mcp-skylos

Overview Schema Source Related Servers Discussions Admin

Verify an edited file or range

verify_change

Read-only

Verify a changed file or line range to detect AI-code defects (hallucinations, unfinished code) and security bugs (secrets, vulnerabilities). Returns a JSON verdict.

Instructions

Verify a changed file/range for AI-code defects and security bugs.

Returns a narrow, versioned JSON verdict containing AI-code trust findings such as hallucinated references, unfinished generated code, stale references, disabled controls, and dependency hallucinations (checked by default; pass include_dependency_hallucinations=False to skip the registry lookups), plus high/critical security findings (category "security") and hard-coded secrets (category "secret", values redacted) in the selected file/range. Pass include_security_findings=False to skip the security and secret checks.

Requires SKYLOS_API_KEY: this tool returns an authentication error unless the MCP server is started with SKYLOS_API_KEY set. Without a key only analyze works (5 calls/day). The local CLI needs no key: skylos verify <file> and skylos agent install-hooks.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`file`	No	File inside `path` to check; omit to check `path`.
`path`	No	Project root, or a single file to check.	.
`confidence`	No	Minimum confidence (0-100) for dead-code findings. Higher values report fewer, surer candidates; 60 is the CLI default.
`line_range`	No	Lines to check in `file`, as "START:END" or "START-END" (e.g. "10:40"), or one line number.
`contract_path`	No	Path to a repo-specific AI-code contract file; omit to use the project's default contract if it has one.
`exclude_folders`	No	Extra folder names to skip, comma-separated (e.g. "migrations,scripts"). Added to the default excludes.
`project_context`	No	Also load the rest of the project to resolve cross-file references (slower; may reduce unresolved-reference findings).
`contract_enabled`	No	False disables contract discovery and checks. Omit contract_path when False; combining them is rejected.
`include_security_findings`	No	Include high and critical security findings and hard-coded secrets in the verdict.
`include_dependency_hallucinations`	No	Check imported packages against the package registries. False skips these network calls.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Addedv4.49.0Oct 14, 2026

TDQS

A4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/openWorld/destructive annotations: it discloses the SKYLOS_API_KEY requirement and that an auth error is returned without it, notes the registry network lookups, states that secret values are redacted, and mentions the versioned JSON verdict shape and CLI alternative.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the paragraphs are organized by capability, output, and auth. Some content (default-on toggles, category names) overlaps with the schema descriptions, but the length is largely justified by the operational constraints it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with an output schema and annotations, the description covers the important operational gaps: authentication, network behavior, redaction, and finding categories. It omits explicit sibling-routing guidance, which is the main remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage the baseline is 3, but the description adds real meaning for the two toggle parameters: include_dependency_hallucinations=False skips registry lookups and include_security_findings=False skips security/secret checks, clarifying the cost/behavior tradeoff of each.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (verify a changed file/range) and enumerates the concrete finding classes it returns (hallucinated references, unfinished code, secrets, security findings). However, it does not differentiate itself from similar siblings such as verify_dead_code, security_scan, or quality_check, so the agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for the operation and a partial routing hint (without an API key only `analyze` works), plus how to toggle checks off. It stops short of stating when to prefer this tool over the many overlapping siblings (verify_dead_code, security_scan, provenance_scan), leaving that to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server