CodeGuardian MCP
Supports validation of Express backends, detecting API contract mismatches and dead code.
Supports validation of FastAPI backends, detecting API contract mismatches and dead code.
Validates JavaScript code against the codebase, detecting AI hallucinations, dead code, and bad imports.
Supports validation of Next.js projects, detecting API contract mismatches and code issues across full-stack applications.
Validates Python code against the codebase, detecting AI hallucinations, dead code, and bad imports.
Supports validation of React projects, detecting API contract mismatches and mismatched function calls against the codebase.
Validates TypeScript code against the codebase, detecting AI hallucinations, dead code, and bad imports.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@CodeGuardian MCPvalidate the function getUserById in my codebase"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CodeGuardian MCP
The Problem
AI coding assistants hallucinate. They generate code that compiles fine but breaks at runtime:
// [X] AI generates this:
const user = getUserById(id); // Function doesn't exist!
// [OK] Your codebase has:
const user = findUserById(id); // Correct function nameCommon AI Hallucinations:
[CRITICAL] Calling
getUserById()when your codebase hasfindUserById()[CRITICAL] Using methods that aren't on your classes
[CRITICAL] Importing from modules that don't export what they claim
[CRITICAL] Creating dead code that nothing ever uses
Related MCP server: spec-drift-mcp
The Solution
CodeGuardian validates AI-generated code against your actual codebase before you run it.
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ AI Generates │────▶│ CodeGuardian │────▶│ Issues Found │
│ Code │ │ Validates │ │ + Suggestions │
└─────────────────┘ └──────────────────┘ └─────────────────┘
│ │ │
▼ ▼ ▼
Vibe Coding AST Parsing Fix Before
Confidently Symbol Matching RuntimeInstallation
Prerequisites
Node.js v20 or higher (Download)
Install from npm
# Using npx (no install needed — recommended)
npx codeguardian-mcp
# Or install globally
npm install -g codeguardian-mcp
# Or with pnpm
pnpm add -g codeguardian-mcpInstall from source (for contributors)
git clone https://github.com/codegoddy/codeguardian_mcp.git
cd codeguardian_mcp
pnpm install
pnpm run buildConnecting to Your MCP Client
Add CodeGuardian to your MCP client config. No cloning or building required — npx handles everything.
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"codeguardian": {
"command": "npx",
"args": ["-y", "codeguardian-mcp"]
}
}
}Windsurf (mcp_config.json):
{
"mcpServers": {
"codeguardian": {
"command": "npx",
"args": ["-y", "codeguardian-mcp"]
}
}
}Cursor (.cursor/mcp.json):
{
"mcpServers": {
"codeguardian": {
"command": "npx",
"args": ["-y", "codeguardian-mcp"]
}
}
}OpenCode (opencode.json in your project root):
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codeguardian": {
"type": "local",
"command": ["npx", "-y", "codeguardian-mcp"],
"enabled": true
}
}
}Gemini CLI (settings.json):
{
"mcpServers": {
"codeguardian": {
"command": "npx",
"args": ["-y", "codeguardian-mcp"]
}
}
}Claude Code (CLI):
claude mcp add --transport stdio codeguardian -- npx -y codeguardian-mcpRestart your IDE / MCP client for the changes to take effect. You should see CodeGuardian's tools become available.
Note: If you installed globally (
npm install -g codeguardian-mcp), you can use"command": "codeguardian-mcp"with no args instead ofnpx.
Quick Start
The two primary tools that handle everything for you:
start_validation — Full Project Health Check
Scans your entire codebase for hallucinations, dead code, and bad imports. Best for on-demand audits.
Where to run: From the specific subdirectory you want to validate (e.g.,
frontend/orbackend/), not the monorepo root.
# Example: Validate frontend only
cd /path/to/your/project/frontend
start_validation({
projectPath: "/path/to/your/project/frontend",
language: "typescript"
})
# Example: Validate backend only
cd /path/to/your/project/backend
start_validation({
projectPath: "/path/to/your/project/backend",
language: "python"
})This runs in the background (no timeouts). Check progress and get results with:
get_validation_status({ jobId: "..." })— poll progressget_validation_results({ jobId: "..." })— get the final report
start_guardian — Real-Time File Watcher
Watches your project and automatically validates files as you (or your AI) edit them. Runs continuously in the background.
Where to run: From the project root directory (monorepo root). Guardian will auto-detect and watch all subprojects (frontend, backend, etc.).
# Run from project root (monorepo root)
cd /path/to/your/project
start_guardian({
projectPath: "/path/to/your/project",
language: "typescript" // or "python" or "auto"
})Once running, it catches issues in real-time across all subprojects. Use these companion tools:
get_guardian_alerts— see current issues found by the watcherget_guardian_status— check which guardians are activestop_guardian— stop a guardian when done
Tip: These two tools handle everything without needing to call individual validation tools manually.
start_validationfor focused audits on specific subdirectories,start_guardianfor continuous protection across the entire project.
Features
AI Hallucination Detection
Catches non-existent functions, classes, and methods with 95% confidence
Confidence Scoring
Every issue includes a confidence score (0-100%) and detailed reasoning
Score | Level | Action |
0-49 | Critical | REJECT - Major hallucinations detected |
50-69 | Low | REVIEW - Multiple issues need attention |
70-89 | Medium | CAUTION - Minor issues, review suggested |
90-100 | High | ACCEPT - Code is safe to use |
Dead Code Detection
Finds exported functions and classes that nothing imports
API Contract Validation
Detects mismatches between frontend and backend — wrong endpoints, missing fields, type incompatibilities
Multi-Language Support
TypeScript / JavaScript — full support
Python — full support
Full-Stack Projects
Automatically detects full-stack projects (e.g. React + FastAPI, Next.js + Express) and validates each language correctly.
Real-Time Validation
Validates code immediately after generation with sub-second response times
What It Catches
Type | Example | Severity | Confidence |
Non-existent function |
| Critical | 95% |
Non-existent class |
| Critical | 95% |
Bad import |
| Critical | 93% |
Missing dependency |
| Critical | 95% |
Wrong method |
| Medium | 70% |
Wrong param count |
| High | 88% |
Dead export | Exported function nothing imports | Medium | 85% |
Hardcoded credentials |
| Critical | 85% |
API contract mismatch | Frontend calls endpoint that doesn't exist on backend | Critical | 90% |
How It Works
┌─────────────────────────────────────────────────────────────┐
│ CodeGuardian Pipeline │
├─────────────────────────────────────────────────────────────┤
│ 1. AST Parsing │
│ └─> Uses tree-sitter to parse your codebase │
│ └─> Extracts all symbols (functions, classes, methods) │
│ │
│ 2. Context Building │
│ └─> Builds searchable index of project symbols │
│ └─> Caches for fast subsequent validations │
│ │
│ 3. Validation │
│ └─> Compares AI-generated code against index │
│ └─> Flags anything that doesn't exist │
│ │
│ 4. Suggestions │
│ └─> Uses fuzzy matching to suggest corrections │
│ └─> Provides confidence scores and reasoning │
└─────────────────────────────────────────────────────────────┘All Tools
Primary Tools (start here)
Tool | Description |
| Full project scan — runs in background, no timeouts. Use for on-demand audits. |
| Real-time file watcher — validates files as they change. Use for continuous protection. |
Validation Job Tools
Tool | Description |
| Poll progress of a |
| Get final results when a validation job completes |
Guardian Tools
Tool | Description |
| Get current issues found by active guardians |
| Check which guardians are running |
| Stop a specific guardian or all guardians |
Individual Tools
Tool | Description |
| Validate a single code snippet against your project's symbols |
| Build/rebuild project symbol index (usually auto-called) |
| Show what files depend on what — understand the blast radius of changes |
API Contract Tools
Tool | Description |
| Validate frontend/backend API contract compatibility |
| Generate a detailed API contract validation report |
What It Skips (No False Positives)
[OK] External packages (npm/pip) - not your code
[OK] Built-ins (
console.log,print,Math.random)[OK] New code being created in the same snippet
[OK] Entry points (
index.ts,main.py)[OK] Test files
Limitations
No Python type inference — CodeGuardian uses static AST analysis, not a type system. It cannot resolve types through variable assignments, function return values, or chained calls. For example, if
db.query(User)returns aQueryobject and you call.filter()on it, CodeGuardian cannot verify that.filter()is a valid method because it doesn't track the return type ofdb.query(). This would require building a mini mypy-style type checker, which is out of scope. Python method calls on dynamically-typed variables are skipped to avoid false positives.Doesn't catch logic errors (that's still on you)
Dynamic code (
eval, reflection) can't be trackedMethod calls on untyped objects may be skipped to avoid false positives
Very large monorepos (>1000 files) should use
start_validationwith batching
Contributing
We welcome contributions! Please see our Contributing Guide for details.
License
MIT License - see LICENSE file for details.
Available Tools
12 toolsbuild_contextB
Build or rebuild project context including symbols, git history, and intent signals. Usually auto-called by other tools.
| Name | Required | Description | Default |
|---|---|---|---|
| language | No | Programming language to focus on (default: all) | all |
| maxFiles | No | Maximum files to index (default: 1000) | |
| projectPath | Yes | Root path of the project to analyze | |
| forceRebuild | No | Force rebuild even if cached | |
| includeTests | No | Include test files in context (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions rebuilding and the components of context, but does not disclose side effects, cache invalidation, resource intensity, idempotency, or whether this can destroy previous context. For a tool that can 'rebuild', this is a significant transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The core purpose is front-loaded, and the second sentence adds valuable invocation context without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the tool description should explain what happens after the call and what the agent receives. It does not mention return values, completion semantics, or side effects, and the five parameters remain contextually underspecified beyond their schema definitions. The auto-call note helps but is not sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters adequately. The description adds no parameter-specific meaning, but the baseline of 3 is appropriate given that the schema handles the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb phrase, 'Build or rebuild project context', and names the concrete contents it covers: symbols, git history, and intent signals. This clearly distinguishes the tool from the validation and guardian sibling tools, which focus on different concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Usually auto-called by other tools' gives a useful invocation signal, implying that direct calls may be rare. However, it does not state when an agent should call it directly, when to avoid it, or how it relates to alternative tools like start_validation or get_dependency_graph.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_api_contract_reportC
Generate a detailed API Contract validation report with recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
| projectPath | Yes | Absolute path to the project root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of explaining behavior. It does not disclose whether this tool reads existing validation data, triggers new validation, is read-only, or produces side effects like writing files or taking a long time.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the action and object, and every word contributes to the core meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a minimal description for a tool with no annotations and no output schema, surrounded by similarly named validation tools. It doesn't explain whether validation must be run first, what the report contains, or how it differs from validate_api_contracts and get_validation_results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the projectPath parameter is already described as 'Absolute path to the project root'. The description adds no further meaning about how the path is used or what project structure is expected, so it stays at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Generate') and object ('API Contract validation report'), so the core purpose is understandable. It doesn't explicitly differentiate from sibling tools like validate_api_contracts or get_validation_results, but the name and wording strongly suggest a reporting action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus alternatives such as validate_api_contracts, get_validation_results, or get_validation_status. There is no mention of prerequisites, sequencing, or conditions that should lead an agent to choose this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dependency_graphA
The Ultimate Impact Analysis tool for Vibe Coders. Analyzes what files or symbols depend on a target. Use this to understand the "blast radius" of your changes. If you provide a 'symbol', it traces semantic call chains. Set 'includeSource: true' to get a bundled Markdown of all affected code, perfect for pasting into an AI prompt for safe refactoring.
| Name | Required | Description | Default |
|---|---|---|---|
| depth | No | How many levels deep to trace (default: 2, max: 5) | |
| symbol | No | Optional: A specific symbol (function, class) to trace impact for | |
| target | Yes | File path or directory to analyze | |
| language | Yes | Programming language | |
| showHubs | No | Optional: If true, identifies the 'Center of the Universe' (most central) symbols in the project | |
| direction | No | Which direction to trace (default: both) | both |
| includeSource | No | Optional: If true, returns a Markdown bundle of all affected source code for AI prompts |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden and does add behavior: symbol traces semantic call chains, and includeSource produces a bundled Markdown of affected code. It does not explicitly state read-only behavior or the default return format, but "analyzes" and "get" make the safe read nature reasonably clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loads the purpose. The opening "Ultimate Impact Analysis tool" line is marketing fluff, but every other sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool with no output schema, it covers the core purpose, key conditional behaviors, and the primary use case. The main omission is a precise description of the default graph response, though the tool name and "analyzes what depends on" largely convey it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds real meaning for two parameters: symbol enables semantic call-chain tracing, and includeSource produces an AI-prompt-ready Markdown bundle. The remaining parameters are already well documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific operation: "Analyzes what files or symbols depend on a target," and frames it as blast-radius impact analysis. This clearly distinguishes it from the sibling validation/guardian tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells the agent when to use it: "Use this to understand the blast radius of your changes." It also gives conditional guidance for providing a symbol and setting includeSource, but it does not state when not to use it or name an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_guardian_alertsA
Get pending alerts from all active Guardians. Returns a compact summary with a pointer to the full LLM-readable alerts file (codeguardian-alerts.json) in the project root.
| Name | Required | Description | Default |
|---|---|---|---|
| summaryOnly | No | If true, returns only a compact summary with file path to full alerts. Useful to avoid LLM context overflow. Default: false. | |
| clearAfterRead | No | Deprecated: Alerts are now persistent until issues are resolved. This flag is ignored. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It does disclose that the tool returns a compact summary and points to a full alerts file, but it does not explicitly state read-only semantics, whether alerts are persistent, or how the default output differs from summaryOnly=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with the key action front-loaded and no filler. The file name pointer is relevant and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple retrieval tool, but there is a slight ambiguity: the schema implies summaryOnly=false returns more than the compact summary, while the description presents the compact summary as the normal result. It also does not address behavior when no Guardians are active or what the exact response structure looks like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters are already well documented in the schema. The description adds no extra parameter-level meaning, so it does not rise above the baseline for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Get pending alerts from all active Guardians,' and clearly says what is returned (a compact summary plus a pointer to codeguardian-alerts.json). This distinguishes it from sibling tools like get_guardian_status or get_validation_results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the tool's purpose—use it when you need pending alerts from active Guardians. However, the description provides no explicit when-to-use guidance, exclusions, or mentions of alternatives among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_guardian_statusA
Get the current status of VibeGuard. Use this when the user asks for 'vibeguard status', 'what is running', or 'agent health'. Lists all active agents.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states that the tool reports current status and lists active agents, implying a read-only operation, but it does not explicitly confirm that it has no side effects or describe any limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the core purpose, then gives usage triggers and output details, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter status tool, the description is largely complete: it states what the tool does and what output to expect. It could be slightly stronger by explicitly noting that it does not start or stop VibeGuard, but this is a minor gap given the sibling names make that distinction inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the description is not required to explain parameter semantics. The description still adds useful context by indicating the output scope: active agents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function: retrieving the current status of VibeGuard and listing active agents. This distinguishes it from siblings like start_guardian, stop_guardian, and get_guardian_alerts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit user-intent triggers ('vibeguard status', 'what is running', 'agent health') for when to use this tool. It does not explicitly mention when not to use it or name alternative tools, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_validation_resultsA
Retrieve final results for a completed validation job. Results are also saved to codeguardian-report.json at the project root, readable by file tools.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes | Job ID returned from start_validation | |
| limit | No | Optional: Limit number of issues returned (default: all) | |
| offset | No | Optional: Offset for pagination (default: 0) | |
| fileFilter | No | Optional: Filter results by file path (partial match) | |
| summaryOnly | No | Optional: If true, returns only summary and stats without issue lists | |
| severityFilter | No | Optional: Filter results by severity |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds value by revealing that results are also persisted to codeguardian-report.json at the project root and can be read by file tools. The word "Retrieve" implies a read operation, and no destructive side effects are hidden, though it does not discuss auth, rate limits, or behavior for incomplete jobs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences. The core action is front-loaded in the first sentence, and the file-persistence detail earns its place in the second without adding noise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only retrieval tool with fully documented parameters, the description plus schema is largely sufficient for an agent to call it correctly after validation completes. The lack of an output schema means the exact result shape is not spelled out, but the saved report file and companion status tool mitigate that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all 6 parameters, so the description is not required to re-explain them. It adds no parameter-level detail beyond what the schema already provides, which is acceptable but does not warrant a higher score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: "Retrieve final results" for a "completed validation job." It distinguishes this tool from siblings like get_validation_status and start_validation by focusing on final results rather than status or triggering validation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "completed validation job" establishes the key prerequisite: only use this tool after validation has finished. It also notes that results are saved to codeguardian-report.json and readable by file tools, hinting at an alternative access path. However, it does not explicitly mention using get_validation_status to check progress or name exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_validation_statusA
Check progress of a validation job. Poll every 3-5s until status is 'complete' or 'failed'.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes | Job ID returned from start_validation |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the burden of behavioral disclosure and does a good job: it reveals that the tool is non-blocking and intended for repeated polling, and it states the terminal statuses 'complete' and 'failed'. It does not cover error behavior or response format, but the primary polling behavior is transparently described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence that front-loads the core purpose and immediately follows with the essential usage instruction. Every word earns its place; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter polling tool with no output schema, the description covers the key context: what to check, how often to poll, and when to stop. It does not spell out the exact response structure, but naming the terminal statuses 'complete' and 'failed' gives enough closure. Minor gaps around error handling and post-completion next steps prevent a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the only parameter, jobId, is already described as 'Job ID returned from start_validation' in the schema. The tool description adds no additional parameter detail beyond referencing validation jobs, but it also doesn't need to given the schema already fully documents the parameter. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action — 'Check progress of a validation job' — with a clear resource and a distinct purpose. It differentiates itself from siblings like get_validation_results by focusing on status/progress rather than final outputs. The polling instruction further reinforces the tool's role in the validation lifecycle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage guidance: poll every 3-5 seconds until a terminal status is reached. This effectively tells the agent when and how to use the tool, though it does not explicitly name alternatives or state when to switch to get_validation_results. The polling cadence and stopping conditions are valuable and clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_guardianB
Activate a VibeGuard Agent. You can start multiple Guardians to watch different parts of your codebase (e.g., one for 'Frontend', one for 'Backend'). Each Guardian watches its own path and language.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Operation mode (default: auto) | auto |
| language | No | Programming language (default: typescript) | typescript |
| agent_name | No | Name for your Guardian (default: 'VibeGuard') | VibeGuard |
| projectPath | Yes | Absolute path to the project root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral disclosure burden. It discloses that multiple Guardians can run and each watches its own path/language, but it does not mention side effects, whether this launches a background process, permission requirements, concurrency implications, or how to observe the Guardian afterward.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with the primary action. The second and third sentences overlap somewhat ('start multiple Guardians' vs. 'Each Guardian watches its own path'), so it is not maximally tight, but it remains efficient and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with four parameters, no annotations, and no output schema, the description provides enough to make the call but is incomplete about postconditions. It does not explain what happens after activation, how to check Guardian status, or how this tool relates to sibling lifecycle tools like stop_guardian and get_guardian_status.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds some useful semantic context by tying each Guardian to its own projectPath and language, but it does not explain parameter formats, default behavior, or mode semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with a clear action and resource: 'Activate a VibeGuard Agent.' It also explains that each Guardian watches its own path and language, which helps distinguish this from generic validation tools. However, it does not explicitly contrast with siblings like start_validation or validate_code, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a usage context: starting multiple Guardians to watch different codebase parts. It does not explicitly state when to prefer this over alternatives such as validate_code or start_validation, nor does it provide exclusions. Usage guidance is present but only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_validationA
Start a background validation job for large codebases (>50 files) to avoid timeouts. In monorepos, run this on a scoped subdirectory (e.g., frontend/ or backend/) rather than the repo root. Use 'get_validation_status' to poll for progress. Results are saved to codeguardian-report.json at the project root (readable by file tools, NOT inside .codeguardian/).
