apsa

Overview Schema Source Related Servers Discussions Admin

reports_compare

Read-onlyIdempotent

Compare two report IDs to identify coverage differences and unproven remediation states, with optional source traces for verification.

Instructions

Compare exact report IDs, retaining coverage differences and unproven remediation states. verification=true adds source traces and scope/build/assertion pairing; portable_inputs=true requires verification and only normalizes absolute targets for identical, complete canonical SHA256 source inputs with unchanged analysis scope. Binary and runtime bindings remain strict; disappearance never proves remediation.

Input Schema

Name	Required	Description	Default
`after`	Yes
`before`	Yes
`verification`	No
`portable_inputs`	No

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.6.0Oct 18, 2026

addedInput schema / properties / portable_inputs

Added value: +{
+  "default": false,
+  "title": "Portable Inputs",
+  "type": "boolean"
+}

addedInput schema / properties / verification

Added value: +{
+  "default": false,
+  "title": "Verification",
+  "type": "boolean"
+}

First observedv1.0.3Oct 6, 2026

TDQS

A3.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, non-destructive semantics, yet the description adds substantive behavior: coverage differences are retained, remediation states are only reported as proven/unproven, disappearance of a finding never proves remediation, and binary/runtime bindings stay strict. That is meaningful disclosure beyond the annotations, though terms like "scope/build/assertion pairing" remain opaque.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first clause, and little is pure filler, but the middle sentence is a dense run-on of jargon ("scope/build/assertion pairing," "identical, complete canonical SHA256 source inputs") that is hard to parse on first read. Length is justified by tool complexity, but structure could be cleaner.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and annotations cover safety, so return values and side effects need not be spelled out. However, for a comparison tool with conditional verification modes, terms like "unproven remediation states" and the scope-matching rule are left under-defined, and nothing says what happens on mismatched or invalid report IDs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry the load, and it does: before/after are identified as "exact report IDs," and both booleans are explained along with their dependency (portable_inputs requires verification) and the narrow condition under which absolute targets are normalized. It stops short of describing ID format or provenance, leaving a small gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Compare exact report IDs") and pins the scope to exact IDs, which implicitly separates it from fuzzy or historical lookups like reports_history or reports_get. It is clear what the tool does, though it never names a sibling or contrasts behavior directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives conditional guidance for the two flags ("verification=true adds source traces", "portable_inputs=true requires verification"), which helps pick a mode. It never says when to use this tool versus reports_get/reports_history, nor states prerequisites such as how to obtain valid report IDs, so usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.