prescryb

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.1.1
Disambiguation5/5
Each tool has a unique, well-defined purpose: checking CVEs, fetching advisories, generating playbooks, inventorying hosts, listing CCE targets, looking up CCE entries, and mapping compliance topics. No functional overlap exists.
Naming Consistency5/5
All tool names follow a consistent verb_noun pattern in snake_case (e.g., check_cves, fetch_advisory, generate_playbook). The naming style is uniform and predictable.
Tool Count5/5
With 7 tools, the set is well-scoped for its security compliance domain. Each tool covers a necessary step in the workflow (inventory, CVE scanning, advisory lookup, compliance mapping, playbook generation) without extraneous additions.
Completeness5/5
The tool surface covers the full lifecycle: inventory → CVE matching → advisory retrieval → compliance mapping (CCE and CIS/DISA) → playbook generation. No critical gaps are apparent for the stated purpose of automated compliance remediation.
Average 4.3/5 across 7 of 7 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 36 commits in the last 12 weeks
- Last stable release on July 12, 2026
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI is passing
Add a LICENSE file by following GitHub's guide. Once GitHub recognizes the license, the system will automatically detect it within a few hours.
If the license does not appear after some time, you can manually trigger a new scan using the MCP server admin interface.
MCP servers without a LICENSE cannot be installed.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must bear the burden. It mentions fetching a record but does not disclose side effects (likely read-only), rate limits, or authentication needs. Lacks behavioral context beyond purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states purpose, second gives usage guidance and return info. No wasted words, front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with one parameter and output schema. Description covers what it does, what it returns, and when to use. Slightly lacking in behavioral details, but sufficient given output schema existence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, cve_id, with 0% schema description coverage. The description implies it's a CVE ID but adds no format or constraints. Minimal added value over the parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fetch the current, authoritative NVD record for a specific CVE ID', specifying verb, resource, and scope. It distinguishes from siblings like check_cves by emphasizing authority and specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after check_cves or for known CVEs, and why (to avoid stale data). Lacks explicit when-not, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that matching is ecosystem-aware and version-specific, adding significant behavioral context. It does not detail potential side effects or auth requirements, but given the read-only nature, it is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no wasted words. Each sentence adds distinct value: action, input source, and matching methodology. Well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose and usage well, but given the complexity of nested object parameters and 0% schema coverage, it lacks completeness in parameter documentation. Output schema exists to cover return values, but input semantics are insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% with no parameter descriptions. The description only states that system and packages are objects from inventory_host, but does not explain their internal structure or required fields. More detail is needed to compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Match installed package versions against known CVEs') and specifies the external service (OSV.dev). It distinguishes from sibling tools like inventory_host and fetch_advisory by indicating the input source and the nature of matching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that inputs come from inventory_host and allows filtering by subset of packages, providing clear context for when to use this tool. However, it does not explicitly state when not to use it or mention alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses key behaviors: authentication method, no password argument for security, unknown host key rejection with trust_unknown_host option, and that only file paths (not contents) are passed. This gives the agent a complete safety and operation picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured well with a clear first sentence stating the main action, followed by details on auth, security, and overrides. It is concise enough but could be trimmed slightly without losing clarity. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, no annotations, output schema exists), the description covers authentication, security constraints, and parameter use for overrides. Missing details on port and user are a minor gap, but overall it provides sufficient context for correct tool use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains host, hostname, identity_file, and trust_unknown_host, but does not mention the port or user parameters. These are important for SSH connections and their defaults (22 and empty string) are noted in the schema, but the description misses the chance to clarify their role.