| Name | Required | Description | Default |
|---|---|---|---|
| language | Yes | Programming language (typescript includes .js/.jsx files for mixed projects) | |
| batchSize | No | Files per batch (default: 50, max: 100) | |
| strictMode | No | ONLY use true if explicitly requested. When true, flags ALL unresolved symbols including edge cases. Default is false which catches likely hallucinations without excessive noise. | |
| projectPath | Yes | Path to your validation scope (e.g., "frontend", "backend", or a single app/package path). Avoid monorepo root unless it is a single-project repo. | |
| includeTests | No | Include test files (default: true) | |
| recentlyEditedFiles | No | Optional list of files edited in this session to boost relevance |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It does well by revealing that the job runs in the background, that progress is polled via get_validation_status, and that results are written to codeguardian-report.json at the project root, explicitly noting it is NOT inside .codeguardian/. It stops short of describing potential overwrite behavior or immediate return values, but the main side effect and output location are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. The first sentence states purpose and threshold, the second gives the most important scoping exception, and the third covers polling and output location. Every sentence earns its place and the most decision-relevant information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a background job with no output schema, the description covers the key operational needs: when to use it, how to scope it, how to check progress, and where results land. The main omission is the immediate return value of start_validation itself (e.g., whether it returns a job ID needed for get_validation_status), but the rest of the workflow is well-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the description is not required to add param detail. The monorepo scoping advice in the description partially reinforces projectPath semantics, though it largely duplicates the schema's existing guidance about avoiding the monorepo root. No significant new parameter meaning is added beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Start a background validation job' for 'large codebases (>50 files)'. It clearly differentiates from siblings by emphasizing the background/asynchronous nature and by pointing to get_validation_status for follow-up, which separates it from synchronous validation or status tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: large codebases over 50 files to avoid timeouts. It also provides concrete monorepo scoping advice and names the polling tool to use afterward. It does not explicitly name validate_code as the alternative for small codebases, but the >50-file threshold makes the intended boundary reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_guardianA
Stop a specific Guardian Agent or all active Guardians.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_name | No | Name of the Guardian to stop. Leave empty to stop ALL. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden of behavioral disclosure. It states the action and scope but does not explain consequences such as whether running validations are interrupted, whether stopping is reversible, or what happens if agent_name does not match an active Guardian. For a 'stop all' operation, this is a meaningful safety gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler or redundant phrasing. The core scoping information ('specific' or 'all') is front-loaded and every word contributes to understanding the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and no output schema, the description plus schema cover the core invocation path. However, with no annotations and no information about return values or side effects, the agent is left to assume outcomes, especially for the potentially destructive stop-all case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents agent_name at 100% coverage, including the 'Leave empty to stop ALL' behavior. The description echoes that scope without adding parameter-level examples, constraints, or additional semantics beyond the schema baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Stop' against the resource 'Guardian Agent' and clearly covers both scopes: a specific agent or all active Guardians. It reads as the clear inverse of the sibling start_guardian and is distinct from the read-only get_guardian_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: whenever one or all active Guardians need to be stopped. It does not explicitly name alternatives or exclusion criteria, but the start/stop pairing with start_guardian makes the intended use obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_api_contractsA
Validate API contracts between frontend and backend. Detects mismatches in endpoints, types, and parameters before runtime errors occur.
| Name | Required | Description | Default |
|---|---|---|---|
| projectPath | Yes | Absolute path to the project root (should contain both frontend and backend) | |
| includeTypes | No | Validate type compatibility | |
| includeEndpoints | No | Validate endpoint existence and HTTP methods | |
| includeParameters | No | Validate request/response parameters |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior itself; it states the tool detects mismatches, implying a non-mutating static analysis. It does not explicitly confirm that it is read-only, nor does it describe project structure requirements or runtime cost, leaving some ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action and followed by a concrete statement of value. No filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple read-only validation tool with fully described parameters, but there is no output schema and the description does not state what the tool returns (e.g., a report, status, or errors). Additional context about how this fits with get_validation_results or get_api_contract_report would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all four parameters. The description adds semantic value by naming the three validation dimensions that map to includeTypes, includeEndpoints, and includeParameters, but this is just a high-level echo of the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('validate') and resource ('API contracts between frontend and backend'), and names concrete detection targets (endpoints, types, parameters). This clearly differentiates it from siblings like validate_code (code-level validation) and get_api_contract_report (retrieving a report rather than running validation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this tool to catch contract mismatches before runtime, which is enough for basic selection. However, it does not mention any alternatives or exclusion criteria, nor how it relates to sibling tools like start_validation or get_api_contract_report, so it stops one step short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_codeA
Validate code snippets or single-file changes for hallucinations, missing dependencies, and dead code in one pass. For full-project or monorepo-wide audits, use start_validation on a scoped subdirectory (e.g., frontend/ or backend/).
