ZeroPath MCP Server

Official

by ZeroPathAI

Overview Schema Related Servers Score Discussions

Python

Remote

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.0
Disambiguation4/5
Most tools have distinct purposes, but some overlap exists: 'get_issues_by_vuln_class' and 'search_vulnerabilities' both involve vulnerability discovery, though the former focuses on statistics and the latter on search. 'list_sca_vulnerabilities' and 'search_vulnerabilities' could be confused as both handle vulnerability queries, but their scopes differ (SCA vs. general). Overall, descriptions help clarify boundaries, but minor ambiguity remains.
Naming Consistency5/5
All tools follow a consistent verb_noun naming pattern (e.g., 'approve_patch', 'archive_issue', 'generate_patch'). There are no deviations in style or convention, making the set predictable and easy to parse. This uniformity enhances usability and reduces cognitive load for agents.
Tool Count4/5
With 17 tools, the count is slightly high but reasonable for a security vulnerability management domain, covering issues, patches, scans, repositories, and SCA. It feels comprehensive without being overwhelming, though it borders on the upper limit of typical scoping (3-15 tools).
Completeness5/5
The toolset provides complete coverage for security vulnerability management: CRUD operations for issues (get, archive/unarchive, mark status), patch lifecycle (generate, approve), scanning (start, list), repository management, and SCA vulnerabilities. No obvious gaps exist; agents can handle full workflows from detection to resolution.
Average 3.1/5 across 17 of 17 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 2 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions 'simple search query' but doesn't disclose behavioral traits such as authentication needs, rate limits, pagination, or what the API returns. This is inadequate for a search tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It's appropriately sized and front-loaded, making it easy to parse quickly, though this conciseness comes at the cost of detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a search tool with no annotations, 0% schema coverage, and no output schema, the description is incomplete. It lacks details on behavior, parameters, and return values, making it insufficient for an agent to use the tool effectively without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only vaguely references 'simple search query' without explaining the 'search_query' parameter's semantics, format, or examples. It fails to compensate for the lack of schema documentation, leaving the parameter's meaning unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose3/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool searches for vulnerabilities using the Zeropath API, which provides a basic purpose (verb+resource). However, it's vague about what 'search' entails and doesn't distinguish this from sibling tools like 'list_sca_vulnerabilities' or 'get_sca_vulnerability', leaving ambiguity about scope and differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. With siblings like 'list_sca_vulnerabilities' and 'get_sca_vulnerability' available, the description lacks any context about use cases, prerequisites, or exclusions, leaving the agent to guess based on tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Approve a patch') which implies a mutation, but fails to describe critical behavioral aspects such as required permissions, whether the action is reversible, potential side effects, or what the response looks like. This is inadequate for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two sentences: one stating the purpose and another documenting the parameter. It's front-loaded with the core functionality, though the 'Args' formatting could be more integrated for better flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a mutation operation with no annotations and no output schema), the description is incomplete. It lacks information about behavioral traits, response format, error conditions, and relationships to sibling tools, making it insufficient for safe and effective use by an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an 'Args' section that documents the single parameter 'issue_id' and its type, adding meaning beyond the input schema which has 0% description coverage. However, it doesn't provide additional context like format examples, constraints, or where to find issue IDs, leaving some semantic gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Approve a patch') and the target resource ('for a specific vulnerability issue'), making the purpose immediately understandable. However, it doesn't explicitly differentiate this tool from sibling tools like 'generate_patch' or 'mark_true_positive', which would require a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (like needing a generated patch first), exclusions, or relationships to sibling tools such as 'generate_patch' or 'mark_true_positive', leaving the agent with insufficient context for proper tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool generates a patch, implying a write operation, but doesn't disclose critical traits like required permissions, whether the patch is applied automatically or suggested, potential side effects, or error handling. For a mutation tool with zero annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the core purpose, followed by a brief parameter explanation. There's no wasted text, and the structure is clear. However, it could be slightly more concise by integrating the parameter note into the main sentence without sacrificing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (generating patches for security issues is a non-trivial mutation), lack of annotations, no output schema, and low schema coverage, the description is incomplete. It doesn't cover behavioral aspects like success/failure outcomes, patch format, or integration with sibling tools. For a tool that likely has significant operational impact, more context is needed to ensure safe and effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an 'Args' section that explains 'issue_id' as 'The ID of the issue to generate a patch for,' adding meaning beyond the input schema, which has 0% description coverage. This clarifies the parameter's purpose, but it doesn't provide details like format examples, valid ranges, or dependencies. With one parameter and low schema coverage, the description compensates partially but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Generate an automated patch/fix for a security issue.' It specifies the verb ('generate') and resource ('patch/fix'), and distinguishes it from siblings like 'approve_patch' or 'get_issue' by focusing on creation rather than approval or retrieval. However, it doesn't explicitly differentiate from all siblings, such as 'mark_false_positive', which might involve issue resolution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides minimal guidance: it implies usage when a security issue needs a patch, but offers no explicit when-to-use criteria, prerequisites, or alternatives. For example, it doesn't specify if this should be used before or after 'approve_patch', or if it's suitable for all issue types. Without such context, the agent lacks clear direction on optimal tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool retrieves detailed information, implying a read-only operation, but doesn't cover critical aspects like authentication requirements, rate limits, error handling, or the format of the returned data. For a tool with no annotation coverage, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence clearly states the purpose, followed by a concise 'Args' section. Every sentence earns its place with no redundant or vague language, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of security vulnerability tools, no annotations, no output schema, and low schema description coverage, the description is incomplete. It lacks details on behavioral traits (e.g., data format, errors), usage context compared to siblings, and output expectations, making it inadequate for informed tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an 'Args' section that explains the 'vulnerability_id' parameter as 'The ID of the vulnerability to retrieve,' adding meaning beyond the schema, which has 0% description coverage. However, with only one parameter, the baseline is high, and this provides basic but not rich semantic context (e.g., it doesn't specify the ID format or source).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Get detailed information about a specific SCA vulnerability,' which includes a specific verb ('Get'), resource ('SCA vulnerability'), and scope ('specific'). However, it doesn't explicitly differentiate from sibling tools like 'search_vulnerabilities' or 'list_sca_vulnerabilities,' which likely serve different purposes (searching vs. listing vs. getting details).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, such as needing a vulnerability ID from another source, or compare it to siblings like 'search_vulnerabilities' for broader queries or 'list_sca_vulnerabilities' for overviews. This lack of context leaves the agent to infer usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only states the action without disclosing behavioral traits such as permissions required, whether the change is reversible, effects on issue status, or response format. It mentions 'confirmed vulnerability' but doesn't elaborate on implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main purpose in the first sentence and uses a structured 'Args' section efficiently. It avoids unnecessary words, though it could be slightly more detailed without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no output schema, and a mutation tool with security implications, the description is incomplete. It lacks information on behavioral context, error handling, and integration with sibling tools, making it inadequate for safe and effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds basic meaning by specifying that 'issue_id' is for the issue to mark, which aligns with the schema. However, it doesn't provide details like format, source, or constraints, leaving gaps despite the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('mark') and resource ('security issue') with specific status ('true positive/confirmed vulnerability'), making the purpose evident. However, it doesn't explicitly differentiate from its sibling 'mark_false_positive' beyond the status difference, missing a direct comparison.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'mark_false_positive' or 'archive_issue', nor does it mention prerequisites or context for marking an issue as true positive. The description lacks explicit usage instructions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It states the action ('Start a new security scan') but doesn't describe what happens during the scan, whether it's asynchronous, what permissions are required, potential side effects, or how results are accessed. This leaves significant gaps for a tool that likely initiates resource-intensive operations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two sentences: one stating the purpose and another explaining the parameter. It's front-loaded with the main action. However, the 'Args:' section formatting could be more integrated with the natural language description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that initiates security scans (likely a significant operation with resource implications), the description is incomplete. With no annotations, no output schema, and minimal behavioral context, it doesn't adequately prepare an agent for proper usage. It should address scan behavior, result access, and relationship to other scanning-related tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal parameter semantics beyond the schema. It explains that 'repository_ids' represents 'List of repository IDs to scan', which provides basic context, but with 0% schema description coverage and only one parameter, this is adequate but not comprehensive. No format, source, or validation details are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Start a new security scan') and target ('on one or more repositories'), providing a specific verb+resource combination. However, it doesn't differentiate from sibling tools like 'list_scans' or 'search_vulnerabilities' which might involve scanning operations, leaving room for improvement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, timing considerations, or how it relates to sibling tools like 'list_scans' (which might show scan results) or 'search_vulnerabilities' (which might involve scanning data).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('archive') and outcome ('remove from active view'), but doesn't cover critical aspects like whether archiving is reversible (though 'unarchive_issue' exists as a sibling), permission requirements, side effects, or what happens to archived data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately concise with two sentences: one stating the purpose and outcome, and another documenting the parameter. It's front-loaded with the core functionality. The 'Args' section is clear but could be integrated more seamlessly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is insufficient. It doesn't explain the archival process, whether it's permanent or temporary, what 'active view' means, error conditions, or return values. The existence of 'unarchive_issue' as a sibling suggests reversibility, but this isn't stated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description includes an 'Args' section that documents the single parameter 'issue_id' with a brief explanation ('The ID of the issue to archive'). With 0% schema description coverage and only one parameter, this adequately compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('archive') and resource ('security issue'), and explains the outcome ('remove it from active view'). It doesn't explicitly differentiate from sibling tools like 'unarchive_issue', but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites, consequences, or when to choose 'archive_issue' over other mutation tools like 'mark_false_positive' or 'mark_true_positive'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states it's a list operation but doesn't mention any behavioral traits such as pagination, rate limits, authentication requirements, or what the output format looks like. For a tool with no annotation coverage, this leaves significant gaps in understanding how it behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded, with the core purpose stated in the first sentence and parameter details in a brief, structured format. Every sentence earns its place without any wasted words, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It doesn't explain what the tool returns (e.g., list structure, fields), any limitations (e.g., max results), or error conditions. For a tool with no structured data to rely on, this leaves the agent with insufficient information to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for the single parameter by explaining that 'search_query' is an 'Optional search term to filter repositories'. Since schema description coverage is 0% and there's only one parameter, this adequately compensates by clarifying the parameter's purpose beyond what the bare schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('List') and resource ('all repositories in the organization'), making the purpose immediately understandable. However, it doesn't explicitly differentiate from sibling tools like 'list_sca_repositories' or 'list_scans', which might have overlapping or related functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'list_sca_repositories' and 'list_scans' present, there's no indication of how this tool differs or when one should be preferred over the others, leaving the agent to guess based on tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but lacks behavioral details. It implies a mutation (unarchiving) but doesn't specify permissions needed, side effects (e.g., notifications), error conditions, or what 'active view' entails. This leaves significant gaps for agent understanding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by a concise parameter explanation. Every sentence earns its place with no wasted words, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and minimal sibling context, the description is incomplete. It lacks details on behavioral traits, usage scenarios, and expected outcomes, leaving the agent under-informed about critical aspects like success criteria or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for the single parameter 'issue_id' by specifying it's for 'the issue to unarchive', which clarifies its role beyond the schema's generic title 'Issue Id'. With 0% schema description coverage, this compensates well, though it doesn't detail format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Unarchive') and resource ('security issue') with the goal 'to restore it to active view'. It distinguishes from 'archive_issue' by specifying the opposite operation, though it doesn't explicitly mention sibling differentiation beyond the inherent contrast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_issue' or 'archive_issue', nor does it mention prerequisites (e.g., issue must be archived). It only states the basic purpose without context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It mentions retrieving 'patch information if available', which hints at conditional data, but doesn't describe error handling (e.g., what happens if issue_id is invalid), authentication needs, rate limits, or response format. For a read operation with zero annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by a parameter explanation. Every sentence adds value: the first defines the tool's function and scope, the second details the parameter. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (single parameter read operation), no annotations, and no output schema, the description is minimally adequate. It covers the basic purpose and parameter but lacks behavioral details like error conditions or response structure, leaving gaps for an agent to use it effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explicitly documents the single parameter 'issue_id' with its type and purpose, adding clear meaning beyond the schema which has 0% description coverage. Since there's only one parameter and it's fully explained in the description, this compensates well for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Get') and resource ('a specific vulnerability issue by its ID'), and mentions 'including patch information if available' which adds useful detail. However, it doesn't explicitly differentiate from sibling tools like 'get_issues_by_vuln_class' or 'search_vulnerabilities' which might retrieve multiple issues differently.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_issues_by_vuln_class' or 'search_vulnerabilities'. It states what the tool does but offers no context about prerequisites, when it's appropriate, or what distinguishes it from sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes what the tool does (get statistics grouped by vulnerability class) but doesn't cover critical aspects such as whether it's a read-only operation, what permissions are required, how data is returned (e.g., format, pagination), or any rate limits. This is a significant gap for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loaded, consisting of two clear sentences that directly state the tool's purpose and output. There is no wasted verbiage, making it efficient and easy to parse for an AI agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (0 parameters, no output schema, no annotations), the description is minimally adequate. It explains what the tool does but lacks details on behavioral traits like permissions or return format. Without annotations or an output schema, more context would be helpful, but the description meets a basic threshold for a simple statistical tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description adds value by explaining the tool's output semantics (grouping by vulnerability class and showing distribution by categories like XSS and SQLi), which compensates for the lack of an output schema. This goes beyond the schema's information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get issue statistics grouped by vulnerability class/type' and 'Shows distribution of vulnerabilities by category (XSS, SQLi, etc.)'. This specifies both the action (get statistics) and the resource (issues grouped by vulnerability class), though it doesn't explicitly differentiate from sibling tools like 'get_summary_statistics' or 'search_vulnerabilities'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'get_summary_statistics' (which might provide broader statistics) or 'search_vulnerabilities' (which might allow filtering), leaving the agent to infer usage context without explicit direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the return content (security score, vulnerability trends, risk assessment) but doesn't cover critical aspects like whether this is a read-only operation, permission requirements, data freshness, rate limits, or error conditions. For a tool that likely accesses sensitive security data, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each earn their place: the first states the action and scope, the second specifies the return values. There's no wasted language or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (security posture assessment likely involves significant data processing), the absence of annotations and output schema means the description should do more. While it efficiently states purpose and return types, it lacks details about behavioral characteristics, data sources, or format of returned metrics that would help an agent use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema description coverage is 100% (though trivial since there are no parameters). The description appropriately doesn't discuss parameters, focusing instead on what the tool returns. This meets the baseline expectation for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('Get') and resources ('overall security posture metrics for the organization'), and it distinguishes this from sibling tools that focus on specific issues, vulnerabilities, or scans rather than organization-wide metrics. However, it doesn't explicitly differentiate from 'get_summary_statistics' which might be a similar high-level reporting tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_summary_statistics' or 'search_vulnerabilities'. It doesn't mention prerequisites, timing considerations, or exclusions, leaving the agent to infer usage from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states what data is included but doesn't describe how the aggregation works, whether it's real-time or cached, what permissions are required, or the format of the response. For a tool with zero annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with just two sentences that directly state the tool's function and scope, including specific examples of metrics. Every word earns its place, and it's front-loaded with the core purpose, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 0 parameters, no annotations, and no output schema, the description is minimal but covers the basic purpose. However, for a tool that aggregates data across an organization, more context on behavior, permissions, or response format would be helpful to compensate for the lack of structured fields, making it only adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description appropriately doesn't discuss parameters, and the baseline for this scenario is 4, as it avoids unnecessary repetition and focuses on the tool's purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('aggregated summary statistics across the organization'), including examples of what metrics are included. It distinguishes itself from siblings like get_issue or get_issues_by_vuln_class by focusing on aggregated statistics rather than individual items. However, it doesn't explicitly differentiate from get_security_posture which might also provide metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention when to prefer this over get_security_posture for metrics or list_repositories for repository counts, nor does it specify prerequisites or exclusions. The context is implied but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes the output ('aggregated dependency inventory information' and 'which repositories have been analyzed for dependencies'), which is useful, but it doesn't cover other behavioral traits such as whether this is a read-only operation, potential rate limits, authentication needs, or how results are formatted (e.g., pagination). For a tool with zero annotation coverage, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded and concise, consisting of two short sentences that directly state the tool's function. Every sentence adds value: the first specifies the action and output, and the second clarifies the scope. There is no wasted wording, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters, no annotations, and no output schema, the description is adequate for a simple listing tool. It explains what the tool does and the type of information returned. However, it lacks details on output format (e.g., structure, fields) and behavioral context (e.g., safety, limits), which would be helpful for an AI agent to use it effectively, especially in a server with many sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters, and the schema description coverage is 100% (though empty). The description doesn't need to add parameter details, so it appropriately