Skip to main content
Glama
Sign In
ai-secure-by-design

ai-secure-by-design

by ankush1982
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Review a diff

sbd_review_diff
Read-onlyIdempotent

Review git changes by scanning added lines for secrets, PII, and PHI; use a git range for full checks or a unified diff for secret-only scans.

Instructions

Review a change. With range, runs the full check limited to lines that range adds. With diffText (a unified diff), scans the added lines for secrets only, because other checks need the surrounding file.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "sbd_review_diff"
  }
}

Input Schema

NameRequiredDescriptionDefault
rangeNogit range in the workspace, e.g. origin/main...HEAD
diffTextNo
manifestPathNoManifest path relative to the workspace root. Default privacy-security-manifest.yaml.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds real behavioral context beyond that: range results are limited to newly added lines, and diffText deliberately degrades to secrets-only because other checks need surrounding file content. It does not say what a result looks like or whether findings are blocking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, mode-first ordering, no repetition of the title's job beyond a short lead. The opening "Review a change" is close to tautological given the title "Review a diff", so it earns little, but nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with no output schema and three parameters, the description covers the two input paths and their differing depth of checking, which is the main decision an agent must make. It omits default behavior when no parameters are passed (all are optional) and gives no hint about the shape or severity semantics of returned findings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, with `diffText` carrying no schema description at all; the description compensates by identifying it as a unified diff and explaining its restricted scan scope. `range` semantics are enriched beyond the schema's "git range" wording. `manifestPath` is left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ("Review a change") and immediately splits into the two operating modes keyed to `range` vs `diffText`. It is distinguishable from siblings like sbd_check and sbd_scan_text only implicitly ("the full check", "secrets only"), without naming which sibling performs which narrower job.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit conditional guidance: supply `range` to get the full check scoped to added lines, supply `diffText` to get a secrets-only scan. It falls short of naming alternatives or stating what happens when neither parameter is provided (required count is 0).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools