Skip to main content
Glama
Sign In
guardvibe

guardvibe

by goklab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

analyze_cross_file_dataflow

Track user input across module boundaries to detect injection vulnerabilities spanning multiple files. Pass file contents or a project directory for cross-file security analysis.

Instructions

Track user input flowing across module boundaries — detects injection vulnerabilities spanning multiple files. Pass files array with file contents. For single-file analysis, use analyze_dataflow instead. Example: analyze_cross_file_dataflow({files: [{path: 'src/api.ts', content: '...'}, {path: 'src/db.ts', content: '...'}]})

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "analyze_cross_file_dataflow"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathNoProject directory path. When provided, auto-discovers all JS/TS files — no need to pass file contents manually.
filesNoList of files to analyze (ignored when path is provided)
formatNoOutput formatmarkdown

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv3.66.0
    • removedInput schema / additionalProperties
      Removed value: -false
    • removedInput schema / properties / files / items / additionalProperties
      Removed value: -false
  2. Addedv3.35.1
  3. Removedv3.30.0
  4. Changed4 schema fields changedv3.0.42
    • addedInput schema / properties / files / default
      Added value: +[]
    • changedInput schema / properties / files / description
      Previous value: -"List of files to analyze: [{path, content}]"New value: +"List of files to analyze (ignored when path is provided)"
    • addedInput schema / properties / path
      Added value: +{
+  "description": "Project directory path. When provided, auto-discovers all JS/TS files — no need to pass file contents manually.",
+  "type": "string"
+}
    • removedInput schema / required
      Removed value: -[
-  "files"
-]
  5. First observedv0.1.0

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full disclosure burden. It does explain the analysis semantics (taint flow spanning files, injection detection), but says nothing about cost, file-count limits, permissions, or what happens when neither path nor files are supplied despite zero required parameters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose, then routing, then a concrete invocation example. The example earns its place by showing the nested file object shape; no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description is the only source of behavioral information, and it omits the return shape (findings structure, markdown vs json differences) and the file-count or performance envelope. Sufficient to invoke correctly, not sufficient to interpret results or anticipate cost.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with per-parameter descriptions, so the baseline is 3. The description reinforces the files array with a concrete example, but it instructs the agent to 'pass files array with file contents' while never mentioning the path auto-discovery mode, which the schema presents as the preferred option — a mild steer toward the more verbose input mode. It also ignores the format enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ('track user input flowing across module boundaries') plus the concrete vulnerability class it targets (cross-file injection). It is immediately distinguishable from the sibling analyze_dataflow, which it explicitly excludes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the condition that selects the alternative: 'For single-file analysis, use analyze_dataflow instead.' This is the when/when-not/alternative pattern, resolved in one sentence with no inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools