vulnerability-exposure-mcp

by MRFrazer25

Overview Schema Source Related Servers Discussions Admin

Python

Local

Check API keys

check_api_keys

Read-onlyIdempotent

Shows which data-source API keys are configured, never their values, and where to obtain missing ones.

Instructions

Shows which data-source API keys are configured (never their values) and where to get missing ones. Most lookups work without keys: NVD (just slower), CISA KEV, EPSS, OSV.dev, DNS, the registries, Spamhaus, GreyNoise, SANS ISC, certificate logs, and Shodan's free InternetDB in place of Shodan.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "check_api_keys"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Oct 25, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description adds important behavioral context: it never reveals key values, it reports where missing keys can be obtained, and it clarifies that many security lookups remain usable without keys. Those details directly affect how an agent should interpret and act on the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is two sentences and front-loads the core behavior: configured keys are shown, values are never exposed, and missing-key sources are provided. The second sentence is a compact list that earns its place by clarifying which lookups remain viable without keys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only diagnostic tool with rich annotations and no output schema, the description covers the essential behavior: what is shown, what is deliberately hidden, and how to address missing keys. Nothing critical for correct invocation or interpretation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is no parameter semantics burden. The baseline for a zero-parameter tool is 4, and the description appropriately does not invent parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it shows which data-source API keys are configured, without exposing their values, and indicates where to obtain missing ones. This clearly distinguishes the tool from the sibling lookup tools, which query security data sources rather than report configuration status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for use by explaining that most lookups work without keys and listing which sources fall into that category, including the NVD slowdown caveat and the Shodan InternetDB alternative. It does not explicitly state a 'use this before calling X' workflow, but the practical guidance is strong enough for an agent to know when key configuration matters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.