Skip to main content
Glama
Sign In
Lex6won

vibecode-checker

by Lex6won
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

scan_code

Checks pasted or in-memory code snippets against public-sector security rules, flagging secrets, personal data, SQL injection, unsafe execution, and LLM risks with fixes.

Instructions

코드 조각을 공공기관 보안 기준으로 점검(보안·검토·체크·검사)합니다.

사용자가 메모리에 있는 코드(붙여넣은 스니펫, 방금 생성한 코드)가 "안전한지", 개인정보·시크릿·SQL 삽입·위험한 코드 실행·LLM 위험이 있는지 묻거나, "보안 점검/검토/체크"를 요청하면 이 도구를 사용하세요. 파일·폴더 경로라면 대신 scan_path 를 씁니다.

코드를 외부 API로 보내지 않습니다. 시크릿·개인정보는 마스킹된 짧은 증거만 반환하며, 각 발견 사항에 why_it_matters(왜 위험한가)와 safe_fix(안전한 수정 방향)가 함께 담깁니다.

Input Schema

NameRequiredDescriptionDefault
codeYes검사할 소스 코드 전문(파일이 아닌 텍스트). 파일·폴더는 scan_path 사용
callerNo호출 주체 자율 신고 (예: 'harness:auto'). 감사 구분용
profileNo정책 프로파일 ID. 값: public-default-strict(기본·엄격) | civil-complaint-chatbot | internal-db-query | web-civil-servicepublic-default-strict
filenameNo표시용 파일명. 확장자로 언어를 추정하므로 알면 넣기 (예: app.py)<memory>
languageNo언어 강제 지정 (예: python, javascript). 미지정 시 확장자·내용으로 추정
scenarioNo용도 힌트 — 해당 시나리오 룰을 우선 적용. 값: web-app | data-pipeline | llm-integration | agent

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changedv0.5.4
    • addedInput schema / properties / caller
      Added value: +{
+  "anyOf": [
+    {
+      "type": "string"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "description": "호출 주체 자율 신고 (예: 'harness:auto'). 감사 구분용"
+}
    • addedInput schema / properties / code / description
      Added value: +"검사할 소스 코드 전문(파일이 아닌 텍스트). 파일·폴더는 scan_path 사용"
    • addedInput schema / properties / filename / description
      Added value: +"표시용 파일명. 확장자로 언어를 추정하므로 알면 넣기 (예: app.py)"
    • addedInput schema / properties / language / description
      Added value: +"언어 강제 지정 (예: python, javascript). 미지정 시 확장자·내용으로 추정"
    • addedInput schema / properties / profile / description
      Added value: +"정책 프로파일 ID. 값: public-default-strict(기본·엄격) | civil-complaint-chatbot | internal-db-query | web-civil-service"
    • addedInput schema / properties / scenario / description
      Added value: +"용도 힌트 — 해당 시나리오 룰을 우선 적용. 값: web-app | data-pipeline | llm-integration | agent"
  2. First observedv0.1.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does add real behavioral context: code is never sent to an external API, secrets/PII are returned only as masked short evidence, and each finding carries why_it_matters and safe_fix. It still omits permissions, determinism, or cost/rate characteristics, so it is strong but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads purpose, then usage triggers, then behavioral guarantees in three short paragraphs, each earning its place. Slightly verbose in listing synonyms (보안·검토·체크·검사), but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter tool with no annotations but a present output schema, the description covers purpose, the key sibling alternative, and privacy/output behavior adequately; return-value structure can be deferred to the output schema. Minor gaps remain around the profile/scenario parameters' effect, but nothing essential to correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters including the file-vs-text distinction for `code`. The description's reinforcement of 'in-memory code, not a path' duplicates what the schema states rather than adding syntax or format detail, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (inspects code snippets against public-institution security standards) and enumerates the risk classes covered (PII, secrets, SQL injection, dangerous execution, LLM risk). It explicitly names the sibling it is not (scan_path) for path inputs, so an agent can route without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit triggers (user asks whether in-memory/pasted/generated code is 'safe' or requests a security check/review) and an explicit exclusion plus alternative ('if it's a file/folder path, use scan_path instead'). The when/when-not split is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools