Skip to main content
Glama
Sabastiaz

tenable-vpr-mcp

by Sabastiaz

scan_delta

Identify vulnerabilities fixed, still open, or new since baseline by comparing two scans, and calculate remediation rate for retest reporting.

Instructions

Compare a baseline scan against a re-test scan by plugin ID and return three buckets: fixed (present in baseline, gone in re-test), still_open (present in both), and new_since_baseline. Includes a remediation-rate percentage. Built for pentest/assessment re-test reporting where a client needs proof of what got remediated between engagement rounds.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
retest_scan_idYes
baseline_scan_idYes

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It details the three output buckets (fixed, still_open, new_since_baseline), the remediation-rate percentage, and the plugin-ID-based comparison logic. It does not explicitly state read-only status or error handling, but the comparative verb and output-driven tone imply no side effects and give the agent a solid mental model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, with no filler. It front-loads the primary action and expected result, then adds a single context sentence that explains the tool's purpose. Every clause earns its place, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, input roles, and a high-level summary of the return buckets. Since an output schema exists, there is no need to detail the return structure further. It could mention prerequisites or failure modes, but for a simple two-parameter comparison tool, the provided context is practical and complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It references 'baseline scan' and 're-test scan,' which map directly to baseline_scan_id and retest_scan_id, clarifying their roles in the comparison. For only two self-explanatory integer parameters, this level of semantic context is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific verb 'Compare' and clearly identifies the resources (baseline scan vs. re-test scan) and the comparison dimension (by plugin ID). It distinguishes itself from sibling tools like compare_vpr_reprioritization by focusing on plugin-level delta and remediation reporting, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear, context-rich use case: 'Built for pentest/assessment re-test reporting where a client needs proof of what got remediated between engagement rounds.' This implies when to use the tool but does not explicitly mention alternative tools or state when not to use it, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Sabastiaz/tenable-vpr-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server