Skip to main content
Glama
Sign In
CodeInspectus

CodeInspectus

by Synvoya
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Explain a finding in depth

codeinspectus_explain_finding
Read-onlyIdempotent

Explains a single finding from a prior scan, covering the weakness, why it matters, concrete remediation steps, and references.

Instructions

Return a deep explanation and full remediation plan for a single finding id from a prior scan: what the weakness is, why it matters, concrete fix steps, and references.

Input Schema

NameRequiredDescriptionDefault
scan_idYesscan_id the finding belongs to.
finding_idYesThe finding id (e.g. CI-0007) to explain in depth.

Output Schema

NameRequiredDescriptionDefault
findingYes
referencesYes
explanationYes
remediationYes
why_it_mattersYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv4.0.0
    • changedOutput schema / properties / finding / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai",
-  "codeinspectus-pub"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "osv-scanner",
+  "codeinspectus-ai",
+  "codeinspectus-pub",
+  "synvoya"
+]
    • addedOutput schema / properties / finding / properties / engine_family
      Added value: +{
+  "enum": [
+    "synvoya"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / finding / properties / package
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "ecosystem": {
+      "type": "string"
+    },
+    "name": {
+      "type": "string"
+    },
+    "version": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "ecosystem",
+    "name",
+    "version"
+  ],
+  "type": "object"
+}
  2. Changed6 schema fields changedv2.5.0
    • changedOutput schema / properties / finding / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "codeinspectus-ai",
+  "codeinspectus-pub"
+]
    • addedOutput schema / properties / finding / properties / finding_kind
      Added value: +{
+  "enum": [
+    "vulnerability",
+    "license",
+    "misconfiguration",
+    "secret",
+    "sast",
+    "ai",
+    "other"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / finding / properties / owasp_api
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / finding / properties / producer_components
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / finding / properties / scope_role
      Added value: +{
+  "enum": [
+    "primary",
+    "supporting_context"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / finding / properties / vulnerability_aliases
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
  3. Changed1 schema field changedv0.3.0
    • addedInput schema / properties / scan_id / pattern
      Added value: +"^scan-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
  4. First observedv0.2.1

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is fully covered. The description adds what the explanation contains (weakness, importance, fix steps, references), but does not disclose operational behavior such as error handling or limits beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. The list after the colon efficiently enumerates the returned explanation components.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two required parameters, full schema coverage, rich annotations, and an output schema present, the description supplies enough context to select and call the tool correctly. It could mention behavior when a finding id is invalid, but that is a minor omission for a read-only explanation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both scan_id and finding_id are already documented in the schema. The description adds only the contextual notion that the finding belongs to a prior scan and that the id identifies a single finding, which is baseline support rather than new meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ("Return a deep explanation and full remediation plan") and a clear resource ("a single finding id from a prior scan"). It does not explicitly name or contrast sibling tools, but the purpose is unmistakable and distinct from scanning, reporting, and cleanup siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "from a prior scan" establishes the prerequisite context for use, making it clear this is a follow-up explanation tool. It does not name alternatives or exclusions, but the usage context is clear and sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools