Skip to main content
Glama
drewrukin

dtrack-mcp

by drewrukin

diff_findings

Compare vulnerability findings between two project versions to identify carried, updated, new, and removed issues for triage transfer during upgrades.

Instructions

Compute carried / updated_component / new / gone between two versions.

Typical use: upgrading a product v1 → v2. source is v1 (where triage decisions already exist), target is v2 (new SBOM just uploaded). Returns four lists:

  • carried — same component + same vulnerability, safe to transfer analyses 1:1.

  • updated_component — same vulnerability, component version changed (patch or major). Decision may or may not still apply.

  • new — appeared in target only.

  • gone — were in source only; reason is vuln_fixed (component still there) or component_removed.

Component matching uses (purl_type, purl_namespace, purl_name) — deliberately drops qualifiers so DT 4.13→4.14 upgrades that add distro=... don't invalidate every match. Ambiguous matches (multi-arch SBOMs with the same component at different qualifiers) emit an entry in warnings. Read-only.

Args: source_project_uuid: Old version UUID (usually with existing triage). target_project_uuid: New version UUID. include_analysis: Load current analysis for each source finding (needed for carry_over; adds one HTTP call per finding).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
source_project_uuidYes
target_project_uuidYes
include_analysisNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses read-only nature, component matching logic (dropping qualifiers), handling of ambiguous matches (warnings), and the meaning of 'reason' fields. This is comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat lengthy but well-structured with a list and detailed explanations. Every sentence adds value, though it could be slightly more concise for a quick scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of the tool (four output categories, matching logic, warnings) and the presence of an output schema, the description covers the key behavioral aspects and output structure. It doesn't explain the exact output schema fields, but that is presumably handled by the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add meaning. It explains 'source_project_uuid' as old version UUID with existing triage, 'target_project_uuid' as new version UUID, and 'include_analysis' as needed for carry_over with a performance note. This adds significant value beyond the schema's title and type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Compute' and the resource 'carried / updated_component / new / gone', which specifically distinguishes it from siblings like carry_over_triage. It explains the four categories and their meanings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a typical use case (upgrading product v1→v2) and explains the roles of source and target. States it's read-only. Does not explicitly list when not to use, but context with siblings implies differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/drewrukin/dtrack-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server