Skip to main content
Glama

🐘 phpustik β€” MCP Server for PHP

AI'nin PHP gâzü, kulağı ve eli olacak.

MCP Sunucusu · Tek npx ile AI asistanınıza PHP runtime, statik analiz, güvenlik taraması, test koşucusu, Composer ve framework entegrasyonu kazandırır.

🏷️ MCP Server | PHP Tools | AI Integration | Static Analysis | Composer | Laravel | Symfony
"The bridge between AI assistants and the PHP ecosystem."


Production-grade MCP server that gives AI assistants deep visibility into the entire PHP ecosystem β€” runtime, linting, static analysis, security, testing, Composer and framework tools.
Works with Claude Desktop, Cursor, Claude Code, Opencode, Cline and any MCP-compatible client.

npm version MIT License Node CI semantic-release MCP Tools Resources Prompts

A Model Context Protocol server for PHP β€” written in TypeScript, shipped as a single npx-able package, battle-tested on Windows, macOS and Linux.
🎯 Vision: Make every AI assistant a PHP expert β€” no Config, no Setup, just npx phpustik.

Features Β· Installation Β· Usage Β· Tools Β· Resources Β· Prompts Β· Integrations


πŸ“‘ Table of contents


Related MCP server: symfony-php-mcp

πŸ’‘ Why phpustik?

AI assistants like Cursor, Claude Desktop, Claude Code and Opencode are increasingly good at writing PHP, but they remain blind to the runtime they target:

  • They don't know which PHP version is installed.

  • They cannot run php -l to catch a missing semicolon.

  • They cannot invoke PHPStan, Psalm, PHP-CS-Fixer, PHPUnit, Rector, PHPMD, PHPCS…

  • They cannot manage Composer packages, audit security, or detect the framework.

  • They cannot run Laravel artisan or Symfony console commands.

phpustik closes that gap. It is a self-contained MCP server that exposes 31 tools, 8 resources and 7 prompts to the model β€” across runtime, static analysis, security, testing, refactoring, dependency management and framework integration.

It is:

  • Production-ready β€” strict TypeScript, no any, exhaustive error handling, structured logs.

  • Cross-platform β€” Windows, macOS, Linux, WSL. Path handling is normalised centrally.

  • Safe by default β€” execFile (no shell), deterministic timeouts, output capping, isError: true on every failure.

  • Honest β€” if a binary is missing, the model is told exactly which command to run.


πŸ“¦ What's inside

Category

Count

Examples

πŸ›  Tools

33

get_php_info, analyze_php_code, composer_audit, scan_secrets, laravel_routes, phpustik_doctor, phpustik_init

πŸ“š Resources

8

php://info, phpustik://workspace, phpustik://composer-json

πŸ’¬ Prompts

7

review_php_code, security_audit, upgrade_php

🧰 PHP tools wired

11

PHP, Composer, PHPStan, Psalm, PHPMD, PHPCS, PHPMND, Rector, PHP Insights, PHPCPD, PHPUnit

πŸš€ Killer features

2

phpustik_doctor (one-shot health check) + phpustik_init (project bootstrap)

πŸ“‘ MCP v2 features

3

Logging notifications, progress reporting, cancellation


✨ Features

Area

What you get

MCP protocol

Implements McpServer with the v2 high-level registerTool API.

Transport

StdioServerTransport for first-class integration with every major MCP client.

Validation

Zod v4 input validation on every tool β€” invalid calls are rejected before any IO.

MCP logging

Real-time notifications/message updates while long tools run.

Progress

notifications/progress for multi-step operations (phpustik_doctor, phpustik_init).

Cancellation

AbortSignal-aware; long ops are tracked and can be killed if the user cancels.

Structured output

structuredContent on key tools β€” model iterates typed data, not Markdown tables.

Error UX

Friendly, actionable messages for missing binaries, timeouts, permission errors.

Cross-platform

POSIX, Windows, UNC, WSL, file:// and ~-prefixed paths accepted and normalised.

Security

No shell: true, no eval, capped output buffers, secrets never logged.

Observability

Stderr-only logger with PHPUSTIK_LOG_LEVEL (debug/info/warn/error).

Workspace-aware

Auto-detects project root from composer.json / phpstan.neon / artisan / bin/console.

Framework-aware

Auto-detects Laravel, Symfony, WordPress, CodeIgniter, Yii, Slim, Laminas, Phalcon, CakePHP.

Caching

TTL cache for expensive ops (composer info, phpstan, audits) β€” 60 s default.

Distribution

bin field + files whitelist β†’ npm i -g phpustik or npx phpustik.

CI / Release

GitHub Actions matrix (3 OS Γ— 3 Node versions), semantic-release.


🩺 Killer features

phpustik_doctor β€” one-shot health check

A single tool call that runs the entire PHP quality pipeline and produces a prioritised Markdown + JSON report.

{
  "tool": "phpustik_doctor",
  "arguments": {
    "category": "all",
    "failOn": "high",
    "skipTests": false,
    "fix": false,
    "json": false
  }
}
  • Runs composer validate, composer audit, analyze_php_code, run_phpcs, run_phpmd, run_phpunit, scan_secrets, scan_vulnerable_functions, scan_sql_injection, scan_xss, check_php_compatibility, suggest_refactoring, get_php_ini, detect_framework, get_php_info β€” in order, with progress notifications.

  • Returns a unified Markdown report plus a typed DoctorReport structured content (overall status, per-check severity, fixable count, recommendations).

  • failOn lets the model or CI fail at a configurable severity threshold.

  • json: true mode for CI pipelines (returns only the structured content).

  • category: security|quality|style to run a targeted subset.

phpustik_init β€” project bootstrap

Generates optimal config files for a PHP project, tailored to its framework and PHP version.

{
  "tool": "phpustik_init",
  "arguments": {
    "dryRun": true,
    "force": false,
    "phpstanLevel": "5",
    "psalmLevel": "4",
    "phpVersions": "8.1,8.2,8.3,8.4"
  }
}
  • Detects composer.json, composer.lock, framework, PHP version.

  • Generates up to 11 config files: phpstan.neon, psalm.xml, .php-cs-fixer.php, rector.php, phpmd.xml, phpcs.xml, phpunit.xml, .editorconfig, .gitattributes, .github/workflows/ci.yml, bin/pre-commit.

  • All templates hand-tuned for low false-positive rate, modern PHP, PSR-12 + strict types.

  • dryRun: true (default) shows a unified diff without touching disk.

  • force: true overwrites existing files; default is "keep what's there".

  • only: "phpstan.neon,phpunit.xml" restricts to a subset.


πŸ— Architecture

β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”    JSON-RPC over stdio    β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
β”‚   MCP client         β”‚  ◀────────────────────▢   β”‚              phpustik server           β”‚
β”‚ (Cursor / Claude /   β”‚                          β”‚            (TypeScript, ESM)            β”‚
β”‚  Opencode / Cline)   β”‚                          β”‚                                        β”‚
β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜                          β”‚  33 tools β”‚ 8 resources β”‚ 7 prompts    β”‚
                                                   β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                                                                      β”‚
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚                          β”‚                            β”‚                                β”‚
        β–Ό                          β–Ό                            β–Ό                                β–Ό
   β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
   β”‚  php   β”‚  β”‚ composerβ”‚ β”‚  phpstan / β”‚  β”‚  phpcs /   β”‚  β”‚  rector /    β”‚  β”‚  laravel /   β”‚  β”‚  pattern    β”‚
   β”‚  -v -m β”‚  β”‚  *      β”‚ β”‚  psalm /   β”‚  β”‚  phpmd /   β”‚  β”‚  insights /  β”‚  β”‚  symfony     β”‚  β”‚  scanner    β”‚
   β”‚  -l -i β”‚  β”‚         β”‚ β”‚  phpmnd    β”‚  β”‚  phpcpd    β”‚  β”‚  phpcpd      β”‚  β”‚  console     β”‚  β”‚  (secrets,  β”‚
   β”‚  -r    β”‚  β”‚         β”‚ β”‚            β”‚  β”‚            β”‚  β”‚              β”‚  β”‚              β”‚  β”‚  SQLi, XSS) β”‚
   β””β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜  β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜

Source layout

src/
β”œβ”€β”€ index.ts                 # entry point
β”œβ”€β”€ server.ts                # bootstrap (tools + resources + prompts)
β”œβ”€β”€ constants.ts             # binary names, install hints, timeouts
β”œβ”€β”€ prompts.ts               # 7 MCP prompts
β”œβ”€β”€ resources.ts             # 8 MCP resources
β”œβ”€β”€ tools/
β”‚   β”œβ”€β”€ get-php-info.ts
β”‚   β”œβ”€β”€ lint-php-file.ts
β”‚   β”œβ”€β”€ analyze-php-code.ts
β”‚   β”œβ”€β”€ format-php-code.ts
β”‚   β”œβ”€β”€ run-php-script.ts
β”‚   β”œβ”€β”€ show-opcache-status.ts
β”‚   β”œβ”€β”€ get-extension-info.ts
β”‚   β”œβ”€β”€ get-php-ini.ts
β”‚   β”œβ”€β”€ check-php-compatibility.ts
β”‚   β”œβ”€β”€ run-phpunit.ts
β”‚   β”œβ”€β”€ run-psalm.ts
β”‚   β”œβ”€β”€ run-phpmd.ts
β”‚   β”œβ”€β”€ run-phpcs.ts
β”‚   β”œβ”€β”€ run-phpmnd.ts
β”‚   β”œβ”€β”€ run-phpcpd.ts
β”‚   β”œβ”€β”€ run-phpinsights.ts
β”‚   β”œβ”€β”€ run-rector.ts
β”‚   β”œβ”€β”€ composer.ts          # 9 composer_* tools
β”‚   β”œβ”€β”€ scan-security.ts     # 4 scan_* tools
β”‚   β”œβ”€β”€ codegen.ts           # add_strict_types, generate_phpdoc, suggest_refactoring
β”‚   β”œβ”€β”€ framework.ts         # detect + Laravel + Symfony tools
β”‚   β”œβ”€β”€ doctor.ts            # phpustik_doctor
β”‚   └── init.ts              # phpustik_init
└── utils/
    β”œβ”€β”€ executor.ts          # execFile wrapper, no shell, timeouts
    β”œβ”€β”€ paths.ts             # cross-platform path normalisation
    β”œβ”€β”€ logger.ts            # stderr-only structured logger
    β”œβ”€β”€ responses.ts         # uniform MCP tool responses
    β”œβ”€β”€ workspace.ts         # project root auto-detection
    β”œβ”€β”€ framework-detector.ts
    β”œβ”€β”€ patterns.ts          # secrets / SQLi / XSS / vuln-func catalogues
    β”œβ”€β”€ scan-runner.ts       # pattern-scan engine
    β”œβ”€β”€ file-scanner.ts      # FS walker with skips
    β”œβ”€β”€ cache.ts             # TTL cache
    β”œβ”€β”€ active-ops.ts        # AbortController registry for cancellation
    β”œβ”€β”€ notification-sink.ts # MCP logging/progress bridge
    └── config-templates.ts  # init tool generators

βœ… Prerequisites

Software

Minimum

Required for

Node.js

20.0 LTS

Running the MCP server

npm

10 (bundled)

Package manager (or pnpm/yarn)

PHP

8.0+

All PHP-runtime tools

Composer

2.x

composer_* tools

PHPUnit

10+

run_phpunit

PHPStan

1.x or 2.x

analyze_php_code (recommended)

Psalm

5+

run_psalm

PHPMD

2.x

run_phpmd

PHPCS

3.x

run_phpcs

PHPMND

3.x

run_phpmnd

Rector

1.x

run_rector

PHP Insights

2.x

run_phpinsights

PHPCPD

6+

run_phpcpd

PHP-CS-Fixer

3.x

format_php_code

All of these are optional β€” phpustik will tell you which to install when a tool needs a missing binary.

Quick check

node -v     # v20 or higher
php -v      # PHP 8.0 or higher
composer --version

πŸ›  Installation

1. Install PHP

OS

Command

macOS

brew install php

Ubuntu/Zorin

sudo apt-get install -y php-cli php-mbstring php-xml

Fedora

sudo dnf install -y php-cli

Alpine

sudo apk add php php-mbstring

Windows

Download from https://windows.php.net/download/ or winget install PHP.PHP.8.3

2. Install Composer

# macOS / Linux / WSL
curl -sS https://getcomposer.org/installer | php
sudo mv composer.phar /usr/local/bin/composer

# Windows (PowerShell)
Invoke-WebRequest https://getcomposer.org/installer -OutFile composer-setup.php
php composer-setup.php
Move-Item composer.phar C:\Program Files\composer\composer.exe
composer global require \
    phpstan/phpstan \
    vimeo/psalm \
    phpmd/phpmd \
    squizlabs/php_codesniffer \
    povils/phpmnd \
    sebastianbergmann/phpcpd \
    nunomaduro/phpinsights \
    rector/rector \
    friendsofphp/php-cs-fixer \
    phpcompatibility/php-compatibility

Make sure ~/.composer/vendor/bin (Linux/macOS) or %USERPROFILE%\Composer\vendor\bin (Windows) is on your PATH.

4. Install phpustik

# Option A: run on demand
npx -y phpustik

# Option B: install globally
npm install -g phpustik
phpustik

πŸš€ Usage

Quick start with npx

npx -y phpustik

You'll see on stderr:

[INFO] server.boot {"name":"phpustik","version":"1.0.0"}
[INFO] server.php_detected {"version":"PHP 8.3.6 (cli)"}
[INFO] server.ready {"transport":"stdio"}

Local development

git clone https://github.com/halitartuc/phpustik.git
cd phpustik
npm install
npm run dev          # tsx, no build

Inspect with the MCP Inspector

npm run inspect

This opens a local web UI where you can call every tool by hand.


πŸ›  Tools (33)

All tools accept JSON Schema (Zod-validated) input and return MCP text content (and, where useful, a typed structuredContent companion). Tools marked ⚠️ are destructive (they modify the filesystem). Tools marked πŸ”’ require project-level configuration.

πŸ” PHP Runtime & Environment (5)

Tool

Purpose

get_php_info

PHP sΓΌrΓΌmΓΌ, modΓΌller, INI.

show_opcache_status

OPcache + JIT (PHP 8+) durumu.

get_extension_info

Tek bir eklentinin fonksiyon/sabit/INI detayΔ±.

get_php_ini

Aktif php.ini, tarama dizini, direktifler.

check_php_compatibility

PHPCompatibility ile hedef PHP sΓΌrΓΌm denetimi.

πŸ§ͺ Linting, Formatting & Syntax (4)

Tool

Purpose

lint_php_file

php -l ile sΓΆzdizimi denetimi.

run_phpcs

PHP_CodeSniffer (PSR12, Squiz, vb.). fix=true ile otomatik dΓΌzeltme.

format_php_code

PHP-CS-Fixer (PSR-12) β€” dry-run veya apply.

add_strict_types

Dosyaya declare(strict_types=1); ekler.

πŸ“ Static Analysis (6)

Tool

Purpose

analyze_php_code

PHPStan seviye 0–max.

run_psalm

Psalm seviye 1–8.

run_phpmd

Mess Detector (karmaşıklık, unused code, design).

run_phpmnd

Magic number tespiti.

run_phpcpd

Copy-paste tespiti.

run_phpinsights

Genel kod kalite skoru (Code / Architecture / Style / Complexity).

πŸ›  Refactoring & Codegen (3)

Tool

Purpose

run_rector

Otomatik refactoring β€” dryRun=true ΓΆnizleme. ⚠️

generate_phpdoc

Eksik PHPDoc bloklarΔ±nΔ± raporlar.

suggest_refactoring

Uzun metod, god class, derin nesting heuristik ΓΆnerileri.

▢️ Execution & Testing (2)

Tool

Purpose

run_php_script

İzole temp dosyada PHP kodu çalıştır. ⚠️

run_phpunit

PHPUnit testleri (filter, testdox, coverage).

πŸ“¦ Composer (9)

Tool

Purpose

composer_info

YΓΌklΓΌ paketler / belirli paket bilgisi.

composer_validate

composer.json doğrulama.

composer_audit

Bilinen CVE taramasΔ±.

composer_outdated

GΓΌncellenmesi gereken paketler.

composer_require

Paket ekle. ⚠️

composer_remove

Paket kaldır. ⚠️

composer_install

composer install. ⚠️

composer_update

composer update. ⚠️

composer_dump_autoload

composer dump-autoload.

πŸ” Security (4)

Tool

Purpose

scan_secrets

Hardcoded API key, private key, token, basic-auth URL.

scan_vulnerable_functions

eval(), system(), unserialize(), weak hash, extract().

scan_sql_injection

Query string concatenation, whereRaw, DB::statement.

scan_xss

Unescaped echo $_GET, Blade {!! !!}, Twig `

πŸ— Framework Integration (7)

Tool

Purpose

detect_framework

Laravel / Symfony / WordPress / … otomatik tespit.

laravel_artisan

php artisan <command> çalıştır. ⚠️

laravel_routes

TΓΌm route'lar (method, uri, name, action, middleware).

laravel_migrations

php artisan migrate:status.

symfony_console

bin/console <command>. ⚠️

symfony_container

debug:container ile servis listesi.

πŸš€ Meta-tools (2)

Tool

Purpose

phpustik_doctor

Tek çağrıda tüm kalite/güvenlik/test kontrollerini çalıştırır, priorize rapor dâner.

phpustik_init

PHPStan / Psalm / Rector / phpcs / phpunit / .editorconfig / .gitattributes / CI workflow ΓΌretir.


πŸ“š Resources (8)

Resources are server-side data the model can read on demand to enrich its context. No parameters required.

URI

MIME

Description

phpustik://workspace

text/plain

Aktif proje ΓΆzeti (root, config dosyalarΔ±).

phpustik://composer-json

application/json

composer.json içeriği.

phpustik://composer-extra

application/json

composer.json extra bloğu.

phpustik://php-version

text/plain

.php-version içeriği.

phpustik://framework

application/json

Tespit edilen framework + sΓΌrΓΌm.

php://info

text/plain

php -i Γ§Δ±ktΔ±sΔ± (ilk 200 satΔ±r).

php://extensions

text/plain

php -m (yΓΌklΓΌ eklentiler).

php://ini-loaded

application/json

Sistem + proje INI dosyalarΔ±.


πŸ’¬ Prompts (7)

Prompts are pre-baked, parameterised workflows the model can invoke.

Prompt

Arguments

Purpose

review_php_code

filepath, focus

PSR-12, gΓΌvenlik ve performans review.

explain_php_code

filepath, depth

SatΔ±r satΔ±r kod aΓ§Δ±klamasΔ±.

refactor_php_code

filepath, goal

Somut refactoring ânerileri + değişiklik ârnekleri.

write_phpunit_test

filepath, method?, coverage

PHPUnit testi ΓΌret.

write_pest_test

filepath, method?

Pest testi ΓΌret.

security_audit

path?

4'lü güvenlik taraması başlat.

upgrade_php

fromVersion, toVersion

PHP sΓΌrΓΌm yΓΌkseltme yol haritasΔ±.


