gmi-security-mcp

Overview Schema Source Related Servers Discussions Admin

explain_cve

Explains CVE, GHSA, or OSV IDs from OSV advisories with citations, returns found=false when no exact advisory exists, and avoids unsupported details.

Instructions

Explain a CVE, GHSA, or OSV id from its advisory, with citations.

Fetches the advisory from OSV by exact id. When no advisory with that id exists, returns found false and invents nothing. When a model is named, GMI writes one plain-language paragraph from the retrieved advisory only. When no model is named, the explanation is the advisory summary itself.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "advisory_id": "<advisory_id>"
    },
    "name": "explain_cve"
  }
}

Input Schema

Name	Required	Description	Default
`package`	No
`version`	No
`max_tokens`	No
`advisory_id`	Yes
`stage1_model`	No
`spend_cap_usd`	No

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.3.0Nov 10, 2026

TDQS

A3.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden well: it discloses that a miss returns found false with no invention, and that any generated paragraph is grounded strictly in the retrieved advisory. It leaves unstated what happens when spend_cap_usd is exceeded or whether the call is network-bound/billed, which an agent invoking an LLM-backed tool needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the purpose, then three clean conditional behaviors. No filler, though the line breaks make it read as fragments rather than a compact paragraph.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-shape explanation is rightly omitted, and the fallback/grounding behavior is covered. What's missing is cost and cap semantics for an LLM-backed, 6-parameter tool whose remaining parameters are entirely undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, and the description only implicitly touches advisory_id and stage1_model. package, version, max_tokens, and spend_cap_usd receive no explanation anywhere, so an agent must guess at their semantics and cost implications.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb (explain) and resource (CVE/GHSA/OSV id) and states the output form (from its advisory, with citations). It is distinguishable from a raw lookup, though it never explicitly contrasts itself with check_osv_advisory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives useful conditional guidance for model-vs-no-model and for a missing advisory, but never says when to pick this over check_osv_advisory or estimate_cost, and doesn't say when a CVE should be triaged instead of explained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server