list_findingsRetrieve locally persisted security findings with optional status, target, or severity filters to support bug bounty triage and reporting.
List locally persisted findings with optional filters.
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | ||
| target | No | ||
| severity | No |
| Name | Required | Description | Default |
|---|---|---|---|
| count | Yes | ||
| findings | Yes |
Changes observed during successful MCP inspections.
v2.2.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered structurally. The description adds the useful fact that findings are 'locally persisted' (i.e., a local store, not a remote fetch), but says nothing about pagination, ordering, or result limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence with the object of the operation front-loaded and no filler. It is efficient, though at the cost of leaving filters and scope entirely unspecified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations carry the safety profile. However, for a retrieval tool with three undocumented filter parameters, the description leaves the agent guessing about what can be filtered and in what form, which is a meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 3 parameters, so the description must compensate and it does not — it only says 'optional filters' without naming status, target, or severity. The two enum parameters are partially self-documenting via their allowed values, but 'target' has neither a schema description nor any hint from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'List locally persisted findings'. The qualifier 'locally persisted' distinguishes it from network-scanning siblings and implies reading the findings store. It does not, however, explicitly differentiate from create_finding/update_finding vs. this read path, though the verb makes the distinction fairly evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of alternatives such as create_finding or update_finding for the write side. The 'optional filters' phrase implies a filtered retrieval context but never states when an agent should prefer this over other finding-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.