Skip to main content
Glama
Synvoya

CodeInspectus

by Synvoya
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Local

Scan code for security issues

codeinspectus_scan
Read-onlyIdempotent

Scan any repository locally for security vulnerabilities, secrets, misconfigurations, and AI-code risks. Returns CWE-keyed findings with fixes and compliance tags—offline, no code writes.

Instructions

Run a full local security scan of a path: managed engines (Opengrep SAST, Gitleaks secrets, Trivy SCA/IaC/license), CodeInspectus's offline native Pub SCA, plus AI-code-specific checks (client-side secret exposure, Supabase RLS/inverted-auth, prompt-injection sinks, API-boundary failures, and explicit runtime-control misconfiguration). Returns CWE-keyed findings with fix recommendations, detected repository technologies, explicit native-pack execution counts, compliance tags, and three-state repository evidence for supported runtime controls. Also returns the V3 repository-trust contract with deterministic V3.1 source-integrity evidence for bidi controls, hidden/default-ignorable characters, Unicode tag and variation-selector payloads, and bounded mixed-script confusables. AI attribution, C2PA and statistical-watermark capabilities remain explicitly unavailable. Fully offline — zero network egress at scan time. Never writes to your code or repo.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the repository or directory to scan.
scannersNoLimit which scanner classes run: sast, secret, vuln, misconfig, license, ai. Default: all.
max_findingsNoCap the number of findings returned to protect agent context (default: 200).
include_complianceNoInclude the per-framework compliance overview in the result (default: true).
severity_thresholdNoOnly return findings at or above this severity (default: info — all).

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetYes
offlineYes
scan_idYes
summaryYes
findingsYes
warningsYes
git_scopeNo
truncatedYes
disclaimerYes
git_safetyYes
started_atYes
duration_msYes
engines_runYes
scan_configNo
engine_setupNo
pack_coverageYes
trivy_db_dateNo
engine_detailsYes
repository_rootNo
secret_coverageNo
history_revisionNo
repository_trustYes
secret_suppressionNo
compliance_overviewNo
dependency_coverageNo
trivy_db_provenanceNo
component_signaturesNo
detected_technologiesYes
security_control_evidenceNo
total_findings_before_limitYes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed2 schema fields changedv3.1.0
    • addedOutput schema / properties / repository_trust
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "artifacts": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "artifact_id": {
+            "pattern": "^artifact-[a-z0-9][a-z0-9._:-]{0,127}$",
+            "type": "string"
+          },
+          "confidence": {
+            "enum": [
+              "high",
+              "medium",
+              "low",
+              "none"
+            ],
+            "type": "string"
+          },
+          "evidence": {
+            "additionalProperties": false,
+            "properties": {
+              "attributes": {
+                "items": {
+                  "additionalProperties": false,
+                  "properties": {
+                    "name": {
+                      "minLength": 1,
+                      "type": "string"
+                    },
+                    "redacted": {
+                      "type": "boolean"
+                    },
+                    "value": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "number"
+                        },
+                        {
+                          "type": "boolean"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "value"
+                  ],
+                  "type": "object"
+                },
+                "maxItems": 128,
+                "type": "array"
+              },
+              "summary": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "summary",
+              "attributes"
+            ],
+            "type": "object"
+          },
+          "fingerprint": {
+            "pattern": "^sha256:[0-9a-f]{64}$",
+            "type": "string"
+          },
+          "kind": {
+            "$ref": "#/properties/repository_trust/properties/coverage/properties/capabilities/items/properties/capability"
+          },
+          "limitations": {
+            "items": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "location": {
+            "additionalProperties": false,
+            "properties": {
+              "end_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "end_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "field": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "file": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "start_column": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              },
+              "start_line": {
+                "exclusiveMinimum": 0,
+                "type": "integer"
+              }
+            },
+            "required": [
+              "file"
+            ],
+            "type": "object"
+          },
+          "marker_class": {
+            "pattern": "^[a-z][a-z0-9_]{0,127}$",
+            "type": "string"
+          },
+          "remediation": {
+            "additionalProperties": false,
+            "properties": {
+              "eligible": {
+                "type": "boolean"
+              },
+              "protected_record": {
+                "type": "boolean"
+              },
+              "reason": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "requires_approval": {
+                "const": true,
+                "type": "boolean"
+              },
+              "reversible": {
+                "type": "boolean"
+              }
+            },
+            "required": [
+              "eligible",
+              "requires_approval",
+              "reversible",
+              "protected_record",
+              "reason"
+            ],
+            "type": "object"
+          },
+          "state": {
+            "enum": [
+              "verified",
+              "probable",
+              "informational",
+              "not_verifiable"
+            ],
+            "type": "string"
+          },
+          "validator": {
+            "additionalProperties": false,
+            "properties": {
+              "authoritative": {
+                "type": "boolean"
+              },
+              "egress": {
+                "enum": [
+                  "none",
+                  "optional",
+                  "required"
+                ],
+                "type": "string"
+              },
+              "id": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "independently_verifiable": {
+                "type": "boolean"
+              },
+              "method": {
+                "enum": [
+                  "deterministic",
+                  "declarative",
+                  "statistical"
+                ],
+                "type": "string"
+              },
+              "version": {
+                "minLength": 1,
+                "type": "string"
+              }
+            },
+            "required": [
+              "id",
+              "method",
+              "authoritative",
+              "independently_verifiable",
+              "egress"
+            ],
+            "type": "object"
+          }
+        },
+        "required": [
+          "artifact_id",
+          "fingerprint",
+          "kind",
+          "state",
+          "marker_class",
+          "location",
+          "evidence",
+          "validator",
+          "confidence",
+          "limitations",
+          "remediation"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "coverage": {
+      "additionalProperties": false,
+      "properties": {
+        "capabilities": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "capability": {
+                "enum": [
+                  "source_integrity",
+                  "explicit_ai_attribution",
+                  "content_provenance",
+                  "statistical_watermark"
+                ],
+                "type": "string"
+              },
+              "limitations": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              "state": {
+                "$ref": "#/properties/repository_trust/properties/coverage/properties/state"
+              },
+              "validators": {
+                "items": {
+                  "minLength": 1,
+                  "type": "string"
+                },
+                "type": "array"
+              }
+            },
+            "required": [
+              "capability",
+              "state",
+              "validators",
+              "limitations"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "limitations": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "state": {
+          "enum": [
+            "ran",
+            "partial",
+            "not_run",
+            "not_applicable",
+            "unavailable"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state",
+        "capabilities",
+        "limitations"
+      ],
+      "type": "object"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "summary": {
+      "additionalProperties": false,
+      "properties": {
+        "informational": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "not_verifiable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "probable": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "total": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "verified": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "verified",
+        "probable",
+        "informational",
+        "not_verifiable",
+        "total"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "schema_version",
+    "coverage",
+    "summary",
+    "artifacts"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "detected_technologies",
-  "pack_coverage",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "repository_trust",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  2. Changed19 schema fields changedv2.5.0
    • addedOutput schema / properties / component_signatures
      Added value: +{
+  "additionalProperties": {
+    "type": "string"
+  },
+  "type": "object"
+}
    • addedOutput schema / properties / dependency_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "database_checked_at": {
+        "type": "string"
+      },
+      "database_version": {
+        "type": "string"
+      },
+      "ecosystem": {
+        "const": "Pub",
+        "type": "string"
+      },
+      "engine": {
+        "const": "codeinspectus-pub",
+        "type": "string"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "lockfiles": {
+        "additionalProperties": false,
+        "properties": {
+          "analyzed": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "discovered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "discovered",
+          "analyzed"
+        ],
+        "type": "object"
+      },
+      "matching": {
+        "const": "exact-enumerated-versions",
+        "type": "string"
+      },
+      "note": {
+        "type": "string"
+      },
+      "packages": {
+        "additionalProperties": false,
+        "properties": {
+          "eligible": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "resolved": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "skipped": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "resolved",
+          "eligible",
+          "skipped"
+        ],
+        "type": "object"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "ecosystem",
+      "engine",
+      "state",
+      "lockfiles",
+      "packages",
+      "matching",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / detected_technologies
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "confidence": {
+        "enum": [
+          "high",
+          "medium"
+        ],
+        "type": "string"
+      },
+      "evidence": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "id": {
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "language",
+          "framework",
+          "platform"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "kind",
+      "confidence",
+      "evidence"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • changedOutput schema / properties / engine_details / items / properties / engine / enum
      Previous value: -[
-  "opengrep",
-  "gitleaks",
-  "trivy",
-  "codeinspectus-ai"
-]New value: +[
+  "opengrep",
+  "gitleaks",
+  "trivy",
+  "codeinspectus-ai",
+  "codeinspectus-pub"
+]
    • addedOutput schema / properties / engine_setup
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "engines": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "detail": {
+            "type": "string"
+          },
+          "engine": {
+            "enum": [
+              "opengrep",
+              "gitleaks",
+              "trivy"
+            ],
+            "type": "string"
+          },
+          "state": {
+            "enum": [
+              "ready",
+              "missing",
+              "hash_mismatch",
+              "unpinned",
+              "lockfile_error",
+              "unsupported_platform"
+            ],
+            "type": "string"
+          },
+          "version": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "engine",
+          "version",
+          "state"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "network_required": {
+      "type": "boolean"
+    },
+    "platform": {
+      "type": "string"
+    },
+    "repair_command": {
+      "type": "string"
+    },
+    "state": {
+      "enum": [
+        "ready",
+        "repair_required",
+        "db_refresh_recommended",
+        "unsupported_platform"
+      ],
+      "type": "string"
+    },
+    "trivy_db": {
+      "additionalProperties": false,
+      "properties": {
+        "downloaded_at": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "ready",
+            "missing",
+            "provenance_missing",
+            "stale"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "state"
+      ],
+      "type": "object"
+    }
+  },
+  "required": [
+    "state",
+    "platform",
+    "engines",
+    "trivy_db",
+    "network_required"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / findings / items / properties / finding_kind
      Added value: +{
+  "enum": [
+    "vulnerability",
+    "license",
+    "misconfiguration",
+    "secret",
+    "sast",
+    "ai",
+    "other"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / owasp_api
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / producer_components
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / findings / items / properties / scope_role
      Added value: +{
+  "enum": [
+    "primary",
+    "supporting_context"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / findings / items / properties / vulnerability_aliases
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / git_scope
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "base": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "entries": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "binary": {
+            "type": "boolean"
+          },
+          "generated": {
+            "type": "boolean"
+          },
+          "inspected": {
+            "type": "boolean"
+          },
+          "note": {
+            "type": "string"
+          },
+          "old_path": {
+            "type": "string"
+          },
+          "path": {
+            "type": "string"
+          },
+          "status": {
+            "enum": [
+              "added",
+              "modified",
+              "deleted",
+              "renamed",
+              "untracked",
+              "ignored"
+            ],
+            "type": "string"
+          },
+          "submodule": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "status",
+          "path",
+          "binary",
+          "generated",
+          "submodule",
+          "inspected"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "head": {
+      "additionalProperties": false,
+      "properties": {
+        "commit": {
+          "pattern": "^[0-9a-f]{40,64}$",
+          "type": "string"
+        },
+        "requested": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "requested",
+        "commit"
+      ],
+      "type": "object"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "mode": {
+      "enum": [
+        "commit_diff",
+        "working_tree"
+      ],
+      "type": "string"
+    },
+    "primary_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "primary_paths": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "supporting_context_finding_count": {
+      "minimum": 0,
+      "type": "integer"
+    },
+    "supporting_context_scanned": {
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "schema_version",
+    "mode",
+    "repository",
+    "base",
+    "entries",
+    "primary_paths",
+    "supporting_context_scanned",
+    "primary_finding_count",
+    "supporting_context_finding_count",
+    "completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / history_revision
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "commit": {
+      "pattern": "^[0-9a-f]{40,64}$",
+      "type": "string"
+    },
+    "committer_at": {
+      "format": "date-time",
+      "type": "string"
+    },
+    "limitations": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "schema_version": {
+      "const": "1.0.0",
+      "type": "string"
+    },
+    "snapshot_completeness": {
+      "enum": [
+        "complete",
+        "partial"
+      ],
+      "type": "string"
+    },
+    "temporal_scope": {
+      "enum": [
+        "historical",
+        "selected_head"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "schema_version",
+    "repository",
+    "commit",
+    "committer_at",
+    "temporal_scope",
+    "snapshot_completeness",
+    "limitations"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / pack_coverage
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "analyzers": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "frameworks": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "languages": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "limitations": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "note": {
+        "type": "string"
+      },
+      "pack_id": {
+        "type": "string"
+      },
+      "platforms": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "rules": {
+        "additionalProperties": false,
+        "properties": {
+          "ran": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "registered": {
+            "minimum": 0,
+            "type": "integer"
+          }
+        },
+        "required": [
+          "registered",
+          "ran"
+        ],
+        "type": "object"
+      },
+      "scanner_kind": {
+        "default": "ai",
+        "enum": [
+          "ai",
+          "sast"
+        ],
+        "type": "string"
+      },
+      "state": {
+        "enum": [
+          "ran",
+          "partial",
+          "not_run",
+          "not_applicable",
+          "unavailable"
+        ],
+        "type": "string"
+      },
+      "version": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "pack_id",
+      "version",
+      "state",
+      "languages",
+      "frameworks",
+      "platforms",
+      "analyzers",
+      "rules",
+      "limitations"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / repository_root
      Added value: +{
+  "type": "string"
+}
    • addedOutput schema / properties / secret_coverage
      Added value: +{
+  "enum": [
+    "verified",
+    "unverified"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / secret_suppression
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "channels": {
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "channel": {
+            "enum": [
+              "target_config",
+              "gitleaks_ignore",
+              "inline_allow"
+            ],
+            "type": "string"
+          },
+          "count": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "handling": {
+            "enum": [
+              "ignored_by_codeinspectus",
+              "coverage_unverified"
+            ],
+            "type": "string"
+          },
+          "paths": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "channel",
+          "count",
+          "paths",
+          "handling"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "channels"
+  ],
+  "type": "object"
+}
    • addedOutput schema / properties / security_control_evidence
      Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "control_id": {
+        "type": "string"
+      },
+      "evidence_locations": {
+        "items": {
+          "additionalProperties": false,
+          "properties": {
+            "end_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            },
+            "file": {
+              "type": "string"
+            },
+            "start_line": {
+              "exclusiveMinimum": 0,
+              "type": "integer"
+            }
+          },
+          "required": [
+            "file",
+            "start_line",
+            "end_line"
+          ],
+          "type": "object"
+        },
+        "type": "array"
+      },
+      "limitation": {
+        "type": "string"
+      },
+      "providers": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      },
+      "state": {
+        "enum": [
+          "verified_in_repository",
+          "insecure_configuration_found",
+          "not_verifiable_from_repository"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "control_id",
+      "state",
+      "providers",
+      "evidence_locations",
+      "limitation"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / trivy_db_provenance
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "instruction": {
+      "type": "string"
+    },
+    "state": {
+      "const": "unrecorded",
+      "type": "string"
+    }
+  },
+  "required": [
+    "state",
+    "instruction"
+  ],
+  "type": "object"
+}
    • changedOutput schema / required
      Previous value: -[
-  "scan_id",
-  "target",
-  "started_at",
-  "duration_ms",
-  "engines_run",
-  "engine_details",
-  "offline",
-  "summary",
-  "findings",
-  "truncated",
-  "total_findings_before_limit",
-  "disclaimer",
-  "warnings",
-  "git_safety"
-]New value: +[
+  "scan_id",
+  "target",
+  "started_at",
+  "duration_ms",
+  "engines_run",
+  "engine_details",
+  "offline",
+  "detected_technologies",
+  "pack_coverage",
+  "summary",
+  "findings",
+  "truncated",
+  "total_findings_before_limit",
+  "disclaimer",
+  "warnings",
+  "git_safety"
+]
  3. Changed1 schema field changedv0.3.0
    • addedOutput schema / properties / scan_config
      Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "max_findings": {
+      "type": "integer"
+    },
+    "scanners": {
+      "items": {
+        "enum": [
+          "sast",
+          "secret",
+          "vuln",
+          "misconfig",
+          "license",
+          "ai"
+        ],
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "severity_threshold": {
+      "$ref": "#/properties/findings/items/properties/severity"
+    }
+  },
+  "required": [
+    "max_findings"
+  ],
+  "type": "object"
+}
  4. First observedv0.2.1

TDQS

A3.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior, and the description adds concrete guarantees: 'Fully offline — zero network egress at scan time' and 'Never writes to your code or repo.' It also explicitly discloses unavailable capabilities such as AI attribution, C2PA, and statistical-watermark support, which is valuable beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary action and then organized into scope, return types, limitations, and safety guarantees. It is dense and long, but the complexity of the tool justifies most of the detail. The V3 trust-contract sentence is somewhat specialized and could be trimmed, but overall every major block earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool, the description covers the scan scope, output categories, offline behavior, write-safety, and unavailable capabilities. An output schema exists, so detailed return-value documentation is not necessary. The main missing context is an explicit prerequisite note about codeinspectus_setup or guidance on when to use rescan/compliance alternatives, which keeps this from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, so the baseline is 3. The description does not add meaningful per-parameter semantics beyond the schema; it mentions scanner categories and output types, but the schema already documents path, scanners, max_findings, include_compliance, and severity_threshold. No contradiction or major gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Run a full local security scan of a path.' It is unambiguous about what the tool does and enumerates the scan categories. It doesn't explicitly name sibling tools for differentiation, but the word 'full' and the specific output details distinguish it enough from the related compliance/report/SBOM tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says what the tool does but gives no guidance on when to choose it over siblings like codeinspectus_rescan, codeinspectus_compliance_report, or codeinspectus_generate_sbom. There are no exclusions, prerequisites, or alternative-selection hints, so an agent must infer when this tool is the right one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Synvoya/codeinspectus'

If you have feedback or need assistance with the MCP directory API, please join our Discord server