gmi-security-mcp

Overview Schema Source Related Servers Discussions Admin

triage_semgrep_finding

Triage a single Semgrep or scanner finding with GMI Inference to get a validated verdict, severity, confidence, reason, and fix, with estimated and actual cost.

Instructions

Triage one semgrep or scanner finding with GMI Inference.

Returns one validated finding as JSON: verdict, severity, confidence, reason, fix, stage used, latency, tokens, cost, and the estimate made before the call. An unparsed reply returns verdict null and unparsed true. It never returns clean. The verdict is stored in the findings store (per-user ~/.gmi-security-mcp/findings.db by default) and the result carries finding_id. An explicit db_path is allowed, with a warning that the caller is responsible for not committing it.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "finding": "<finding>",
      "code": "<code>"
    },
    "name": "triage_semgrep_finding"
  }
}

Input Schema

Name	Required	Description	Default
`code`	Yes
`file`	No
`line`	No
`check`	No
`db_path`	No
`finding`	Yes
`threshold`	No
`two_stage`	No
`max_tokens`	No
`stage1_model`	No
`stage2_model`	No
`spend_cap_usd`	No

Output Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.5.11Nov 12, 2026

addedInput schema / properties / db_path

Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Db Path"
+}

First observedv0.3.0Nov 10, 2026

TDQS

B3.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses the persisted side effect (verdict written to ~/.gmi-security-mcp/findings.db), the returned finding_id, the unparsed-reply fallback (verdict null, unparsed true), the 'never returns clean' invariant, and the db_path warning about caller responsibility. Gaps remain around whether an external inference call is billed, what auth/config it needs, and any rate or latency expectations beyond the reported fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead sentence front-loads purpose, and each subsequent sentence adds a distinct fact (return fields, fallback behavior, persistence, db_path caveat). It is somewhat dense but no sentence is pure filler, though the return-field enumeration partly duplicates the output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the enumerated return fields are not strictly needed, while genuinely important unknowns remain for a complex 12-parameter, LLM-backed, side-effecting tool: the shape of the required 'finding' input, what 'code' should contain, threshold and spend_cap semantics, and how it relates to verify_finding. Adequate but with material gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% across 12 parameters, so the description must compensate and largely does not. It explains db_path and gestures at two-stage behavior via 'stage used' and at pre-call cost via 'the estimate made before the call', but finding, code, file, line, check, threshold, two_stage, max_tokens, stage1_model, stage2_model, and spend_cap_usd are all left undefined, including the required 'finding' string format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Triage one semgrep or scanner finding with GMI Inference.' That is clearly distinct from siblings like get_finding or verify_finding, but the description never explicitly contrasts itself with them, so the agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not guidance, and no alternative is named. The only implicit signal is 'one ... finding', which implies single-item scope, but nothing tells the agent whether to triage here versus verify_finding or mark_confirmed, nor what prerequisites exist before calling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server