Skip to main content
Glama

code_quality_scan

Read-only

Scan local Python, JS/TS, Java, Go and PHP code for bugs, vulnerabilities, secrets, and code smells without SonarQube, returning issue counts, complexity, tech debt, and A–E ratings.

Instructions

本地 Bug 与代码质量扫描(无需 SonarQube):Python、JS/TS、React、Vue、Svelte、Java、Kotlin、Go、C#、PHP, 外加 Spring/.NET 配置里写死的密码和 MyBatis ${} 拼接;给出 Bug、漏洞、安全热点、异味、复杂度、重复、技术债和 A–E 评级。 use_linters:合并已装的 ruff、项目里的 ESLint(会加载项目的 ESLint 配置)、go vet。max_issues:简版列出的重要问题条数。detail:列出全部问题。

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "path": "<path>"
    },
    "name": "code_quality_scan"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathYes
detailNo
max_issuesNo
use_lintersNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.2.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description does not contradict them; it correctly frames the tool as analysis only. It adds real context beyond the annotations: the scan shells out to installed linters (ruff, project ESLint config, go vet) and reports a structured A–E grade across seven issue categories. Minor gaps remain (no mention of scan duration, file writes, or exit behavior on unsupported languages).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information is front-loaded: capability and language coverage first, then parameters in a compact trailing block. It is dense but nearly every clause adds facts an agent needs; the sentence structure is slightly run-on because capability and parameter notes share one paragraph.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully summarizes the return payload (issue categories plus an A–E rating) and explains the mode parameters. It is nearly sufficient to call the tool correctly, with 'path' semantics and runtime/timeout expectations being the only notable omissions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden; it explains three of four parameters (use_linters merges ruff/ESLint/go vet and loads the project ESLint config, max_issues caps the brief listing, detail lists all issues), which is well beyond the bare types. The required 'path' parameter is left implicit — the agent must infer it is a directory or file path to scan.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete action (local bug and code-quality scan) and enumerates supported languages and the specific extra checks (hardcoded secrets in Spring/.NET config, MyBatis ${} concatenation). The parenthetical 'no SonarQube needed' plus the output list (bugs, vulnerabilities, hotspots, smells, complexity, duplication, tech debt, A–E rating) makes it clearly distinguishable from the sonar_* siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase '无需 SonarQube' implies the condition under which to prefer this over the sonar_* tools, but the choice is left to inference and the sibling full_quality_report is never mentioned. There is no explicit when-not guidance, e.g. whether this is a subset or a superset of full_quality_report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.