| Name | Required | Description | Default |
|---|---|---|---|
| newCode | No | The AI-generated code to validate (optional - omit for dead code scan only) | |
| language | Yes | Programming language | |
| sessionId | No | Optional session ID for incremental validation (reuses previous results) | |
| strictMode | No | ONLY use true if explicitly requested. When true, flags ALL unresolved symbols including edge cases. Default is false which catches likely hallucinations without excessive noise. | |
| projectPath | Yes | Path to the relevant project scope for this snippet/file (e.g., ".", "src", "backend"). For large repository scans, prefer start_validation. | |
| useSmartContext | No | Use smart context selection for faster validation (default: true) | |
| recentlyEditedFiles | No | Optional list of files edited in this session to boost relevance |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the burden. It discloses the validation dimensions and the 'one pass' behavior, but it does not reveal whether the tool is asynchronous, whether results are persisted for later retrieval, or whether any side effects occur. The sibling status/result tools imply a follow-up flow, but the description itself leaves this implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, and the core purpose is front-loaded before the alternative routing. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema covers parameters and the description covers scope, but there is no output schema and no guidance on how results are returned or retrieved (e.g., get_validation_status/get_validation_results). For a 7-parameter validation flow this is a meaningful completeness gap, though sibling names partially compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 7 parameters. The description adds no parameter-level detail beyond its general scope statement ('snippets or single-file changes'), so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and target: 'Validate code snippets or single-file changes for hallucinations, missing dependencies, and dead code in one pass.' It clearly distinguishes from start_validation by scoping to single-file/snippet validation, so an agent can discriminate without inspecting the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the alternative for broader work: 'For full-project or monorepo-wide audits, use start_validation on a scoped subdirectory...' This tells the agent both when to use this tool and when to choose a sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v1.4.8- First observed
build_context - First observed
get_api_contract_report - First observed
get_dependency_graph - First observed
get_guardian_alerts - First observed
get_guardian_status - First observed
get_validation_results - First observed
get_validation_status - First observed
start_guardian - First observed
start_validation - First observed
stop_guardian - First observed
validate_api_contracts - First observed
validate_code
TDQS
Scored across 12 tools
Most tools have clear, distinct purposes, especially the lifecycle pairs for guardians and validation jobs. The main confusion risk is between validate_code and start_validation, which are distinguished primarily by codebase size, and validate_api_contracts vs get_api_contract_report, which could be seen as overlapping.
Tool names consistently follow a verb_noun pattern with get_, start_, stop_, and validate_ prefixes. There are no mixed casing or naming style violations, making the tool surface predictable.
Twelve tools is well within the sweet spot for a domain with multiple sub-areas: code validation, guardian lifecycle, alert retrieval, dependency analysis, and API contract checking. Each tool contributes a distinct capability without bloating the surface.
The set covers the main validation workflow (start/status/results), guardian lifecycle (start/stop/status/alerts), and API contract validation/reporting. A notable gap is the absence of a cancel or stop operation for background validation jobs, since stop_guardian only applies to Guardians.
Maintenance
Related MCP Connectors
Codebase intelligence for AI agents — dead code, blast radius, ownership.
Proves AI-generated Python does what you asked: lint, types, security, sandbox run, exact fixes.
Deterministic validation for AI-generated artifacts: JSON Schema, OpenAPI response, SQL syntax.
Pre-commit code quality guardian. Detects semantic drift in AI-generated code.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables AI coding tools to query your live codebase for routes, import graph, domain context, and blast radius, eliminating hallucinations about project structure.377 npm76MIT
- AlicenseAqualityCmaintenanceEnables AI coding agents to verify code against YAML specifications, detecting missing fields, extra fields, and type mismatches to prevent silent drift before commits.3MIT
- AlicenseNot gradedqualityAmaintenanceA verification layer that lets AI agents safely delete code in large codebases by assessing usage paths and providing risk statuses.7MIT
- AlicenseAqualityDmaintenanceEnables evaluation of AI-generated code across 45 specialized dimensions using deterministic pattern matching and optional LLM-powered deep review, acting as an independent quality gate.31608 npm7MIT