Skip to main content
Glama
Sign In
guardvibe

guardvibe

by goklab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

full_audit

Runs all security checks in one command—code scan, secret detection, dependency CVEs, config audit, taint analysis, and auth coverage—and returns a PASS/FAIL/WARN verdict with deterministic hash.

Instructions

Single command that runs ALL checks: code scan (429 rules), secret detection, dependency CVEs, config audit, taint analysis, and auth coverage. Returns PASS/FAIL/WARN verdict with deterministic hash. IMPORTANT: If verdict is FAIL or WARN, you MUST call remediation_plan next to get a section-by-section fix checklist — do NOT skip any section. After fixing, call verify_remediation to confirm ALL sections are addressed. Example: full_audit({path: '.'})

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "full_audit"
  }
}

Input Schema

NameRequiredDescriptionDefault
pathNoProject root directory.
formatNoOutput formatmarkdown
skipDepsNoSkip dependency vulnerability check
skipSecretsNoSkip secret scanning

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv3.66.0
    • removedInput schema / additionalProperties
      Removed value: -false
  2. Addedv3.35.1
  3. Removedv3.30.0
  4. Addedv3.1.6
  5. Removedv3.1.10
  6. Addedv3.0.42

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description does substantial work: it discloses the return verdict vocabulary (PASS/FAIL/WARN), the deterministic hash, the full set of checks performed, and a mandatory follow-up chain. It omits things an agent would still want, such as whether the scan is strictly read-only and the expected runtime/cost of running all checks at once.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the capability list, then the critical workflow rule, then an example — a sensible ordering. Slight redundancy between 'do NOT skip any section' and 'confirm ALL sections are addressed', and the '429 rules' detail is decorative, but nothing is wasted at length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must carry return semantics, and it does at the verdict level (PASS/FAIL/WARN plus hash). For a tool that aggregates six analyses, it says nothing about the structure or size of the report body, which is the main remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (path, format, skipDeps, skipSecrets) are already documented in the schema. The description only demonstrates path usage via the example and never mentions the skip flags or output format, so it adds little beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (single command running ALL checks) and enumerates exactly what those checks are: code scan with 429 rules, secret detection, dependency CVEs, config audit, taint analysis, and auth coverage. An agent can tell this is the aggregate entry point rather than one of the single-purpose scanners like scan_secrets or check_dependencies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Very explicit about the downstream workflow: on FAIL/WARN you MUST call remediation_plan, and after fixing, verify_remediation. That is strong conditional routing. It does not, however, say when to prefer this over siblings such as deep_scan, check_project, or security_workflow, so entry-point selection is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools