Skip to main content
Glama
Sign In
sphior-code-mcp

sphior-code-mcp

by Toraastrta
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

verify_evidence

Independently verify SPHIOR's tamper-evident code evidence chain (Merkle root, hash-chain, commit anchor) to confirm scan records were not altered. Built for auditor review; returns no source code.

Instructions

Independently verify SPHIOR's tamper-evident code evidence chain (Merkle root + hash-chain + commit anchor). Confirms the deterministic scan records were not altered — for auditors. No source code is returned.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "verify_evidence"
  }
}

Input Schema

NameRequiredDescriptionDefault
repoNoFilter to one repository (full_name). Omit for all.
includePackNoInclude the independently-verifiable evidence pack (records + SHA-256 manifest).

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden and does meaningful work: it names the three verification components checked, frames the operation as independent verification rather than a mutation, and explicitly bounds the output with 'No source code is returned.' It stops short of saying whether the call is strictly read-only/no-side-effect, what a failed verification yields, or any cost/latency or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the verification target and followed by the outcome and the output bound; nothing is redundant. The parenthetical component list is dense jargon but earns its place by defining what is actually being verified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-optional-parameter read tool with no annotations and no output schema, the description covers what is verified and what is not returned, which is the core need. It leaves open what the response reports (pass/fail vs. detailed chain diagnostics) and whether calling it has prerequisites, so it is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (repo filter and includePack) are already documented in the schema. The description adds no syntax, default, or behavioral nuance beyond that — notably it never mentions that the evidence pack is optional — so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb (verify) against a specific resource (the tamper-evident evidence chain made of Merkle root, hash-chain, and commit anchor) and states the goal — confirming scan records were not altered. The domain (evidence integrity) is far enough from the finding-oriented siblings that an agent can route correctly, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for auditors' implies the usage context (attestation/audit workflows) rather than spelling it out, and 'Independently' signals this is a re-check rather than a scan. There is no explicit when-to-use vs. when-not guidance and no alternative named, so guidance is implied only.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools