Skip to main content
Glama

Explain a specific finding and how to fix it

explain_finding
Read-only

Identify why a security rule fired and receive actionable remediation steps to resolve the vulnerability.

Instructions

Given a ruleId (and optionally the finding's path + preview), returns the reasoning ('why this matters') and a concrete remediation you can turn into a code change or an instruction to the user.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathNoThe file path where the finding fired. Optional, used for context in the response.
ruleIdYesThe rule id from a scan finding, e.g. 'stripe-secret-live'.
previewNoThe masked preview from the finding. Optional, used verbatim in the response.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations mark this as read-only and not open-world, so the bar is lower. The description adds useful behavioral detail by specifying that the output includes reasoning and remediation, and that the result can be turned into a code change or instruction. It does not contradict the annotations and offers more behavioral context than the minimal read-only hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single well-structured sentence. It front-loads the required input (ruleId), notes optional parameters, and states the two-part output. No filler or redundant phrasing; every clause contributes to understanding how to use the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with three parameters and no output schema, the description covers the main call details: required and optional inputs, and the nature of the return value. It does not address invalid ruleId behavior or how to choose between explain_finding and explain_rule, but these are relatively minor gaps given the tool's simple purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The tool description only mentions that path and preview are optional, which is already fully documented in the schema. It does not add semantic meaning beyond what the parameter descriptions provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action: given a ruleId, it returns reasoning and a concrete remediation. This is specific and understandable, but it does not explicitly differentiate from the sibling explain_rule, which likely covers general rule explanations. The title adds the 'specific finding' framing, but the description itself could be clearer about the distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used after a scan produces a finding, since it asks for a ruleId and optionally the finding's path and preview. However, it does not explicitly state when to prefer this tool over explain_rule or any other sibling, nor does it mention when not to use it. Usage guidance is present but remains implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.