focuses on the tool's purpose. Since there are no parameters to document, a baseline of 4 is justified, as the description doesn't have to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List repositories with their aggregated dependency inventory information' and 'Shows which repositories have been analyzed for dependencies.' This specifies the verb ('list'), resource ('repositories'), and scope ('dependency inventory information'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from the sibling tool 'list_repositories', which might serve a similar purpose without the dependency focus, so it doesn't reach a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention any prerequisites, context for usage, or comparisons to sibling tools like 'list_repositories' or 'list_scans', which could be related. Without such information, users might struggle to choose the right tool in this server's context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions 'optional filtering and pagination' but doesn't cover critical aspects like whether this is a read-only operation, rate limits, authentication needs, or what the output format looks like. For a list tool with 5 parameters, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized, with a clear opening sentence followed by a bullet-point-like 'Args' section. Each sentence earns its place by explaining functionality or parameters, though it could be slightly more front-loaded with key behavioral details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, no annotations, no output schema), the description is partially complete. It excels in parameter semantics but lacks behavioral context (e.g., output format, safety, limits) and usage guidelines. This makes it adequate but with clear gaps for an agent to operate effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose: 'search_query' for filtering scans, 'repository_ids' for filtering by IDs, 'scan_type' with enum values (FullScan, PrScan, SCAScan), and 'page'/'page_size' for pagination with defaults. This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'List security scans with optional filtering and pagination.' This specifies the verb ('List') and resource ('security scans'), making the action clear. However, it doesn't differentiate from sibling tools like 'get_security_posture' or 'start_scan', which prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'get_security_posture' for summary data or 'start_scan' for initiating scans, nor does it specify prerequisites or contexts for use, leaving the agent without usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions the tool is for 'searching' but does not clarify if it's read-only, what permissions are needed, how results are returned (e.g., pagination details beyond defaults), or error handling. This leaves significant gaps for a tool with 6 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized, with a clear purpose statement followed by a bullet-point list of parameters. It avoids redundancy, but could be slightly more concise by integrating the purpose and parameter explanations more seamlessly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no annotations, no output schema), the description is partially complete. It excels in parameter semantics but lacks behavioral context (e.g., permissions, error handling) and output details, making it adequate but with clear gaps for effective agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds substantial meaning beyond the input schema, which has 0% description coverage. It explains each parameter's purpose (e.g., 'Optional search term to filter vulnerabilities' for search_query), provides examples (e.g., 'npm, pip, maven' for ecosystems), and clarifies defaults (e.g., page default: 1), fully compensating for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search for SCA (Software Composition Analysis) vulnerabilities in dependencies.' It specifies the verb ('search') and resource ('SCA vulnerabilities'), but does not explicitly differentiate it from sibling tools like 'search_vulnerabilities' or 'get_sca_vulnerability', which prevents a score of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention sibling tools like 'search_vulnerabilities' or 'get_sca_vulnerability', nor does it specify prerequisites or contexts for usage, leaving the agent without clear direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the tool marks issues as false positives, implying a mutation operation, but does not disclose behavioral traits such as permissions required, whether the action is reversible, or any side effects. This is a significant gap for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with a clear purpose statement followed by parameter details in a structured format. Every sentence earns its place without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity as a mutation operation with no annotations and no output schema, the description is incomplete. It lacks details on behavioral aspects, error handling, or return values, which are crucial for effective use by an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the input schema by explaining that 'issue_id' refers to 'The ID of the issue to mark as false positive'. With 0% schema description coverage and only one parameter, this compensates adequately, though it could provide more context like format or source of the ID.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('mark') and resource ('security issue'), and distinguishes it from sibling tools like 'mark_true_positive' by specifying the action is for false positives. The title is null, so the description fully defines the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for marking security issues as false positives, but does not explicitly state when to use this tool versus alternatives like 'mark_true_positive' or 'archive_issue'. It provides basic context but lacks guidance on prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![zeropath-mcp-server MCP server](https://glama.ai/mcp/servers/ZeroPathAI/zeropath-mcp-server/badges/card.svg)](https://glama.ai/mcp/servers/ZeroPathAI/zeropath-mcp-server)

Score Badge

Copy to your README.md:

[![zeropath-mcp-server MCP server](https://glama.ai/mcp/servers/ZeroPathAI/zeropath-mcp-server/badges/score.svg)](https://glama.ai/mcp/servers/ZeroPathAI/zeropath-mcp-server)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ZeroPathAI/zeropath-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server