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it SSHs into a host and inventories installed packages, which is a specific verb+resource. It distinguishes from sibling tools (check_cves, fetch_advisory, etc.) that focus on security/compliance, not package inventory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains authentication via ~/.ssh/config, SSH agent, and default identity files, likening it to running `ssh host` yourself. It clarifies when to use overrides (e.g., local molecule/vagrant instances) and how to handle unknown host keys. It lacks explicit 'when not to use' or comparisons to siblings, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description covers the behavior: returns filtered entries or categories/count, explains target resolution, and warns against dumping entire platform. Safe read operation implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Multiple paragraphs but each sentence adds value. Structured with summary line, target details, and filtering options. Could be slightly more concise but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 3 params, no annotations, but output schema exists. Explains behavior with and without filters, covers main use cases. Lacks mention of error handling or missing targets, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage; description compensates fully by detailing target formation (examples, resolution), keyword matching fields, and cce_id with example. All three parameters are well explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it looks up NIST CCE entries for a platform, using specific verbs and resource. It distinguishes from siblings like list_cce_targets and check_cves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use target, keyword, cce_id, and directs to list_cce_targets for platform discovery. Implicitly covers when not to use by explaining behavior without filters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description fully discloses key behavioral traits: the playbook is 'suggest-only' and not executed, output should be reviewed with 'ansible-playbook --check --diff', compliance areas are resolved via map_compliance and may reference a hardening role, and MITRE ATT&CK techniques are cited. This goes beyond what any annotations would provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively concise given the complexity, front-loaded with the main purpose, and uses clear structure with code formatting. A few redundant phrases could be trimmed, but overall it earns its keep.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters, nested objects, and existing output schema, the description is thorough. It explains the input sources, parameter behavior, and post-generation step, though it doesn't detail the return format beyond suggesting it's a YAML playbook.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description adds significant meaning: 'system' is an object from inventory_host, 'cve_matches' become package-upgrade tasks, and 'compliance_areas' are topic hints resolved via map_compliance. However, 'hosts_alias' is not explained, leaving a gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Generate a suggest-only Ansible playbook from findings. Does NOT run it.' This specific verb-resource pair and the explicit exclusion of execution make the purpose unmistakable and distinct from siblings that perform checks or lookups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool: after inventory_host, check_cves, and map_compliance. It explains the role of each parameter, but does not explicitly state when not to use it or compare directly to alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool lists platform names (read-only), the data source (a GitHub repo), and important limitations on usable targets. This provides adequate behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences in the first paragraph for the main purpose, followed by a necessary second paragraph for additional context. Every sentence adds value, and it is front-loaded with the primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and an output schema (implied), the description provides all necessary context: what it does, its data source, and critical usage caveats about available targets. It is complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the description is not required to add parameter meaning. The baseline for 0 parameters is 4, and the description neither adds nor detracts.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (list) and the resource (platform names that lookup_cce can query), with concrete examples like 'rhel8' and 'firefox'. It also implicitly distinguishes from sibling tools by indicating that this tool provides targets for lookup_cce.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides implicit guidance by stating that coverage is thin and listing only usable targets (RHEL-family and SUSE). However, it does not explicitly say when to use this tool versus alternatives, though the context of sibling tools suggests its role as a prerequisite for lookup_cce.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description fully bears the burden. It discloses that only topic-area mapping is returned, not rule IDs, and explains why ATT&CK IDs are cited directly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening sentence and explanatory notes, though it is slightly verbose with disclaimers. It earns its place but could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema, the description adequately explains the return values (role, ATT&CK techniques, mitigations) without over-specifying format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by providing concrete examples for the 'area' parameter (e.g., 'ssh', 'sudo') and explaining its purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool maps a free-text topic to CIS Benchmark/DISA STIG topic areas, ATT&CK techniques, and optionally a GitHub role. It uses specific verbs and distinguishes from sibling tools like check_cves and generate_playbook.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool (mapping topics) and what not to expect (no specific rule IDs). It also provides alternative contexts by referencing licensed vs. public catalogs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![prescryb MCP server](https://glama.ai/mcp/servers/konstruktoid/prescryb/badges/card.svg)](https://glama.ai/mcp/servers/konstruktoid/prescryb)

Score Badge

Copy to your README.md:

[![prescryb MCP server](https://glama.ai/mcp/servers/konstruktoid/prescryb/badges/score.svg)](https://glama.ai/mcp/servers/konstruktoid/prescryb)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/konstruktoid/prescryb'

If you have feedback or need assistance with the MCP directory API, please join our Discord server