πŸ”Œ Integrations

The server speaks stdio MCP β€” any client that supports MCP can use it.

Cursor

Settings β†’ MCP β†’ + Add new global MCP server:

{
  "mcpServers": {
    "phpustik": {
      "command": "npx",
      "args": ["-y", "phpustik"]
    }
  }
}

Claude Desktop

Edit claude_desktop_config.json:

{
  "mcpServers": {
    "phpustik": {
      "command": "npx",
      "args": ["-y", "phpustik"]
    }
  }
}

Claude Code (CLI)

claude mcp add phpustik -- npx -y phpustik
claude mcp list

Opencode

~/.config/opencode/mcp.json:

{
  "mcpServers": {
    "phpustik": {
      "command": "npx",
      "args": ["-y", "phpustik"]
    }
  }
}

Cline / Continue.dev

.vscode/cline_mcp_settings.json:

{
  "mcpServers": {
    "phpustik": { "command": "npx", "args": ["-y", "phpustik"] }
  }
}

βš™οΈ Configuration

All via env vars. Everything has a sensible default.

Variable

Default

Description

PHPUSTIK_LOG_LEVEL

info

debug / info / warn / error β€” stderr.

PHPUSTIK_CACHE_TTL

60000

Tool result cache TTL (ms).

PHPUSTIK_TIMEOUT_MS

30000

Default command timeout.

PHPUSTIK_PHPSTAN_BIN

phpstan

Override PHPStan binary path.

PHPUSTIK_PSALM_BIN

psalm

Override Psalm binary path.

PHPUSTIK_PHPCS_BIN

phpcs

Override PHPCS binary path.

PATH

β€”

The system PATH is used to find every PHP tool.


🧯 Troubleshooting

Common issues & fixes:

  • Make sure the MCP client config is valid JSON. Trailing commas break it.

  • Restart the MCP client after editing the config.

  • Run the server manually: npx -y phpustik. If it crashes, the issue is server-side.

composer global require phpstan/phpstan

Make sure ~/.composer/vendor/bin is on your PATH. Restart the terminal and the MCP client.

Add C:\php to Path in System Environment Variables, then restart the terminal and the MCP client.

The server sends logs to stderr and protocol frames to stdout. If your client shows nothing, set PHPUSTIK_LOG_LEVEL=debug and check its log panel.

npm install @cfworker/json-schema

It's a peer dep of the MCP SDK v2 alpha.


πŸ”’ Security

  • No shell: true. Every command runs through execFile β€” arguments are never parsed as shell.

  • Every tool input goes through Zod validation before any IO.

  • File-system access is read-only by default. Destructive tools are clearly marked ⚠️.

  • Output buffers are capped at 1 MiB per stream.

  • File contents are never logged β€” only paths and metadata.

Please report security issues privately β€” see SECURITY.md.


πŸ—Ί Roadmap

  • php -S managed dev server tool

  • phpdbg interactive debugging

  • php -d ini override preview

  • Docker image: phpustik/phpustik:latest with every tool pre-installed

  • HTTP/SSE transport for remote deployments

  • VS Code extension proxy

  • GitHub Actions annotation output for CI integration


🀝 Contributing

See CONTRIBUTING.md. Run npm run lint && npm run typecheck && npm run build before opening a PR.


πŸ“„ License

MIT β€” Β© 2024-2026 phpustik contributors.


πŸ™ Acknowledgements

Made with ❀️ for the PHP + AI community.

Available Tools

41 tools
add_strict_typesAdd declare(strict_types=1)A
DestructiveIdempotent

Bir PHP dosyasΔ±nΔ±n en ΓΌstΓΌne 'declare(strict_types=1);' ekler (yoksa). 'dryRun=true' ile ΓΆnizleme.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNoMevcut declare(strict_types=...) satırını değiştir.
dryRunNoSadece ΓΆnizleme. VarsayΔ±lan: true.
filepathYesHedef dosya. Γ–rnek: ./src/Foo.php

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds context beyond annotations: clarifies it only adds if not present ('yoksa'), and describes dryRun preview behavior. No contradiction with annotations. Could explicitly mention file modification side effect, but destructiveHint covers that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, efficient sentence with no redundant words. Front-loads key action and parameter usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple idempotent file modification tool with no output schema, the description fully explains the operation, parameter usage, and preview mode. No missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with descriptions. Description reinforces dryRun usage but adds little new meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb 'add' and resource 'declare(strict_types=1) to PHP file' clearly stated. Distinguishes from sibling PHP tools by focusing on a single, narrow operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies usage via context (add if missing, preview with dryRun) but does not explicitly state when to use or exclude alternatives. No direct siblings to compare, but could benefit from a note about prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_php_codeAnalyze PHP Code (PHPStan)B
Read-onlyIdempotent

PHPStan ile statik analiz yapar. Dosya veya dizin yolu alabilir. 'level' parametresi 0-9 veya 'max' olabilir.

ParametersJSON Schema
NameRequiredDescriptionDefault
levelNoPHPStan analiz seviyesi (0-9 veya 'max'). VarsayΔ±lan: maxmax
filepathYesAnaliz edilecek PHP dosyasΔ± veya dizini. Γ–rnek: ./src veya ./src/Foo.php
memoryLimitNoPHPStan iΓ§in PHP bellek limiti. VarsayΔ±lan: 512M512M
configurationNoİsteğe bağlı phpstan.neon / phpstan.neon.dist yapılandırma yolu.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds that the tool accepts file or directory paths and the level parameter range (0-9 or max), but does not disclose potential output format or installation prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, direct and front-loaded. Every word is necessary and no fluff is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters and no output schema, the description is too minimal. It omits expected output (e.g., analysis results), prerequisites (like autoload), and does not prepare the agent for potential edge cases or complex configurations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description summarizes what the schema already details (file/directory input, level values). It adds no new information beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool performs static analysis using PHPStan, distinguishing it from siblings like run_phpcs or run_psalm. It specifies the verb 'analiz yapar' and the resource (PHP code).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives such as lint_php_file, run_phpcs, or run_psalm. It only states what it does without context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_php_compatibilityCheck PHP Version CompatibilityB
Read-onlyIdempotent

PHPCompatibility standard'Δ± ile kodu belirli bir PHP sΓΌrΓΌmΓΌ iΓ§in denetler. Hem PHP hem de sΓΆzdizimi/semantik geriye/ileriye uyumsuzluklarΔ± yakalar.

ParametersJSON Schema
NameRequiredDescriptionDefault
filepathYesDenetlenecek dosya veya dizin. Γ–rnek: ./src veya ./src/Foo.php
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
targetVersionNoTest edilecek minimum PHP sΓΌrΓΌmΓΌ. VarsayΔ±lan: 8.1.8.1

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate the tool is read-only, idempotent, and non-destructive. The description adds that it catches backward/forward incompatibilities, but does not detail output format or if it modifies anything (though annotations imply no modification). Provides some additional context but not extensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, concise and to the point. However, it is not available in English, which may not be ideal for an English-speaking audience. It is front-loaded with the main purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the purpose but lacks details about the output (e.g., what the tool returns) and any setup requirements. Since there is no output schema, the description should mention the return format. It is adequate but incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all three parameters. The description does not add further meaning beyond what is in the schema, such as parameter syntax or examples. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool checks PHP code for compatibility with a specific PHP version using the PHPCompatibility standard, catching syntax/semantic backward/forward incompatibilities. This distinguishes it from sibling tools like lint_php_file or run_phpcs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives (e.g., run_phpcs, lint_php_file). It does not mention prerequisites or scenarios where it's appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_auditComposer AuditB
Read-onlyIdempotent

Proje bağımlılıklarında bilinen güvenlik açıklarını taramak için composer audit çalıştırır.

ParametersJSON Schema
NameRequiredDescriptionDefault
noDevNoDev bağımlılıklarını atla.
formatNoÇıktı formatı. Varsayılan: summary (âzet tablo).summary
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, indicating it is a safe, non-destructive operation. The description confirms it scans for vulnerabilities but adds no additional behavioral details beyond what annotations provide. With annotations covering the core traits, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys the tool's purpose. It is front-loaded and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description does not need to explain return values. Parameters are fully documented in the schema, and annotations cover safety. The description is sufficient for a simple audit tool, though it could mention output format options (covered in schema).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all three parameters, so the schema already documents them. The tool description does not add any extra meaning beyond the schema. Baseline is 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs `composer audit` to scan for known security vulnerabilities in project dependencies. It uses a specific verb and resource, distinguishing it from other composer tools like composer_install or composer_update. However, it does not explicitly differentiate from siblings, which would push it to a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or context for use. The purpose is clear, but usage context is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_dump_autoloadComposer Dump AutoloadB
Idempotent

composer dump-autoload çalıştırarak autoloader ânbelleğini yeniler.

ParametersJSON Schema
NameRequiredDescriptionDefault
apcuNoAPCu autoloader kullan.
optimizeNoOptimize edilmiş autoloader üret. Varsayılan: true.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
classmapAuthoritativeNoSadece classmap autoloader.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate the tool is idempotent and non-destructive. The description adds that it refreshes the cache, which is consistent. No additional behavioral details are disclosed beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately conveys the tool's action. It is front-loaded but may be too brief, sacrificing additional context that could improve clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and full schema coverage, the description provides the essential purpose. However, it lacks usage guidance and does not explain return values or side effects, which is acceptable since no output schema exists. Completeness is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all 4 parameters. The description does not add any parameter-specific meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs 'composer dump-autoload' to refresh the autoloader cache. This distinguishes it from sibling composer tools like install, update, and validate, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It does not mention prerequisites, typical scenarios, or when to avoid using it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_infoComposer InfoB
Read-onlyIdempotent

composer.json veya --package ile belirtilen paketin bilgilerini listeler. Yüklü sürüm, lisans, bağımlılıklar vb.

ParametersJSON Schema
NameRequiredDescriptionDefault
directNoSadece doğrudan bağımlılıkları gâster.
packageNoΔ°steğe bağlΔ± paket adΔ±. Belirtilirse sadece o paket iΓ§in bilgi dΓΆner. Γ–rnek: laravel/framework
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, providing a clear safety profile. The description adds behavioral context about listing info (version, license, dependencies), but this is expected and does not exceed what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the main action, and contains no extraneous information. Every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema, the description provides useful hints about the return value (installed version, license, dependencies). All three optional parameters are covered. It is sufficient for a simple read-only tool, though a bit more detail on the structure could enhance completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema itself documents all parameters. The description adds no additional meaning beyond naming the output categories (version, license, dependencies), which is already implied by the tool's purpose. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'listeler' (lists) and the resource (composer.json or a specified package). It mentions specific information categories (installed version, license, dependencies). However, it does not explicitly differentiate from sibling tools like composer_outdated, leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., composer_audit, composer_outdated). There is no indication of prerequisites or when not to use it, which is a significant gap given the number of composer-related sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_installComposer InstallB
DestructiveIdempotent

composer.json + composer.lock üzerinden bağımlılıkları kurar.

ParametersJSON Schema
NameRequiredDescriptionDefault
noDevNoDev bağımlılıklarını kurma.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
preferSourceNoPaket kaynaklarΔ±nΔ± (git) tercih et.
optimizeAutoloaderNoAutoloader optimizasyonu. VarsayΔ±lan: true.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive, idempotent, and open-world behavior. The description adds only 'installs dependencies' without detailing side effects like modifying the lock file or downloading packages. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. It is not verbose, but it could include more structure or additional lines for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and parameter descriptions are in the schema, the description covers the basic function but lacks detail on expected outcomes, such as whether the tool creates or updates the lock file, or what happens if composer.lock is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for each parameter. The tool description does not add extra meaning or context beyond what is already in the schema. Baseline score is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool installs dependencies via composer.json and composer.lock, which is a specific verb and resource. However, it does not differentiate from sibling tools like composer_update or composer_require, which also install dependencies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like composer_update (which updates lock file) or composer_require (which adds new packages). There are no when-to-use or when-not-to-use instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_outdatedComposer OutdatedB
Read-onlyIdempotent

composer.json kΔ±sΔ±tlamalarΔ±na gΓΆre gΓΌncellenmesi gereken paketleri listeler.

ParametersJSON Schema
NameRequiredDescriptionDefault
directNoSadece doğrudan bağımlılıkları listele.
formatNoÇıktı formatı.text
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to reiterate safety. The description adds no additional behavioral context beyond the annotations, which is acceptable but not improved upon.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that communicates the primary purpose without any extraneous words. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is somewhat incomplete for a tool with no output schema. It does not mention what the output format looks like (e.g., list of packages with versions) or how the 'format' parameter affects output. However, the tool is simple and the sibling list provides context. A more complete description would include return value details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The tool description itself does not add any parameter information, but the schema already describes each parameter adequately (direct, format, projectPath).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool lists packages needing updates based on composer.json constraints. It is a specific verb+resource combination. However, it does not explicitly distinguish itself from sibling tools like composer_audit, which checks for security vulnerabilities, so it loses a point for differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives such as composer_update or composer_audit. The context of use is implied but not explicitly stated, and there are no exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_removeComposer RemoveA
Destructive

Bir paketi composer.json'dan ve vendor/ dizininden kaldΔ±rΔ±r.

ParametersJSON Schema
NameRequiredDescriptionDefault
dryRunNoSadece ΓΆnizleme (--dry-run).
packageYesKaldΔ±rΔ±lacak paket. Γ–rnek: ramsey/uuid
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true, and the description explicitly states that removal occurs from both composer.json and vendor/, adding context beyond annotations. However, it does not mention potential side effects like updating composer.lock or handling dependencies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that directly communicates the core functionality with no wasted words, and it is front-loaded with the action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple schema and presence of annotations, the description is sufficiently complete for a standard composer remove operation. It could mention dryRun behavior but is not critically lacking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so all parameters are described in the schema. The description does not add any extra meaning or examples beyond what the schema provides, meeting the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Bir paketi composer.json'dan ve vendor/ dizininden kaldΔ±rΔ±r.' clearly states the action (removes) and the resource (package), and it distinguishes the tool from siblings like composer_require which adds packages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lacks explicit guidance on when to use this tool or when not to, and does not mention alternatives. However, the action is self-explanatory and the sibling context provides some implicit distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_requireComposer RequireB
Destructive

Bir paketi composer.json'a ekler. SΓΌrΓΌm kΔ±sΔ±tΔ± opsiyoneldir.

ParametersJSON Schema
NameRequiredDescriptionDefault
devNorequire-dev bΓΆlΓΌmΓΌne ekle.
dryRunNoSadece ΓΆnizleme (--dry-run).
packageYesEklenecek paket. Γ–rnek: ramsey/uuid:^4.7 veya nesbot/carbon
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, so the description's claim of adding a package aligns. The description adds no new behavioral context beyond what annotations provide, meeting the baseline for adequate transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two short sentences with no fluff. It front-loads the core action and adds one key constraint. Every word is informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema and annotations provided, the description is minimal but covers the basic action. However, it lacks context like the underlying composer command, side effects on composer.lock, or prerequisites (e.g., composer installed). It is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents parameters. The phrase 'SΓΌrΓΌm kΔ±sΔ±tΔ± opsiyoneldir' reiterates the optional version constraint already exemplified in the schema's package parameter description, adding no new semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool adds a package to composer.json and mentions version constraints are optional. The verb 'ekler' (adds) and resource 'composer.json' are specific. It distinguishes from sibling tools like composer_remove or composer_install through the explicit action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as composer_install, composer_update, or composer_remove. No conditions, prerequisites, or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_updateComposer UpdateB
Destructive

composer.json kısıtlamaları dahilinde bağımlılıkları günceller.

ParametersJSON Schema
NameRequiredDescriptionDefault
noDevNoDev bağımlılıklarını güncelleme.
packagesNoGüncellenecek paketler. Boş bırakılırsa tümü güncellenir.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
preferLowestNoEn düşük uyumlu sürümü tercih et (test için).
withAllDependenciesNo--with-all-dependencies (transitive).

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description states it updates dependencies, matching destructiveHint=true. Adds that it respects composer.json constraints, but annotations already convey write/modify nature. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence front-loading the core action. No superfluous text, but Turkish language may limit audience.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks details about return values, side effects (e.g., lock file update), or behavior when no packages specified. Minimal for a tool with 5 optional parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 5 parameters have descriptive schema descriptions (coverage 100%). Description adds no additional parameter meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'updates' and specific resource 'dependencies within composer.json constraints'. Distinct from sibling tools like composer_install (install from lock) and composer_require (add new packages).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives like composer_install or composer_outdated. Does not mention prerequisites or scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

composer_validateComposer ValidateB
Read-onlyIdempotent

composer.json dosyasını sâzdizimi ve şema hatalarına karşı doğrular.

ParametersJSON Schema
NameRequiredDescriptionDefault
strictNoStrict mod β€” name, version, licence zorunluluğu vb.
noCheckAllNoTΓΌm depolarΔ± kontrol etme.
noCheckLockNocomposer.lock kontrolΓΌnΓΌ atla.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
noCheckPublishNoYayΔ±nlanabilirlik kontrolΓΌnΓΌ atla.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, idempotent, non-destructive behavior. The description adds minimal transparency beyond stating validation, but does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence conveying the core purpose with no extraneous information. Highly concise and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters and no output schema, the description is too minimal. It lacks information about output format, behavior of flags, or typical use cases, making it incomplete for a tool of moderate complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description adds no parameter meaning beyond what the schema provides. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool validates composer.json for syntax and schema errors, specifying a distinct verb and resource. It differentiates from siblings like composer_audit or composer_install.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives (e.g., composer_audit). The description only states the core purpose, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_frameworkDetect PHP FrameworkB
Read-onlyIdempotent

Proje kΓΆkΓΌnΓΌ analiz ederek kullanΔ±lan PHP framework'ΓΌnΓΌ tespit eder (Laravel, Symfony, WordPress, vb.).

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool as read-only, idempotent, and safe. The description adds context about analyzing the project root and detecting specific frameworks, but does not disclose behavior such as what happens when no framework is found or if it scans all files. The description does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence with no extraneous words. It efficiently conveys the tool's purpose and scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks expected details about the return value or output format, which is important for a detection tool. It does not explain what the tool returns (e.g., framework name, version, confidence). No output schema is provided, so the description should compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for the single optional parameter 'projectPath'. The description mentions 'project root' which aligns with the parameter, but does not add new meaning beyond the schema's auto-detection hint. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects the PHP framework by analyzing the project root, listing specific examples (Laravel, Symfony, WordPress). This distinguishes it from sibling tools that focus on linting, testing, or package management.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention when not to use it or any prerequisites. Given the sibling context, it's implied for framework detection, but no explicit guidelines are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

format_php_codeFormat PHP Code (PHP-CS-Fixer)A
DestructiveIdempotent

PHP-CS-Fixer (PSR-12) ile bir PHP dosyasΔ±nΔ± formatlar. 'dryRun' true ise sadece diff gΓΆsterir, false ise dosyayΔ± yerinde gΓΌnceller.

ParametersJSON Schema
NameRequiredDescriptionDefault
dryRunNoSadece ΓΆnizleme diff gΓΆsterir (true). DosyayΔ± yazmak iΓ§in false kullanΔ±n.
filepathYesFormatlanacak PHP dosyasΔ±nΔ±n yolu. Γ–rnek: ./src/Foo.php
createBackupNoFormat ΓΆncesi orijinali geΓ§ici bir dizine yedekler. VarsayΔ±lan: false.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behaviors: dry-run mode vs actual write, backup option, and uses PHP-CS-Fixer. Annotations already indicate destructiveHint=true and idempotentHint=true; the description adds contextual detail about what happens in each mode, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys essential behavior without fluff. Every word is informative, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high schema coverage, lack of output schema, and clear annotations, the description covers all necessary behavioral aspects. No gaps remain for an agent to safely invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and already describes each parameter (dryRun, filepath, createBackup) in detail. The description adds minimal new information beyond restating the dry run behavior. Baseline 3 is appropriate as the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool formats a PHP file using PHP-CS-Fixer (PSR-12) and distinguishes between showing a diff (dryRun) and updating the file in place. This specific verb-resource pairing differentiates it from sibling tools like lint_php_file or run_phpcs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when dryRun is true vs false, which implies usage contexts. However, it does not explicitly contrast with alternative tools (e.g., lint_php_file for checks vs this for fixes) or state when not to use it. Still, the purpose is clear enough for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_phpdocGenerate PHPDocA
Read-onlyIdempotent

Bir PHP dosyasΔ±ndaki sΔ±nΔ±f ve metotlar iΓ§in eksik PHPDoc bloklarΔ±nΔ± raporlar.

ParametersJSON Schema
NameRequiredDescriptionDefault
filepathYesHedef dosya. Γ–rnek: ./src/Foo.php

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and idempotent behavior. The description adds no further behavioral insight beyond restating the action. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, focused sentence that clearly communicates the tool's purpose with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (one parameter, no output schema) and good annotation coverage, the description is sufficient to understand the tool’s function, though it could optionally mention the output format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add any extra meaning or constraints to the 'filepath' parameter beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('reports') and resource ('missing PHPDoc blocks for classes and methods'), and distinguishes this tool from sibling tools like 'analyze_php_code' which have broader scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, nor any mention of prerequisites or exclusions. The description does not help an agent decide between this and similar sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_extension_infoGet PHP Extension InfoA
Read-onlyIdempotent

Bir PHP eklentisinin sürümünü, fonksiyonlarını, sabitlerini, ini girişlerini ve bağımlılıklarını raporlar.

ParametersJSON Schema
NameRequiredDescriptionDefault
extensionYesSorgulanacak eklenti adΔ±. Γ–rnek: pdo, mysqli, opcache, intl, redis.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds context by specifying the exact information reported (version, functions, constants, etc.), which goes beyond the annotations. No contradictory behavior is mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded. It covers the main functionality without superfluous words. However, it could be slightly more structured by briefly listing the reported items.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description adequately lists the types of information returned. It provides a good understanding of what to expect. However, it does not mention error handling or behavior for missing extensions, which is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with a clear description and examples for the 'extension' parameter. The tool description does not add additional meaning beyond the schema, so it meets the baseline of 3. No extra parameter details are provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it reports version, functions, constants, ini entries, and dependencies of a PHP extension. The verb 'raporlar' (reports) and the specific resource ('PHP eklentisi') make the purpose unambiguous. It distinguishes from siblings like 'get_php_info' which covers general PHP configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing details about a specific PHP extension, but it does not explicitly state when to use this tool versus alternatives like 'get_php_info' or 'analyze_php_code'. No when-not-to-use conditions or alternative suggestions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_php_infoPHP Environment InfoA
Read-onlyIdempotent

Sistemdeki aktif PHP sürümünü, derleme bilgilerini, SAPI türünü ve yüklü modülleri dândürür. PHP kurulumunu doğrulamak için kullanılır.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive. Description adds listing of returned data (version, compile info, SAPI, modules) but no additional behavioral traits beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, first front-loads the action and output, second states purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Describes return data types (version, compile info, SAPI, modules) sufficient for understanding output without a schema. Could be more detailed about structure, but adequate for a simple diagnostic tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters in schema (0 params, 100% schema coverage). Description adds no parameter info, which is acceptable as there is none to document. Baseline 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specifically states the tool returns PHP version, compilation information, SAPI type, and installed modules. Purpose is to verify PHP installation, clearly differentiating from siblings like get_extension_info or get_php_ini.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states used to verify PHP installation, implying when to use. However, does not provide when-not-to-use or explicit contrasts with siblings, though the sibling context makes differentiation clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_php_iniGet PHP INI InfoA
Read-onlyIdempotent

Aktif php.ini yollarΔ±nΔ±, taranan dizinleri ve ΓΆnemli ini direktiflerini raporlar.

ParametersJSON Schema
NameRequiredDescriptionDefault
directiveNoΔ°steğe bağlΔ± olarak tek bir ini direktifinin değerini sorgula. Γ–rnek: memory_limit, max_execution_time.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint as true, indicating a safe, read-only operation. The description adds minor context (e.g., reports scanned directories) but reveals no additional behavioral traits beyond what annotations convey. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that directly states the tool's function. It is front-loaded with key actions (reports) and objects. Could benefit from structural elements like bullet points, but remains efficient and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one optional parameter and no output schema, the description provides reasonable context by listing what is reported (paths, scanned directories, important directives). It does not detail return format but sufficiently informs the agent about the output scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single optional parameter 'directive', which already explains its purpose with an example. The tool description adds no extra meaning beyond the schema, so baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it reports active php.ini paths, scanned directories, and important ini directives. The name 'get_php_ini' matches this purpose well, and it distinguishes from sibling tools like 'get_php_info' which likely covers broader PHP configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving PHP INI information but does not explicitly state when to use this tool over alternatives like 'get_php_info' or 'get_extension_info'. No exclusion criteria or context is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

laravel_artisanLaravel ArtisanA
Destructive

Laravel artisan komutlarını çalıştırır. Yalnızca Laravel projelerinde kullanın.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesArtisan komutu. 'list', 'migrate:status', 'route:list', 'config:show app' vb.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey readOnlyHint=false and destructiveHint=true, so the description's minimal addition ('runs commands') is adequate. No contradiction with annotations, but the description does not elaborate on side effects like filesystem changes or output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no fluff. It immediately states the purpose and constraint, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (running a command), the description covers the essentials. It could mention that the tool executes the command and returns output, but the schema and annotations fill most gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema covers 100% of parameters with descriptions, so the description does not need to add extra parameter info. However, it could mention that the command is executed in the project directory, but this is not necessary.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool runs Laravel artisan commands, with a specific verb and resource. It distinguishes itself from sibling tools like symfony_console or other PHP tools by specifying 'only in Laravel projects.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear when-to-use condition ('only in Laravel projects'), which helps the agent avoid misuse. It does not explicitly state when not to use it, but the sibling list implicitly provides alternatives. This is slightly above basic.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

laravel_migrationsLaravel Migrations StatusA
Read-onlyIdempotent

Laravel migration'larının çalıştırılıp çalıştırılmadığını listeler.

ParametersJSON Schema
NameRequiredDescriptionDefault
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is clear. The description adds that it lists migration status, but does not elaborate on what happens if no migrations are found or how the status is presented (e.g., pending vs run).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence in Turkish, front-loaded with the action and resource. No wasted words; every part contributes to understanding the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is simple, has one optional parameter, rich annotations, and no output schema, the description is nearly complete. It could hint at the return format (list of migrations with status), but the name and context suffice for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single optional parameter 'projectPath' described. The description adds no further meaning beyond the schema, so it meets the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: listing whether Laravel migrations have been executed. The verb 'list' and resource 'migration status' are specific and distinguish it from sibling tools like 'laravel_artisan' or 'laravel_routes'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is provided. The context of sibling tools implies it is for checking migration status rather than running migrations, but the description lacks exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

laravel_routesLaravel RoutesA
Read-onlyIdempotent

Laravel uygulamasΔ±nΔ±n tΓΌm route'larΔ±nΔ± method, uri, name, action, middleware ile listeler.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoFiltre: route adΔ±nda ara (opsiyonel).
methodNoFiltre: GET, POST vb. (opsiyonel).
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the description does not need to restate safety. However, it adds no extra behavioral details beyond 'lists all routes' – no mention of output format or potential limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded, no wasted words. Effectively conveys the tool's function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only listing tool with optional filters and good annotation coverage, the description is adequate. It covers the essential purpose, though it lacks output format details (no output schema).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, meaning each parameter is already described in the input schema. The description adds no additional meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Lists all routes of the Laravel application with method, uri, name, action, middleware,' using a specific verb and resource. This distinguishes it from sibling tools like laravel_artisan and laravel_migrations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The name and description imply it is for viewing routes, but the absence of usage context is a gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lint_php_fileLint PHP FileA
Read-onlyIdempotent

Verilen bir PHP dosyasını sâzdizimi hatalarına karşı denetler (php -l). Sadece parse-time hatalarını yakalar, statik analiz yapmaz.

ParametersJSON Schema
NameRequiredDescriptionDefault
filepathYesLint edilecek PHP dosyasΔ±nΔ±n mutlak veya gΓΆreli yolu. Γ–rnek: ./src/Foo.php

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that it runs php -l, catches only parse-time errors, and does no static analysis, adding valuable behavioral context beyond the annotations (readOnlyHint, idempotentHint, destructiveHint). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences that front-load the action and key details without any unnecessary words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter, no output schema, and clear annotations, the description provides complete context: what it does, how it works, and its limitations. No gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single parameter 'filepath' with a clear description and example. The tool description does not add additional parameter semantics beyond what is in the schema, meeting the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states it checks a PHP file for syntax errors using php -l, and distinguishes itself by specifying it only catches parse-time errors and does not perform static analysis, clearly differentiating it from sibling tools like run_psalm or run_phpcs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by specifying the tool's scope (syntax-only, no static analysis), but it does not explicitly state when to use or when to prefer alternatives. Still, the clarity about limitations provides useful guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

phpustik_doctorPHP project health checkA
Idempotent

Tek Γ§ağrΔ±da composer, PHP runtime, statik analiz, stil, gΓΌvenlik ve test kontrollerini Γ§alıştΔ±rΔ±r. Γ–ncelikli, actionable bir rapor dΓΆner.

ParametersJSON Schema
NameRequiredDescriptionDefault
fixNoOtomatik dΓΌzeltilebilir olanlarΔ± uygula. VarsayΔ±lan: false.
jsonNoSadece structured JSON (text Γ§Δ±ktΔ±yΔ± gizle).
failOnNoBu seviyede ve ΓΌzerinde hata varsa overallStatus=fail. VarsayΔ±lan: high.high
categoryNoHangi kategorileri çalıştır: all | security | quality | style. Varsayılan: all.all
skipTestsNoPHPUnit atla (uzun sΓΌrer). VarsayΔ±lan: false.
projectPathNoProje kΓΆkΓΌ (otomatik tespit edilir).
phpstanLevelNoPHPStan seviyesi. VarsayΔ±lan: max.max

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate idempotent, non-destructive, open-world behavior. The description adds context by listing the types of checks performed (composer, runtime, static analysis, style, security, tests) and the output (prioritized report), which enriches the behavioral understanding beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, front-loaded with the core purpose. Every word adds value, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the overall purpose but does not detail the output format or structure (e.g., whether report is JSON or text, how issues are prioritized). Given no output schema, more detail would be beneficial, but the description is adequate for a straightforward tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with all 7 parameters having descriptions. The tool description does not add any additional parameter semantics beyond what the schema already provides, so baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs composer, PHP runtime, static analysis, style, security, and test checks in a single call, which is a specific verb+resource. It distinguishes itself from sibling tools that focus on individual checks (e.g., run_phpcs, composer_audit) by aggregating multiple checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as an all-in-one health check but does not explicitly state when to use this tool versus individual sibling tools, nor does it mention any prerequisites or exclusions. The context is clear but lacks explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

phpustik_initBootstrap PHP project configA
DestructiveIdempotent

Bir PHP projesi iΓ§in optimal config dosyalarΔ±nΔ± ΓΌretir: phpstan.neon, psalm.xml, .php-cs-fixer.php, rector.php, phpunit.xml, phpmd.xml, phpcs.xml, .editorconfig, .gitattributes, .github/workflows/ci.yml, bin/pre-commit.

ParametersJSON Schema
NameRequiredDescriptionDefault
onlyNoSadece belirli dosyalarΔ± ΓΌret (virgΓΌlle ayrΔ±lmış). Boş = hepsi. Γ–rnek: phpstan.neon,phpunit.xml
forceNoMevcut dosyalarΔ±n ΓΌzerine yaz. VarsayΔ±lan: false (ΓΌzerine yazmaz).
dryRunNoSadece ΓΆnizleme (default). apply=true ile dosyalara yaz. VarsayΔ±lan: true.
psalmLevelNopsalm.xml iΓ§in seviye. VarsayΔ±lan: 4.4
phpVersionsNoCI matrisinde test edilecek PHP sΓΌrΓΌmleri (virgΓΌlle). VarsayΔ±lan: 8.1,8.2,8.3,8.4.8.1,8.2,8.3,8.4
projectPathNoProje kΓΆkΓΌ (otomatik tespit edilir).
phpstanLevelNophpstan.neon iΓ§in seviye. VarsayΔ±lan: 5 (orta).5

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate idempotentHint=true and destructiveHint=true. The description states it 'produces' files, but relies on parameter descriptions (dryRun, force) to clarify behavior. It adds no extra context about side effects, permissions, or safety beyond what is in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that lists all generated files, making it concise and front-loaded. Every word serves a purpose, no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no output schema, the description covers the purpose and outcomes. It lists expected files. However, it could mention that dryRun defaults to true, but that is in parameter descriptions. Overall fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear parameter descriptions. The tool description adds no additional meaning beyond the schema for parameters. Baseline 3 is appropriate as the schema sufficiently explains each parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates optimal configuration files for PHP projects, listing specific files. The title 'Bootstrap PHP project config' reinforces the purpose. It distinguishes from sibling tools which are analysis or execution tools, not config generators.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when configuring PHP projects but does not explicitly state when to use or avoid this tool, nor does it mention prerequisites or alternatives among siblings. No guidance on when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpcpdRun PHP Copy-Paste Detector (PHPCPD)A
Read-onlyIdempotent

Tekrarlanan kod bloklarını tespit eder. Token tabanlı çalışır, küçük kod parçalarını yakalar.

ParametersJSON Schema
NameRequiredDescriptionDefault
filepathYesTaranacak dizin. Γ–rnek: ./src
minLinesNoMinimum satΔ±r sayΔ±sΔ± (varsayΔ±lan: 5).
minTokensNoMinimum token sayΔ±sΔ± (varsayΔ±lan: 50). Daha kΓΌΓ§ΓΌk bloklar gΓΆz ardΔ± edilir.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds that it is token-based and catches small code pieces, but no further behavioral traits are disclosed beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, concise, and front-loaded with the core purpose. Every word adds value, with no unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple detection tool, the description covers the basic purpose. However, it lacks details about output format, limitations (e.g., handling of large codebases), or typical use cases. The absence of an output schema increases the burden on the description, which is not fully met.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters are documented. The description adds minimal additional meaning (e.g., 'token based' relates to minTokens), but does not significantly enhance semantic understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool detects repeated code blocks and works token-based, which directly matches the name 'run_phpcpd'. Among sibling tools, none specialize in copy-paste detection, so it distinguishes well.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for finding duplicate code but does not explicitly state when to use this tool versus alternatives like run_phpmd or run_phpcs. No exclusions or context are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpcsRun PHP_CodeSniffer (PHPCS)C
Idempotent

PHP_CodeSniffer ile kod stili / PSR ihlallerini raporlar. 'fix' parametresi true ise otomatik dΓΌzeltme yapar (phpcbf).

ParametersJSON Schema
NameRequiredDescriptionDefault
fixNoOtomatik dΓΌzeltme uygula (phpcbf kullanΔ±r). VarsayΔ±lan: false.
filepathYesTaranacak dosya veya dizin. Γ–rnek: ./src
severityNoMinimum raporlama seviyesi. VarsayΔ±lan: warning.warning
standardNoKod stili standardı. Varsayılan: PSR12. Boş bırakılırsa phpcs.xml kullanılır.PSR12
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

C2.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that setting fix=true auto-corrects (modifies files), but annotations declare destructiveHint=false and idempotentHint=true. This is a direct contradiction: modifying files is destructive and potentially not idempotent. The annotation contradiction severely undermines trust.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no fluff. The key behavior (report/fix) is front-loaded. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 5 parameters and no output schema, the description is very brief. It fails to explain return format, error handling, or whether the tool outputs a report or just exit codes. For a code analysis tool, this is insufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds behavior for the 'fix' parameter beyond the schema, but does not elaborate on other parameters like filepath, severity, standard, or projectPath. Minimal extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports PHP coding style/PSR violations and optionally auto-fixes. Verb 'raporlar' (reports) is specific. However, it does not explicitly differentiate from sibling tools like run_phpmd or run_psalm, which have distinct purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied (admin wants to check coding style), but no explicit guidance on when to use this tool versus alternatives (e.g., run_phpmd for mess detection). No exclusions or when-not-to-use mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpinsightsRun PHP InsightsB
Idempotent

PHP Insights ile kod kalitesi, mimari, stil ve karmaşıklık üzerinden genel bir skor üretir.

ParametersJSON Schema
NameRequiredDescriptionDefault
fixNoInsights tarafΔ±ndan ΓΆnerilen stil dΓΌzeltmelerini uygula. VarsayΔ±lan: false.
productionNoÜretim modunda çalıştır (test dosyaları hariç). Varsayılan: false.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate idempotentHint=true and destructiveHint=false, which are consistent with generating a score. However, the description does not disclose any behavioral traits beyond the purpose, such as potential side effects if the fix parameter is used.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence in Turkish, concise and to the point. It lacks structure but contains no superfluous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has multiple optional parameters (including fix that may modify files) and no output schema, the description is incomplete. It does not explain the return value (the score format) or the effect of the fix parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters are fully documented in the input schema with descriptions, achieving 100% coverage. The tool description adds no additional meaning or context for parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool generates an overall score on code quality, architecture, style, and complexity using PHP Insights. This specifies the verb (generate) and resource (score), but does not explicitly distinguish from sibling tools like run_phpcs or run_phpmd.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, scenarios, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpmdRun PHP Mess Detector (PHPMD)B
Read-onlyIdempotent

PHPMD ile kod karmaşıklığı, kullanılmayan kod, tasarım sorunları ve adlandırma ihlallerini raporlar.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoÇıktı formatı. Varsayılan: text.text
filepathYesPHPMD tarafΔ±ndan taranacak dosya veya dizin. Γ–rnek: ./src
rulesetsNoKullanΔ±lacak kurallar. VarsayΔ±lan: cleancode,codesize,design,naming,unusedcode.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it's safe. The description adds value by specifying the specific analysis categories (complexity, unused code, design issues, naming), which go beyond the annotations and inform the agent about what behavioral checks are performed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no wasted words. It is front-loaded with the tool's purpose. However, it could be more comprehensive by mentioning the required filepath parameter without significantly increasing length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is minimal for a tool with multiple parameters and no output schema. It does not explain that results are returned in a configurable format (text, json, etc.), nor does it mention the need for a filepath or rulesets. Given the tool's complexity, more context is needed for an agent to use it effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters. The tool description does not add any additional meaning to the parameters beyond what the schema already provides. Thus, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports code complexity, unused code, design issues, and naming violations using PHPMD. It uses a specific verb ('reports') and resource ('code issues'), distinguishing it from sibling tools like run_phpcs (coding standards) or run_phpinsights (overall quality). However, it could be more explicit about the action of running PHPMD on a file/directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus other similar analysis tools (e.g., run_phpcs, run_phpinsights). There is no mention of prerequisites, context, or exclusions, leaving the agent to infer usage from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpmndRun PHP Magic Number Detector (PHPMND)B
Read-onlyIdempotent

SayΔ±sal sabitleri tespit eder ve bunlarΔ±n 'const' olarak tanΔ±mlanmasΔ±nΔ± ΓΆnerir.

