Skip to main content
Glama
Sim-xia

Blind-Auditor-MCP

submit_draft

Submit code drafts for automated security and quality audits using prompt injection and context isolation techniques.

Instructions

Submit a code draft for audit.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
codeYes
languageNopython

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Implementation Reference

  • The core handler function for the 'submit_draft' tool. It is registered via the @mcp.tool() decorator. This function processes submitted code drafts, updates session state, checks retry limits, generates audit prompts with rules, and handles limit exceeded cases by producing detailed reports.
    @mcp.tool()
    def submit_draft(code: str, language: str = "python") -> str:
        """Submit a code draft for audit."""
        print(f"DEBUG: submit_draft called with code length={len(code)}", file=sys.stderr)
        session.current_code = code
        session.status = "AUDITING"
        
        max_retries = rules_loader.get_max_retries()
        
        # CHANGED: Generate detailed report instead of auto-approving
        if session.retry_count >= max_retries:
            session.status = "LIMIT_EXCEEDED"
            return _generate_detailed_report(session.audit_history, code, language, max_retries)
        
        rules_formatted = rules_loader.format_rules_for_prompt()
        
        return f"""🛑 **[SYSTEM INTERVENTION: CONTEXT ISOLATION MODE]**
    
    **STOP GENERATING**. Do not output the code yet.
    
    You are now entering the **Blind Audit Phase**.
    
    **Rulebook:**
    {rules_formatted}
    
    **Candidate Code:**
    ```{language}
    {code}
    ```
    
    **Instructions:**
    1. **Analyze Step-by-Step (CoT)**:
       - First, list all violations found.
       - Classify each violation by severity (CRITICAL, WARNING, PREFERENCE).
       - Calculate the deduction for each violation.
    
    2. **Scoring Rubric (Strict Enforcement)**:
       - **Start Score**: 100
       - **CRITICAL Violation**: -50 points each (Immediate FAIL)
       - **WARNING Violation**: -15 points each
       - **PREFERENCE Violation**: -5 points each
       - **Maximum Deduction**: 100 points (Minimum Score: 0)
    
    3. **Final Decision**:
       - Call `submit_audit_result` with your findings.
       - **CRITICAL**: If score is < 80, you MUST set passed=False.
       - The system will enforce `score >= 80` to pass.
    """
  • src/main.py:138-138 (registration)
    The @mcp.tool() decorator registers the 'submit_draft' function as an MCP tool.
    @mcp.tool()
  • The function signature defines the input schema (code: str, language: str='python') and output (str), along with the tool description.
    def submit_draft(code: str, language: str = "python") -> str:
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'submit' implying a write operation, but fails to describe key traits like whether this requires authentication, what happens after submission (e.g., triggers an audit process), or any rate limits. This leaves significant gaps in understanding the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words, making it easy to parse. It is appropriately sized for a simple tool, though this conciseness comes at the cost of missing details in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema, the description doesn't need to explain return values. However, with no annotations, 2 parameters (0% schema coverage), and a mutation implied by 'submit', the description is incomplete—it lacks behavioral context and parameter details, making it only minimally adequate for a basic submission tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for undocumented parameters. It does not explain the 'code' or 'language' parameters beyond what the schema provides (e.g., what format 'code' should be in, what 'language' options exist beyond the default 'python'). This adds minimal value, failing to address the coverage gap adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('submit') and resource ('code draft for audit'), making the purpose understandable. However, it doesn't differentiate this tool from sibling tools like 'submit_audit_result' or 'update_rules', which also involve submission or updating processes in the audit context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'submit_audit_result' or 'update_rules'. It lacks context about prerequisites, such as whether a draft must be prepared first or if this is part of a workflow, leaving usage ambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Sim-xia/Blind-Audition-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server