Scored across 17 tools
Several tools have genuinely distinct targets (analyze, security_scan, secrets_scan, quality_check, architecture_check, provenance_scan, change_map), but `validate_code_change` and `verify_change` both inspect a diff for security/dependency defects and are easy to confuse, as are `generate_fix` (deterministic dead-code patch) and `remediate` (LLM fixes). The overloaded `verify_` prefix spans three unrelated domains (dead code, AI agents, diffs), which muddies selection, and `health_score` overlaps with analyze/quality_check readouts.
Everything is snake_case and readable, but the convention is mixed: verb_noun (verify_change, get_security_context, generate_fix, learn_triage), noun_verb (security_scan, secrets_scan, quality_check, architecture_check), and bare nouns/verbs (analyze, remediate, health_score, change_map). The result is a set where you cannot infer from the name alone whether a tool scans, verifies, or reports.
17 tools is on the heavy side for one analysis server, and a few feel marginal or duplicative: health_score mostly aggregates outputs already available from analyze/quality_check, and learn_triage/get_triage_suggestions are a narrow pairing. It is justifiable for a broad static-analysis platform, but the surface is creeping toward overlap rather than crisp separation.
Coverage is broad: dead code, security, secrets, quality, architecture, AI-agent and provenance verification, diff validation, remediation, and triage learning, with full result retrieval documented via resources. Gaps are minor — no explicit way to manage suppressions/config (rules, ignore files) or compare against a baseline, though triage partially covers accepting/dismissing findings.