ParametersJSON Schema
NameRequiredDescriptionDefault
excludeNoHariΓ§ tutulacak dizinler.
filepathYesTaranacak dosya veya dizin. Γ–rnek: ./src
extensionsNoDosya uzantΔ±larΔ±. VarsayΔ±lan: ['php'].
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is clear. The description adds that the tool detects numeric constants and suggests const definitions, which is consistent but does not disclose additional behaviors like output format or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one sentence, very concise. It front-loads the core purpose without unnecessary detail. However, it could be slightly more informative without sacrificing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only analysis tool, the combination of annotations and parameter descriptions covers safety and input. However, the description lacks context about output (e.g., whether it returns results inline or as a message) and does not explain how it fits into the workflow. The tool is functional but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, including explanations for filepath, exclude, extensions, and projectPath. The tool description does not add extra meaning beyond the schema; it merely summarizes the function. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool detects numeric constants and recommends defining them as const (suggesting refactoring). It is specific about the verb (detects) and resource (numeric constants), but it does not explicitly distinguish it from sibling tools like run_phpmd or run_phpcpd, which have different scopes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternative PHP analysis tools. It does not mention prerequisites, when not to use it, or how it compares to similar tools in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_php_scriptRun PHP ScriptA
Destructive

PHP kodunu izole bir temp dosyasında çalıştırır. Kısa betikler için uygundur, kalıcı projeler için tasarlanmamıştır.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesΓ‡alıştΔ±rΔ±lacak PHP kodu. <?php etiketi opsiyoneldir.
memoryLimitNomemory_limit ini değeri. Varsayılan: 256M256M
timeoutSecondsNoSaniye cinsinden wall-clock timeout. VarsayΔ±lan: 30.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations (destructiveHint=true, openWorldHint=true) indicate side effects and external access. Description adds context about isolation and temporary nature, but doesn't elaborate on cleanup or output behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with key action and environment, then usage guidance. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequately covers purpose, isolation, and usage scope. Could mention output capture or error handling, but not required for this simple tool given annotations and schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 3 parameters with descriptions. Description adds no parameter info beyond schema, meeting baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb ('çalıştırır' = runs) and resource ('PHP kodu' = PHP code) in an isolated temp file. It distinguishes from permanent projects, aiding selection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says suitable for short scripts and not for permanent projects, providing usage boundaries. Lacks explicit sibling tool alternatives but sets clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_phpunitRun PHPUnit TestsA
Read-onlyIdempotent

Proje için PHPUnit testlerini çalıştırır. Test yolu, filtre ve testdox formatı desteklenir. Coverage raporu opsiyoneldir.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoBelirli bir test dosyası veya dizini. Boş bırakılırsa phpunit.xml kullanılır.
filterNo--filter değeri. Γ–rnek: testUserCreation
testdoxNoΔ°nsan-okunabilir test listesi (--testdox). VarsayΔ±lan: true.
coverageNoCoverage raporu ΓΌret (Xdebug/PCOV gerekir).
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
coverageDriverNoCoverage sΓΌrΓΌcΓΌsΓΌ. PCOV daha hΔ±zlΔ±dΔ±r.pcov

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, indicating a safe, non-destructive operation. Description adds that it runs tests and supports coverage, which is consistent but does not significantly expand on behavioral traits beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is two sentences in Turkish, concise and to the point with no extraneous information. It efficiently communicates the tool's purpose and key features.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema covers all parameters and annotations provide safety context, the description adequately summarizes the tool's function. It mentions path, filter, testdox, and coverage, leaving out projectPath and coverageDriver but these are covered by schema. No output schema, but return values are standard test output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All 6 parameters have schema descriptions (100% coverage). The description summarizes key parameters (path, filter, testdox, coverage) but does not add new meaning beyond what is in the schema. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it runs PHPUnit tests for the project, with specific features like path, filter, testdox format, and optional coverage. It is distinct from sibling tools that are not focused on running PHPUnit tests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies usage for running PHPUnit tests but does not provide explicit guidance on when to use this tool versus alternatives or when not to use it. No exclusions or alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_psalmRun Psalm Static AnalysisB
Read-onlyIdempotent

Psalm ile statik analiz yapar. PHPStan'Δ±n tamamlayΔ±cΔ±sΔ±dΔ±r. Hata seviyesi 1-8 arasΔ± veya 'auto' olabilir.

ParametersJSON Schema
NameRequiredDescriptionDefault
levelNoPsalm hata seviyesi (1-8). VarsayΔ±lan: 4 (orta).4
threadsNoParalel iş parçacığı sayısı. Varsayılan: 4.
filepathYesPsalm ile analiz edilecek dosya veya dizin. Γ–rnek: ./src
showInfoNoinfo seviyesindeki uyarΔ±larΔ± da gΓΆster.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, covering safety. Description adds 'statik analiz yapar' (does static analysis) and the level range, but no extra behavioral traits like output format or permissions. With annotations, score 3 is baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, very concise with no extraneous words. Front-loaded: first sentence states core purpose. The second sentence adds complementarity and level range. Minor deduction for contradictory level info.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters and no output schema, description omits what the tool returns (e.g., error list, JSON, exit code). Static analysis tools typically produce output; failing to mention it leaves agents uncertain. Annotations cover safety but not completeness of context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. However, description claims level can be 'auto' while schema enum only includes '1'-'8', creating a contradiction. This reduces clarity for agents. No additional parameter meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states that the tool runs static analysis with Psalm, and distinguishes itself by noting it is complementary to PHPStan. The verb 'run' and resource 'Psalm' are specific. Sibling tools like run_phpcs, run_phpmd, run_phpinsights show differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description mentions 'PHPStan'Δ±n tamamlayΔ±cΔ±sΔ±dΔ±r' (complement to PHPStan) implying usage context, but does not explicitly state when to use this vs alternatives like run_phpcs or run_phpmd. No when-not-to or prerequisites provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_rectorRun Rector (Automated Refactoring)A
DestructiveIdempotent

Rector ile otomatik refactoring uygular (dryRun=false). 'rector.php' yapΔ±landΔ±rmasΔ± gerekir.

ParametersJSON Schema
NameRequiredDescriptionDefault
dryRunNoSadece değişiklik ânizlemesi (true). Uygulamak için false kullanın. Varsayılan: true.
filepathYesİşlenecek dosya veya dizin. Γ–rnek: ./src
clearCacheNoRector cache temizle. VarsayΔ±lan: false.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false. The description adds that dryRun=false is used (implying file modification) and requires a config file, but does not elaborate on side effects, required permissions, or what changes are made. It supplements annotations but does not deeply disclose behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise (two short sentences) and front-loaded with the core purpose. While it could include more context, it is efficient and avoids wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters, no output schema, and destructive behavior, the description leaves out details about output format, error handling, or post-run effects. However, annotations partially compensate (e.g., destructive hint). The tool is relatively simple, so the description is minimally acceptable but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with all parameters having descriptions. The tool description adds minimal value beyond reinforcing that dryRun=false is used. Given high schema coverage, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool applies automatic refactoring using Rector with dryRun=false, and requires a 'rector.php' configuration file. This differentiates it from siblings like 'suggest_refactoring' and provides specific, actionable information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for automated refactoring but does not explicitly state when to use this tool versus alternatives (e.g., suggest_refactoring) or when not to use it. No exclusions or alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_secretsScan for SecretsA
Read-onlyIdempotent

Proje kaynak kodunda hardcoded API key, private key, token ve şifre gibi hassas değerleri arar.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoTaranacak dizin veya dosya. Belirtilmezse proje kΓΆkΓΌ.
onlyPhpNoSadece .php dosyalarΔ±nΔ± tara. VarsayΔ±lan: false.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the agent knows it is safe and idempotent. The description adds what types of secrets are searched for but does not disclose other behavioral traits like recursion, binary file handling, or output format. With annotations covering safety, the description adds moderate value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently captures the tool's purpose. No fluff or redundant information. Perfectly front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given full schema coverage and informative annotations, the description is largely complete. It lacks details about return values or behavior on no results, but for a scanning tool with no output schema, this is acceptable. Slight gap in not mentioning file filtering or recursion depth.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema descriptions cover all three parameters (path, onlyPhp, projectPath) with 100% coverage. The tool description does not add any additional meaning beyond the schema definitions. Baseline of 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool scans project source code for hardcoded sensitive values like API keys, private keys, tokens, and passwords. It uses specific verbs ('arar' meaning searches) and a concrete resource (project source code). No other sibling tool focuses on secret scanning, so differentiation is implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for scanning secrets in source code. Sibling tools include other security scanners (scan_sql_injection, scan_xss, etc.), so context is clear but there is no explicit when-not-to-use or alternative guidance. A score of 4 is appropriate for clear context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_sql_injectionScan SQL Injection PatternsB
Read-onlyIdempotent

Sorgu oluştururken string birleştirme veya unsafe raw metodları kullanan kalıpları tespit eder.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoTaranacak dizin veya dosya.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate the tool is read-only and idempotent. The description adds that it scans for specific patterns, but does not elaborate on behavior beyond that. With annotations covering safety, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately conveys the tool's purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a scanner but the description does not explain the output format or what the results look like. Since there is no output schema, the description should provide this context, which is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are described in the schema. The description adds no extra meaning beyond the schema, so baseline 3 is given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool detects patterns of string concatenation or unsafe raw methods when creating queries, which specifically identifies SQL injection vulnerabilities. This distinguishes it from sibling tools like scan_xss.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternative security scanners. The description does not mention prerequisites, exclusions, or comparisons with siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_vulnerable_functionsScan Vulnerable FunctionsA
Read-onlyIdempotent

eval(), unserialize(), system() ve diğer güvensiz fonksiyonların değişken argümanlarla kullanımını tespit eder.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoTaranacak dizin veya dosya.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds behavioral context by specifying detection of 'variable arguments' usage, which goes beyond solely reading. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, complete sentence that conveys the essential purpose without any extraneous words. It is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks details about the output format or return value (no output schema). It does not explain scanning behavior like recursion or handling multiple files. For a security scanning tool, this is a notable gap, but the core functional description is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for both parameters, clearly explaining their purpose. The tool description does not add additional parameter-level information. Baseline 3 is appropriate since schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The tool's name is descriptive and the description explicitly lists specific vulnerable functions (eval, unserialize, system) and the condition 'with variable arguments.' This clearly distinguishes it from sibling tools like scan_secrets, scan_sql_injection, and scan_xss.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives. It lacks context about prerequisites, when not to use it, or typical use cases. No explicit when/when-not statements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_xssScan XSS PatternsA
Read-onlyIdempotent

Doğrudan superglobal çıktısı, Blade/Twig unescaped echo ve diğer XSS kalıplarını tespit eder.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoTaranacak dizin veya dosya.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it's safe and read-only. The description adds behavioral context by listing specific patterns it detects (superglobal output, Blade/Twig unescaped echo), which goes beyond the annotations. However, it does not disclose output format or potential side effects, but annotations cover the critical safety aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently conveys the tool's purpose and key detection targets. It is front-loaded with the verb and resource, contains no filler, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the schema coverage (100%) and annotations (read-only, idempotent), the description adequately explains what the tool does but does not describe the return values or format. Since no output schema exists, this leaves some uncertainty about how results are presented. The tool is straightforward, but completeness could be improved by mentioning output structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, with both parameters providing clear meaning (path and projectPath). The tool description does not add any further parameter semantics beyond what the schema already provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool detects XSS patterns, specifically citing direct superglobal output and unescaped echo in Blade/Twig. The verb 'detects' and the resource 'XSS patterns' make the purpose unambiguous. It distinguishes itself from sibling tools like scan_sql_injection or scan_vulnerable_functions by focusing on XSS.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for XSS scanning but does not explicitly state when to use this tool versus alternatives like scan_vulnerable_functions or scan_sql_injection. No direct when/when-not guidance is provided, leaving the agent to infer from the tool name and context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

show_opcache_statusShow OPcache / JIT StatusA
Read-onlyIdempotent

Aktif PHP CLI için OPcache ve JIT (PHP 8+) durumunu raporlar. opcache eklentisi yüklü değilse bildirir.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the agent knows it's safe. The description adds context that it reports specific status values and handles missing extension scenarios, which is useful behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence front-loaded with key information. No extraneous words; every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with no parameters and annotations covering safety, the description is complete: it fully explains what the tool reports and a key edge case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. Baseline for zero parameters is 4; description does not need to add parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it reports OPcache and JIT status for the active PHP CLI, and handles missing extension. This distinguishes it from siblings like get_php_info which provide broader PHP info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives like get_php_info or get_extension_info. The description only states what it does, not usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

suggest_refactoringSuggest RefactoringB
Read-onlyIdempotent

Uzun metod, god class, derin iç içe geçmiş kontrol yapıları ve kâtü kokular için heuristik âneriler üretir.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoTaranacak dizin veya dosya. Belirtilmezse proje kΓΆkΓΌ.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate the tool is read-only, idempotent, and non-destructive. The description adds that it generates heuristic suggestions, which implies no side effects, but provides no further behavioral context beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loaded. However, it is written in Turkish while the tool name and title are English, which may reduce clarity for some agents.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description should explain what kind of output to expect (e.g., list of suggestions). It does not, leaving the agent uninformed about the return format. Given the low complexity, a bit more detail would be warranted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the input schema already describes both parameters (path, projectPath). The description does not add any additional semantic value or examples beyond the schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies that the tool produces heuristic suggestions for long methods, god classes, deeply nested control structures, and code smells. It clearly states the verb (produces suggestions) and the resource (code smells), distinguishing it from sibling tools that analyze but do not suggest refactoring.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide guidance on when to use this tool versus alternatives like run_phpcs or run_phpmd, nor does it mention any exclusions or prerequisites. The agent has no context to differentiate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

symfony_consoleSymfony ConsoleB
Destructive

Symfony console komutlarını çalıştırır ('list', 'debug:container', 'cache:clear' vb.).

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesSymfony console komutu. Γ–rnek: 'debug:router', 'cache:clear --no-warmup'.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and idempotentHint=false. Description adds command examples but doesn't elaborate on behavioral traits beyond annotations. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with examples, no waste. Could be slightly more structured but effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and annotations present, description covers basic purpose. However, lacks mention of prerequisites (e.g., Symfony project) or expected side effects, leaving some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with detailed parameter descriptions. The tool description adds little beyond examples already in the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the verb 'çalıştırır' (runs) and the resource 'Symfony console komutları' with specific examples. It distinguishes from siblings like 'symfony_container' by focusing on running arbitrary console commands.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives (e.g., other Symfony tools like 'symfony_container'). The description only states what it does without context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

symfony_containerSymfony Container DebugB
Read-onlyIdempotent

Symfony service container'Δ±ndan belirli bir servis veya tΓΌm servis listesi hakkΔ±nda bilgi dΓΆner.

ParametersJSON Schema
NameRequiredDescriptionDefault
serviceNoTek bir servis adı (ârnek: 'App\\Service\\Mailer'). Boş bırakılırsa tüm servisler.
projectPathNoİsteğe bağlı proje kâkü (otomatik tespit edilir).
showArgumentsNoServis argΓΌmanlarΔ±nΔ± gΓΆster.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, idempotentHint=true, destructiveHint=false, which cover the safety profile. The description adds that it returns information, which is consistent but adds no new behavioral context beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that conveys the core purpose efficiently with no unnecessary words. It is appropriately sized for a simple read-only tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should explain the return format (e.g., structure of service info). It only says 'bilgi' (information) without specifying what details are included (class, tags, arguments, etc.), leaving the agent guessing about the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters have schema descriptions (100% coverage). The description's mention of 'specific service or all services' aligns with the 'service' parameter but does not add additional meaning beyond the schema's explanation of each parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns information about Symfony services, either specific or all. The verb and resource are specific, but the language is Turkish while the title is English, which may cause some confusion. It does not explicitly distinguish from sibling tools like symfony_console, but there are no other Symfony container-specific siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. No mention of prerequisites, when not to use, or which sibling tools might be more appropriate for different tasks (e.g., symfony_console for console commands).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.4/5.0
Disambiguation3/5

While tools have distinct descriptions, there is overlap among static analysis tools (analyze_php_code, run_psalm, run_phpcs, run_phpmd, run_phpinsights), security scanners (scan_secrets, scan_sql_injection, etc.), and multiple composer commands. An agent may struggle to choose between similar tools, though descriptions help differentiate them.

Naming Consistency4/5

The majority of tools follow a snake_case verb_noun pattern (e.g., add_strict_types, run_phpunit, scan_secrets). There is some variation (e.g., 'get_php_info' vs 'show_opcache_status'), but the conventions are predictable and readable.

Tool Count3/5

With 41 tools, the server covers a broad PHP development lifecycle but feels heavy. Many tools are specialized, and an agent might have too many choices. The count is borderline high for a single-purpose server.

Completeness4/5

The toolset is comprehensive, covering initialization, linting, static analysis, testing, refactoring, security scanning, framework helpers, and package management. Minor gaps exist, such as a dedicated project creation tool, but overall it is very complete.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Connects AI assistants like Claude to PHP's XDebug debugger for runtime inspection, breakpoint control, and variable tracking, enabling natural language debugging of PHP applications.
    6
    1
    Apache 2.0
  • A
    license
    A
    quality
    C
    maintenance
    A production-ready Model Context Protocol (MCP) server that bridges your Symfony/PHP project with LLMs such as Claude. It exposes tools that let the AI read your project's routes, services, Twig templates, and PHP source code.
    8
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Connects Claude or any MCP client to Laravel Herd, providing 218 tools to manage PHP development environments, Laravel projects, sites, services, database, and more through natural language.
    1
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/halitartuc/phpustik'

If you have feedback or need assistance with the MCP directory API, please join our Discord server