Skip to main content
Glama
Sign In
gmi-security-mcp

gmi-security-mcp

by Jayanng
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

list_rules

Retrieve the custom semgrep rules pack with rule IDs, categories, severities, descriptions, and default-enabled status, optionally filtered by category. No GMI call or spend.

Instructions

List the custom semgrep rules pack. No GMI call, no spend.

Returns each rule with id, name, category, severity, description, and whether it is enabled by default. category filters to one of the 7 known checks. The pack ships in src/gmi_security_mcp/rules/; set GMI_SECURITY_MCP_RULES_DIR when it is elsewhere.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "list_rules"
  }
}

Input Schema

NameRequiredDescriptionDefault
categoryNo

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.5.11

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses cost behavior (no GMI call/spend), that the data comes from a local pack directory, and that an env var (GMI_SECURITY_MCP_RULES_DIR) changes the source. It omits failure behavior if the pack directory is missing, which keeps it off a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded with the purpose and cost profile, then the return fields, then the filter and path configuration. No sentence is wasted, though the line breaks mid-sentence make it slightly harder to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so the return-field list is mostly reinforcement, but it helps confirm the listing shape. The description covers cost, data source, and configuration override, leaving only the missing enumeration of the 7 category values as a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single 'category' parameter has no schema description or enum. The description adds meaning by saying it filters to one of 7 known checks, but never enumerates those 7 values, so the agent still cannot construct an exact filter without guessing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ("List the custom semgrep rules pack") that is clearly distinct from the finding-oriented siblings like list_findings and get_finding. It does not explicitly name what it is not, but the resource scope is unambiguous enough to select it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The "No GMI call, no spend" line implies this is a cheap local lookup the agent can call freely, which is useful guidance. However there is no explicit when-to-use versus list_findings or triage_semgrep_finding, so the routing guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools