutation mode. It names the sibling tools it is not (health_check, detect_anomalies, check_project) and the scoping difference, so an agent can distinguish it without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames itself as the canonical 'agent maintenance loop' for a portfolio of repos, then routes the agent to three alternatives with the condition that selects each ('single read-only scope', 'audit-only triage', 'single-project manifest check'). When-to-use and when-to-use-something-else are both covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.