MCP RHHI CrunchTools
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| RHHI_API_URL | No | Catalog API base URL; HTTPS required except for localhost | https://api-hummingbird.hummingbird-project.io |
| RHHI_TIMEOUT | No | Request timeout in seconds (max 300) | 30 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": true
} |
| resources | {
"subscribe": false,
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_images_toolA | List images in the Hummingbird catalog with streams, variants and pull URL. The response also lists every category, for use as |
| get_image_toolC | Get an image's metadata: summary, streams, variants, licenses, architectures. |
| list_tags_toolA | List an image's tags with pull_url, digest, canonical tag and sizes. Only current (non-superseded) tags unless include_superseded is set. |
| get_tag_details_toolA | Get a tag's container config and provenance per architecture. User, entrypoint, cmd, env, exposed ports, working dir, labels, the Containerfile, source repo/commit, SLSA level and build system. |
| get_sbom_toolB | Get a tag's SBOM: package counts per arch and a filterable package list. |
| get_tag_vulnerabilities_toolB | Get the CVE scan for a tag: summary counts and each CVE with components. |
| get_catalog_vulnerabilities_toolA | Get catalog-wide CVE stats across every current tag, with per-image counts. catalog_summary is the unfiltered catalog total; images, matched and cves reflect the image and min_severity filters. |
| find_cve_toolB | Find which current catalog images and tags a CVE affects. |
| get_release_history_toolB | List past releases (digest, date, source commit) of a stream and variant. |
| get_release_details_toolA | Get the container config and provenance of a historical release by digest. |
| get_release_sbom_toolB | Get the SBOM of a historical release by digest. |
| get_release_vulnerabilities_toolB | Get the CVE scan of a historical release by digest. |
| list_image_requests_toolA | List image requests from images.redhat.com/image-requests. Each request carries its HUM key, title, friendly status (Submitted/In progress/Delivered/Declined) and the public deep_link that opens it on the site. Filter by status or a title/key substring. |
| get_image_request_toolA | Get one image request by HUM key or image title. Returns the HUM key, title, friendly status, submitted/updated dates, the public status note, and the deep_link that opens it on images.redhat.com. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 14 tools
Most tools target distinct resources and actions, but the set has several closely related vulnerability and SBOM tools that differ mainly by scope (catalog, tag, release, or CVE). Descriptions clarify the boundaries, though an agent must still choose carefully among them.
All 14 tools consistently use snake_case verb_noun_tool naming (find/list/get + resource + _tool). There are no mixed conventions or ambiguous verb styles.
With 14 tools, the set is well scoped for a read-only catalog/release/security inspection server. Each tool maps to a meaningful operation and the count stays comfortably within a manageable range.
The surface covers the apparent read-only domain thoroughly: images, tags, tag details, image requests, CVE lookups across catalog/tag/release scopes, SBOMs for tags and releases, and release history/details. There are no obvious dead ends for catalog inspection, vulnerability review, or historical release examination.