Skip to main content
Glama

Scan installed agent setup

scan_installed
Read-onlyIdempotent

Scans installed AI agent skills, plugins, hooks, MCP servers, and editor/CLI configs for security findings, using read-only, offline checks with severity filtering.

Instructions

Scans the agent setup already on this machine, like toolmoat scan with no paths: Claude Code skills, plugins, commands, agents, hooks, settings and user config, Claude Desktop, Cursor, VS Code, Windsurf, Codex and Gemini CLI configs, plus the project files of the server working directory. Read-only and offline.

Input Schema

NameRequiredDescriptionDefault
deepNoAlso walk node_modules, virtualenvs and caches.
max_findingsNoLargest number of findings to return, most severe first.
min_severityNoLeave out findings below this severity.low

Output Schema

NameRequiredDescriptionDefault
toolYes
countsYes
targetsYes
versionYes
findingsYes
filesScannedYes
skippedFilesYes
highestSeverityYes
omittedFindingsYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and openWorld=false, so the description need not restate safety. It still adds real context: the scan is offline, covers project files of the server working directory, and mirrors the CLI's no-path mode. It does not mention cost/scale implications of the scan, which is the only notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence with the scope front-loaded and the read-only/offline guarantee saved for the end where it lands as a qualifier. The long product enumeration is the only bulk, and it earns its place by defining scan coverage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema and rich annotations are present, so the description only needs to establish scope and safety, both of which it does. The one remaining unknown an agent might want—whether results are truncated or how findings are grouped—is partly handled by the max_findings schema field.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and every parameter (deep, max_findings, min_severity) carries its own description and defaults, so the schema does the heavy lifting. The description adds nothing about how deep or severity thresholds affect results, which is acceptable at full coverage but leaves the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (scans) and a precise resource (the agent setup already on this machine), and enumerates the exact surface covered: Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Codex, Gemini CLI, plus working-directory project files. The zero-argument, machine-scoped nature makes it clearly distinct from path/text-oriented siblings like scan_path and scan_text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'like `toolmoat scan` with no paths' plus 'the agent setup already on this machine' implicitly routes the agent here when no specific target is supplied, versus scan_path/scan_text which take targets. It stops short of an explicit exclusion ('use scan_path instead if you have a directory'), but the contrast is easy to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools