llm-code-security-review-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| load_planA | Load the supplied security-review plan before execution. |
| get_taskA | Issue or repeat the one current security-review task. Obey its execution_instruction: read source serially in one-file or <=300-line calls, submit report_done for mechanical coverage verification, then immediately call get_task {} again. |
| statusA | Return read-only authoritative review progress and diagnostics. After the server reports COMPLETE, call status {} and use only its diagnostics for final totals. |
| report_doneA | Submit the structured result. This call mechanically verifies source coverage and returns the exact missing read when incomplete. For NO FINDINGS, finding_ids, evidence, and artifacts must all be empty. For FINDING or CORROBORATION, include only concise source ranges needed to prove the security effect. After an accepted result, immediately call get_task {} and continue until COMPLETE; after COMPLETE, call status {} and use only its diagnostics for final totals. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool has a distinct role: load_plan initializes the review, get_task fetches the active task, status reports progress, and report_done submits results. Despite verbose instructions, the boundaries are clear and an agent should not confuse them.
load_plan and get_task follow a clean verb_noun pattern, and all names use lowercase snake_case. status is a bare noun and report_done uses an adjective complement rather than a noun object, so the pattern is not perfect but remains readable and predictable.
Four tools is well-scoped for a focused security-review orchestration server. Each tool maps to an essential phase of the workflow and none feels redundant or missing.
The tool surface covers the full intended lifecycle: load the plan, retrieve tasks, submit results, and check final status. There are no obvious dead ends or missing operations within the server's clearly defined orchestration purpose.