dtrack-mcp

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.7.2
Disambiguation5/5
Each tool has a distinct purpose in the triage workflow. For example, broadcast_triage and carry_over_triage are clearly differentiated, and finding deduplication tools like find_duplicate_analyses and group_findings_by_alias serve different scopes.
Naming Consistency5/5
All tools use consistent snake_case naming with a verb_noun pattern (e.g., list_findings, upload_bom, set_analysis), making them predictable and easy to navigate.
Tool Count5/5
With 14 tools, the server is well-scoped for a Dependency-Track integration, covering project management, finding analysis, vulnerability search, and SBOM upload without excess.
Completeness4/5
The tool set covers the core triage and analysis lifecycle comprehensively. Minor gaps exist, such as explicit project creation or deletion tools, but these are partially addressed by upload_bom with auto_create.
Average 4.6/5 across 14 of 14 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 0 commits in the last 12 weeks
- Last stable release on April 25, 2026
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully discloses behavior: it is read-only, lists all returned fields, handles missing analysis by returning a default (never null), and uses clear language. This is comprehensive for a retrieval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: it starts with the primary purpose, then lists return fields, then explains edge cases, and ends with 'Read-only' and arguments. It is informative without unnecessary repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 required UUID parameters, no output schema shown but exists), the description covers all essential aspects: what it does, what it returns, edge cases, and read-only guarantee. It leaves no gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description only restates parameter names with generic phrases like 'DT project UUID'. It adds minimal semantic value beyond the schema, failing to explain formats or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Fetch' and identifies the resource as 'analysis record for one finding'. It clearly distinguishes itself from siblings like 'set_analysis' (modification) and 'list_findings' (listing many findings).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: it retrieves an analysis record for a single finding, and explains the default return when no analysis exists. However, it does not explicitly contrast with sibling tools or state when not to use it, leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavior. It declares 'Read-only', specifies the return includes 'per-severity vulnerability counts', and explains parameters like pagination and filtering details (e.g., case-insensitive substring, max page size). This provides substantial transparency, though it omits rate limits or authorization requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-organized, starting with a summary sentence, then a second sentence on output and safety, followed by parameter explanations. Every sentence adds value without redundancy, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (filtering, pagination) and the presence of an output schema for return values, the description covers key aspects: filtering, pagination details, read-only assurance. It lacks an explicit mention of ordering, but the output schema likely covers that. Overall, it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description is essential. It adds a dedicated 'Args' section explaining each parameter beyond the schema's titles: name_filter (case-insensitive substring), active_only (exclude inactive), page (1-based), page_size (max 500). This fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb and resource: 'List Dependency-Track projects'. It also specifies the operations: listing all projects with optional filtering by name substring, and indicates the output includes vulnerability counts. This distinguishes it from sibling tools like list_findings (which lists findings) and upload_bom (which uploads).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied by the tool's purpose—listing projects—but the description does not explicitly state when to use this tool over alternatives like list_findings or search_vulnerability. It mentions 'Read-only', which hints at safe use, but lacks direct guidance on context or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses write nature (⚠ WRITE), HTTP method (PUT), behavior of None fields (omitted) and comment appending, and return value. No annotations provided, so description carries full burden; could mention error handling or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections, bullet points, and arg list. Front-loaded with purpose and warning. Slightly long but justified by 10 parameters; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, parameters, behavioral details, and return value. Output schema exists so return description is sufficient. Could include error scenarios or idempotency, but overall comprehensive for a write tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Every parameter explained with context: relationships between component_uuid, vulnerability_uuid, and finding, enum examples, optionality. Adds significant meaning beyond the schema which has 0% description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'Update the analysis record for one finding' with clear verb-resource pair. Distinguishes from siblings by specifying the write path and mentioning alternative finding identification methods.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides two explicit ways to identify the finding with precedence rules, explains why project_uuid is always required, and notes field omission behavior. Lacks direct contrast with sibling tools for when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses the write nature, the need for polling via a returned token, and permission requirements for auto_create. It does not cover rate limits, idempotency, or error behavior, but the core behavioral traits are well communicated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but well-organized, with a warning symbol, paragraph explaining the endpoint and polling, and a clear bullet-like list of parameters. It could be slightly more concise but avoids fluff and front-loads key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 6 parameters and an output schema (not shown), the description covers usage, parameter meanings, return behavior (token), and post-processing polling. Missing details like token format or error conditions, but overall adequate for an AI agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema only provides types. The description adds rich semantics: explains project_name/version as target, bom as base64-encoded SBOM, auto_create behavior and permission, and optional parent parameters for hierarchy. This fully compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it uploads a CycloneDX/SPDX SBOM to Dependency-Track, specifies it is a write operation, and distinguishes from sibling tools (none of which are upload tools). The verb 'upload' and resource 'SBOM' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use (uploading SBOMs), mentions that the caller should poll for completion, and notes auto_create triggers project creation with extra permission requirements. It does not explicitly state when not to use, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states 'Read-only,' which is a key behavioral trait. It also details the output structure and filters. However, no annotations exist, and the description does not disclose authorization requirements or rate limits, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections and bullet points, front-loading the core purpose. While every sentence is informative, the length could be slightly reduced without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 parameters, no annotations, rich output), the description is remarkably complete. It covers the three output lists, parameter details, and edge cases (e.g., active_only default flip). The output schema exists but the description adds important context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by explaining each parameter's purpose, default values, interaction rules (e.g., states wins over only_analyzed), and behavioral impacts (e.g., active_only default flip). This adds substantial meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds duplicate analyses of a given finding across DT, and explains the three parallel lists (aliases_in_project, same_vuln_other_components, other_projects) with specific definitions. This is specific and distinguishes the tool from other search/filter tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description frames the tool as 'intended for a triage loop that wants to reuse prior decisions,' providing clear context. However, it does not explicitly contrast with sibling tools like carry_over_triage or diff_findings, or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses read-only nature, sorting behavior (semver-aware, newest first), and return structure. It does not mention error handling or rate limits, but for a simple listing tool, this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with each sentence adding value. It front-loads the main action, then covers return, use case, read-only status, and parameters. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description is fairly complete. It explains purpose, usage, behavior, and parameters. It could mention error scenarios (e.g., project not found), but for a listing tool, the provided information is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description must fully explain parameters. It does so effectively: 'name: Exact project name' and 'active_only: Exclude projects marked inactive in DT' with default true, adding meaning beyond the schema's type definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all versions of a project by exact name,' which is a specific verb+resource combination. It distinguishes itself from siblings by mentioning its use for picking UUIDs for diff_findings and carry_over_triage, which are sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Used to pick source / target UUIDs for diff_findings and carry_over_triage,' providing clear context for when to use it. It also states 'Read-only,' but does not explicitly exclude other scenarios or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses read-only nature, component matching logic (dropping qualifiers), handling of ambiguous matches (warnings), and the meaning of 'reason' fields. This is comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat lengthy but well-structured with a list and detailed explanations. Every sentence adds value, though it could be slightly more concise for a quick scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the tool (four output categories, matching logic, warnings) and the presence of an output schema, the description covers the key behavioral aspects and output structure. It doesn't explain the exact output schema fields, but that is presumably handled by the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning. It explains 'source_project_uuid' as old version UUID with existing triage, 'target_project_uuid' as new version UUID, and 'include_analysis' as needed for carry_over with a performance note. This adds significant value beyond the schema's title and type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Compute' and the resource 'carried / updated_component / new / gone', which specifically distinguishes it from siblings like carry_over_triage. It explains the four categories and their meanings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a typical use case (upgrading product v1→v2) and explains the roles of source and target. States it's read-only. Does not explicitly list when not to use, but context with siblings implies differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present, so description carries full burden. Discloses read-only nature, filtering behavior (client-side, post-filter total), return structure (bundled vulnerability, component, analysis state), and include_details trade-off (payload size). Highly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with summary, behavioral notes, and parameter list. Front-loaded with purpose. Slightly verbose but all content adds value; could tighten a few phrases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main behaviors, pagination, filtering, and include_details. Output schema exists, so return values not needed. Lacks error handling or prerequisites (e.g., project UUID from list_projects), but still sufficiently complete for typical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the Args section thoroughly explains each parameter, including examples for analysis_states and severities, and details on include_details. Fully compensates for missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'List vulnerability findings for a project with optional filters.' Verb and resource are specific, and it distinguishes from sibling tools like get_analysis or set_analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides usage context: filters applied client-side, pagination behavior, and advice on include_details (use only for focused batches). Does not explicitly contrast with all sibling alternatives but gives clear guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and explicitly states 'Read-only', which is a key behavioral trait. It also describes the resolution process (including alias handling) and return structure (per-project analysis state), providing sufficient transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-line purpose, a brief explanation of the process, a usage hint, and a clear Args section. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema, the description does not need to detail return values. It covers the overall behavior, parameters, and usage context comprehensively for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are explained in the description beyond the input schema: vuln_id includes examples, active_only and only_analyzed have clear explanations of their effects and defaults. This compensates for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search which projects are affected by a vulnerability.' It explains the process of resolving a vulnerability ID and finding affected projects with analysis states per component, distinguishing it from siblings like find_vulnerability or list_findings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises to use the tool for answering which products are affected by a CVE and what decisions have been made, avoiding manual iteration. It does not explicitly mention when not to use it, but the context and sibling list provide alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: union-find algorithm, canonical id priority, merge_reason trace, pagination on groups, sorting by CVSS, include_details behavior, and read-only status. It even warns about repeated descriptions in findings. This is comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, then logically covers clustering details, behavior, and parameter list. Every sentence adds value without redundancy. Length is appropriate for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters, no annotations, and an existing output schema, the description explains output structure (canonical id, alias list, merge_reason, all findings), pagination, sorting, and the effect of include_details. This is sufficient for an AI agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists all 7 parameters with explanations (e.g., 'page: 1-based page of groups (not findings)') and defaults. Some details like possible values for analysis_states are omitted, but the coverage is strong overall.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Group findings by alias (transitive closure) — dedup CVE/GHSA/OSV,' which precisely states the tool's action and resource. It clearly distinguishes from sibling tools like list_findings by explaining the clustering over alias graph, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use (deduplication via aliases) and notes 'Same filters as list_findings,' implying an alternative. It lacks explicit 'when not to use' or direct comparison to other sibling tools, but the context of deduplication is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It explicitly states 'Read-only.' and describes the return behavior: returns the first hit or null if nothing matches. It lists all returned fields (title, description, CVSS scores, etc.). No contradictions with annotations. The description fully discloses the tool's behavior and effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: an introductory sentence, a paragraph explaining the source parameter logic, a line stating 'Read-only.' and then a bulleted list of return fields. Every sentence is informative; there is no redundancy or fluff. The size is appropriate for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters, optional source inference) and the presence of an output schema, the description is complete. It explains the input parameters, the logic of source resolution, and the output fields. There are no gaps in context for an agent to select and invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description fully explains both parameters: vuln_id with examples ('CVE-2024-1234', 'GHSA-xxxx-yyyy-zzzz') and source with a list of possible values and the default inference behavior. This adds substantial meaning beyond the schema's type/required fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Fetch the full detail record of a vulnerability.' It goes beyond a simple verb+noun by explaining the behavior with and without the source parameter, and implicitly distinguishes from sibling tools like 'search_vulnerability' (fetch vs. search). The verb 'Fetch' and resource 'full detail record' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to include the source parameter (e.g., 'When source is given ... fetches directly') and when to omit it (source inferred from id prefix). It explains the fallback behavior (probes candidates, returns first hit or null). However, it does not explicitly advise when to use this tool versus the sibling 'search_vulnerability' or other alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description fully carries the burden. Declares read-only operation, return null if no match, and precedence behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections for different lookup paths. Front-loaded with purpose. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so need not explain return values. Description fully explains behavior, input strategies, and return null case. Complete for a single-project resolver.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description explains each parameter's role, how to use them together, and precedence. Adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool resolves a project by UUID or by exact (name, version). Distinguishes two lookup paths and specifies precedence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use each parameter set and precedence rules. Lacks explicit exclusion of when not to use this tool compared to siblings, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: in exact mode it issues PUT calls, appends comments, preserves source history, and includes skip rules and safety caps. Also mentions an env var for rate-limiting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is fairly long but well-structured: a warning, usage guidelines, skip rules, safety caps, and parameter list. It's front-loaded with the dry-run instruction. A minor point is that it could be slightly more concise, but every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 params, write operation, safety concerns), the description covers all necessary aspects: prerequisite dry-run, skip rules, safety caps, parameter meanings. The output schema exists but doesn't need elaboration in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The Args section provides detailed explanations for all 8 parameters, adding meaning beyond the schema's property titles and types. For example, it explains include_updated_components as 'same CVE, different component version'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Transfer triage decisions v1 → v2', a specific verb-resource combo. It distinguishes from siblings like broadcast_triage and diff_findings by emphasizing it's a version-to-version transfer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit instructions: 'ALWAYS run with mode="dry_run" first' and only switch to exact after human review. Also details skip rules and safety caps, leaving no ambiguity about when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses it is a WRITE operation when mode='exact', describes the full algorithm (fetch, exclude, iterate, return), and covers default behaviors without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with warning, purpose, steps, and parameter docs; every sentence is valuable and front-loaded with critical info.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, 9 parameters, and output schema present, the description fully covers behavior, usage, and parameter details, making it self-sufficient for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description provides detailed explanations for all 9 parameters, including defaults and behavior, far exceeding schema information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Fan out triage decisions to all versions' and distinguishes from sibling 'carry_over_triage' as a specialized form for simultaneous CVEs across versions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises to always run dry_run first, compares to carry_over_triage, and provides step-by-step usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![dtrack-mcp MCP server](https://glama.ai/mcp/servers/drewrukin/dtrack-mcp/badges/card.svg)](https://glama.ai/mcp/servers/drewrukin/dtrack-mcp)

Score Badge

Copy to your README.md:

[![dtrack-mcp MCP server](https://glama.ai/mcp/servers/drewrukin/dtrack-mcp/badges/score.svg)](https://glama.ai/mcp/servers/drewrukin/dtrack-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/drewrukin/dtrack-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server