Skip to main content
Glama
Kyze-Labs

Damn Vulnerable MCP Server (DVMCP)

by Kyze-Labs

hr.search_employees

Search employees by name, department, or role to retrieve contact info and optionally sensitive fields like salary and SSN.

Instructions

Search the employee directory by name, department, or role. Returns employee details including contact info. Set include_sensitive=true to include salary, SSN, and bank details.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queryNoSearch query (name, email, or role)
departmentNoFilter by department
include_sensitiveNoInclude sensitive fields (salary, SSN, bank info). Default: true
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior. It mentions that include_sensitive=true includes salary, SSN, and bank details, which is important. However, it does not discuss access controls, data sensitivity risks, behavior when no results are returned, or the fact that include_sensitive defaults to true (which may be dangerous).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first states the primary purpose, the second adds essential detail about an optional parameter. No redundant information, front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with three parameters and no output schema, the description is adequate. It explains the main use case and the sensitive flag. However, it does not cover pagination, ordering, error handling, or performance, which would be helpful but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, so baseline is 3. The description adds value by explaining the effect of 'include_sensitive=true' and listing what sensitive fields are included, which is not fully captured in the schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the verb 'search', the resource 'employee directory', and the criteria ('by name, department, or role'). It also states the output ('employee details including contact info'). This distinguishes it from sibling tools like hr.review_candidate or hr.update_employee.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching employees but does not explicitly state when to use this tool versus other search tools or provide exclusions. It gives guidance on the include_sensitive parameter but lacks context on prerequisites or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Kyze-Labs/damn-vulnerable-MCP-Server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server