qualys-mcp

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.2.9
Disambiguation5/5
Each tool targets a distinct security domain: cache admin, investigation, risk, compliance, remediation, overview, reporting, and cloud connectors. The descriptions provide clear use cases that prevent confusion, with only minor overlap between assess_risk and security_overview that is still disambiguated by their scope.
Naming Consistency2/5
Naming conventions are mixed: some tools use verb_noun (assess_risk, check_compliance, plan_remediation), some are bare verbs (investigate), and others are nouns or noun phrases (reports, aws_org_connectors, cache_status, security_overview). There is no consistent pattern across the set.
Tool Count5/5
Eight tools is a well-scoped count for a broad security platform, covering major operational areas without bloat. Each tool represents a meaningful high-level capability, making the count appropriate.
Completeness4/5
The tool set covers the core security operations lifecycle: investigation, risk assessment, compliance, remediation, overview, reporting, and cloud connector management. Minor gaps exist such as explicit asset management or scan configuration, but these are workable through the provided tools.
Average 3.8/5 across 8 of 8 tools scored. Lowest: 3/5.
See the Tool Scores section below for per-tool breakdowns.
- 7 of 8 community issues answered or closed in the last 6 months
- 11 commits in the last 12 weeks
- Last stable release on July 8, 2026
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI is passing
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden for behavioral disclosure. It only lists actions without explaining side effects, permissions, rate limits, or what happens after execution. This is a significant gap for a multi-action tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with a '[Reporting]' tag, but it's terse to the point of omitting necessary context for a tool with 7 parameters and 6 actions. It's concise but under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple actions, 7 params), the description fails to provide enough contextual information. The schema covers parameter details well, but the description doesn't explain the purpose of each action, usage sequence, or operational dependencies. Output schema may cover return values, but operational context is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no additional parameter meaning beyond repeating the action list, which is already fully described in the schema's action parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the tool as handling report operations and enumerates the supported actions (list, templates, generate, status, download, delete). This clearly distinguishes it from the security-focused sibling tools. However, it doesn't elaborate on what each action does, so it's clear but not fully detailed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for any report-related task by listing the available actions, but it doesn't explicitly state when to prefer this tool over alternatives or when to use each action. No exclusions or alternative references are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states the two modes (show stats/clear caches) but does not disclose side effects of clearing caches, such as performance impact, irreversibility, or potential disruption to other users.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. The '[Admin]' tag gives immediate context, and all information is relevant and efficiently presented.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one boolean parameter and an output schema), the description is minimal but adequate for basic usage. However, the lack of any warning or context around the destructive 'clear' operation, combined with no annotations, leaves the description incomplete for safe usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter description already explains the 'clear' flag. The tool description essentially restates the parameter behavior without adding additional meaning, so it meets the baseline but doesn't exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool displays cache statistics or clears all caches. The '[Admin]' prefix and verbs 'Show'/'clear' specify the action and resource, making it distinct from sibling security/risk tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The '[Admin]' prefix implies administrative context, but there is no mention of prerequisites, exclusions, or when clearing vs. showing is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the burden for behavioral disclosure. It notes '@slow' as a performance characteristic but does not mention other behavioral aspects such as how data is fetched, whether it provides real-time or cached data, or any permission requirements. The output schema may cover return format, but the description itself offers limited behavioral insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, uses a clear structure with a summary line and a 'USE WHEN' section, and every sentence adds value. It front-loads the core purpose without unnecessary elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 optional parameters) and the presence of an output schema, the description covers the main purpose and usage scenarios effectively. However, it omits guidance on how parameters interact (e.g., whether framework and platform are mutually exclusive), and the '@slow' hint could imply performance constraints without elaboration. Still, it is largely complete for an agent to decide when to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are fully documented in the schema. The description does not add further detail beyond the schema; it only lists examples of user intents. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function as a compliance posture assessment and lists specific outputs (framework pass/fail rates, failing controls, risk acceptances). It distinguishes from sibling tools by focusing on compliance frameworks and providing example queries in the USE WHEN section.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The USE WHEN section provides explicit example queries covering common use cases (PCI compliance, compliance gaps, failing controls, risk acceptances, HIPAA, CIS, frameworks). However, it does not explicitly state situations where alternative tools (e.g., assess_risk, security_overview) should be preferred instead, so it falls short of full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must convey behavioral traits on its own. It includes '@slow' as a warning about latency and mentions 'deep-dive', implying heavy processing. However, it does not disclose whether the tool is read-only, the data sources accessed, or any rate limits, leaving behavioral transparency incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise: a one-sentence summary followed by a short list of example queries. It is front-loaded with the core purpose, and every element—including the '@slow' note and examples—earns its place without redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters) and the existence of an output schema, the description is fairly complete. It clearly explains the tool's scope, provides realistic usage examples, and flags latency. It lacks any mention of edge cases or limitations beyond slowness, but the detailed schema and output schema compensate for most gaps, meriting a 4.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with all 12 parameters already having detailed descriptions in the input schema. The tool description itself adds no additional parameter semantics beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states a specific verb ('Deep-dive investigation') and resource ('any security topic'), listing concrete examples like CVEs, threat actors, assets, and endpoint events. It also includes example queries that distinguish it from sibling tools (e.g., 'assess_risk', 'reports') by emphasizing broad investigation over focused assessment or reporting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'USE WHEN' section provides explicit example queries for when to invoke the tool, such as 'tell me about CVE-2024-3400' and 'are we exposed to Lazarus Group?'. This gives clear context on suitable scenarios, though it does not mention alternatives or when not to use it, preventing a score of 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description notes '@slow', giving a performance warning. Without annotations, it doesn't explicitly state whether the tool is read-only or whether it modifies anything; the word 'planning' implies non-destructive but this is not explicit. Thus partial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with a clear summary, followed by usage examples. All content is useful and no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full parameter descriptions, the description's use cases and scope notes make it complete for most planning queries. Missing explicit information about limitations or interactions between parameters, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions, so baseline is 3. The description provides no additional parameter-specific semantics beyond the schema, so it stays at 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states its role: 'Remediation planning — patch priorities, deployment status, mitigation coverage, program gaps.' This is a specific verb+resource and differentiates it from sibling tools like investigate or assess_risk by focusing on remediation planning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'USE WHEN' list with natural language queries, making it clear when to invoke this tool. However, it doesn't mention alternatives or when not to use it, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden. It discloses the performance trade-off ('@slow when quick=False') and the general content of the briefing (scanner health, findings, risk trends), but it does not explicitly state that the tool is read-only, nor does it mention authentication requirements, rate limits, or other side effects. This is moderate disclosure but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured, opening with a clear title and purpose, followed by a compact definition of the summary content, and then a focused list of usage examples. There is no redundancy; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the tool (10 parameters, output schema), the description provides a high-level purpose and usage triggers, which is sufficient for an agent to decide when to invoke it. It does not repeat parameters that are fully documented in the schema, and the output schema covers return values. It could mention the configurable periods explicitly (daily/weekly/monthly) but these are inferred from the description and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all 10 parameters, so the baseline is 3. The description does not add additional meaning beyond the schema, only referencing 'quick' indirectly through the performance note. All parameter details are already fully documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function as a 'Security briefing' that provides daily/weekly/monthly summaries of scanner health, findings, and risk trends. The 'USE WHEN' examples ('morning briefing', 'security overview', 'scanner status') distinguish it from sibling tools like investigate or reports, which focus on deeper analysis or custom reporting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage scenarios with 'USE WHEN' trigger phrases, signaling appropriate contexts such as morning briefings and weekly retrospectives. However, it does not state when not to use the tool or explicitly mention alternative sibling tools, so it offers clear context but lacks exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool is '@slow' and spans multiple domains, but does not explicitly state that it is read-only, which data sources it queries, or any side effects. The output schema covers return structure, but the behavior beyond speed is somewhat opaque.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core purpose and a performance warning ('@slow'). The 'USE WHEN' list is directly relevant and adds no fluff. Every sentence and clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (26 parameters) and the absence of annotations, the description is relatively sparse. It provides high-level usage scenarios but does not explain parameter interactions (e.g., asset_id skipping broad queries), how results are aggregated across domains, or how to interpret the output. The rich schema and output schema help compensate, but the description alone leaves gaps for such a feature-rich tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameter descriptions exist. The tool description adds value by mapping natural language to specific parameters, e.g., 'cloud risk in AWS' implies provider='aws' and scope='cloud', and 'container vulnerabilities' implies scope='containers'. This semantic mapping goes beyond the schema's literal field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear, specific purpose: cross-domain risk assessment across VMs, cloud, containers, web apps, certificates, and assets. The 'USE WHEN' examples further specify intent ('what's our risk?', 'show me cloud risk in AWS'). This distinguishes it from siblings like security_overview by emphasizing the cross-domain aggregation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a 'USE WHEN' section with concrete example queries, giving clear context for when to invoke the tool. It does not explicitly mention alternative tools or when not to use it, so it falls short of a 5, but the examples are strong enough to effectively guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It implies a read-only operation via 'list and health status' but does not describe return details, pagination, or potential rate limiting. This is acceptable for a simple list tool but leaves some behavioral aspects unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence followed by a 'USE WHEN' list, with no redundant wording. It front-loads the core purpose and provides immediately useful trigger phrases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The presence of an output schema and fully described parameters means the description only needs to convey purpose and usage context, which it does effectively. The sibling tool list adds context, and the tool is simple enough that no more behavioral detail is required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents both parameters with descriptions: 'limit' (max connectors, default 50) and 'detail' (summary/standard/detailed). The tool description adds no additional parameter-level meaning, so it relies on the schema's 100% coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'list and health status for multi-account AWS setups,' with a specific verb and resource. It distinguishes itself from sibling tools like cache_status or investigate by focusing on AWS Organization connectors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
A 'USE WHEN' section provides explicit trigger phrases like 'show AWS org connectors' and 'AWS Organizations status', giving clear context for when to use this tool. It does not explicitly mention when not to use it or name alternatives, but the sibling list and distinct purpose make the usage context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![qualys-mcp MCP server](https://glama.ai/mcp/servers/nelssec/qualys-mcp/badges/card.svg)](https://glama.ai/mcp/servers/nelssec/qualys-mcp)

Score Badge

Copy to your README.md:

[![qualys-mcp MCP server](https://glama.ai/mcp/servers/nelssec/qualys-mcp/badges/score.svg)](https://glama.ai/mcp/servers/nelssec/qualys-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/nelssec/qualys-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server