Skip to main content
Glama
L337-org

docker-mcp-server

by L337-org
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

scout_sbom

Read-only

Generate a Software Bill of Materials (SBOM) for a container image, supporting SPDX, CycloneDX, JSON, or list formats.

Instructions

Generate a Software Bill of Materials (SBOM) for an image.

Package inventory only - scout_cves adds vulnerability matching on top. SBOMs can be large; captured stdout is subject to MAX_CLI_OUTPUT_BYTES and may be truncated for big images. If that's a concern, run docker scout sbom -o file.json ... on the host and load the file separately. Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.

Args: format: "spdx" (default, SPDX JSON), "cyclonedx" (CycloneDX JSON), "json" (Scout's native JSON), or "list" (plain-text package list) platform: Platform of the image to analyze

Returns: dict: {"format", "result", "raw": }. result is a parsed dict when format is "spdx"/"cyclonedx"/"json" and stdout parses cleanly; for "list" or a parse failure it's the raw text.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
imageYes
formatNospdx
platformNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv2.2.5
    • addedInput schema / properties / format / enum
      Added value: +[
+  "list",
+  "json",
+  "spdx",
+  "cyclonedx"
+]
  2. First observedv1.9.0

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/destructiveHint annotations, the description discloses non-obvious behavior: captured stdout may be truncated by MAX_CLI_OUTPUT_BYTES, non-zero CLI exits do not raise (except missing plugin or timeout), and callers must inspect raw.stderr. It also explains the result parsing behavior. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: purpose, key caveats, args, and return value. Each sentence adds essential information, with no fluff. The most important scoping and truncation caveats come early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only CLI wrapper with no output schema, the description is complete: it specifies parameters, return shape, parsing behavior, error handling, and truncation risk. It names the relevant sibling (scout_cves) and provides a workaround for large outputs. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the burden. It adds useful semantics for format (explaining each enum value and the default) and platform ('Platform of the image to analyze'). The required image parameter is not explicitly documented in Args, though it is self-evident from 'for an image.' Minor gap, otherwise strong.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Generate a Software Bill of Materials (SBOM) for an image.' It then clarifies scope ('Package inventory only') and explicitly differentiates from sibling scout_cves, which does vulnerability matching. This makes the tool's purpose immediately distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the intended use (package inventory) and names the alternative for vulnerability matching (scout_cves). It also provides operational guidance: when large SBOMs risk truncation, run the command on the host with -o file.json and load separately. This is explicit when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools