Skip to main content
Glama
prinzalx

winsecure-mcp

by prinzalx

Scan inventory

scan_inventory

Refresh the installed-software inventory by scanning the Windows registry, winget list, and portable .exe files. Returns per-source counters and a deduplicated software list.

Instructions

Refresh the installed-software inventory from the registry, winget list and a portable .exe scan. Returns per-source counters and the deduplicated result.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
rootsNoDrive roots for the portable scan. Defaults to the fixed disks
sourcesNoWhich sources to read. Defaults to all three

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the mechanics (three sources read) and the return shape (per-source counters plus deduplicated result), but says nothing about whether the stored inventory is overwritten, how long the scan takes, whether winget/portable scanning needs network or elevated permissions, or what happens on partial failure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the action and scope, followed by the return summary. Every clause earns its place; no filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the right thing by summarizing return values, and it covers both optional parameters' domains. The remaining gap is side-effect/permission context for a refresh operation that mutates stored inventory state, which matters more given the absence of annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the schema and the baseline is 3. The description usefully connects the 'portable .exe scan' wording to the `roots` parameter and enumerates the three source names matching the `sources` enum, but adds no default or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: 'Refresh the installed-software inventory', with the three data sources named concretely (registry, winget list, portable .exe scan). That is far clearer than a bare 'scan', though it never names a sibling to distinguish itself from get_program or check_cves, which also touch installed software.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Refresh' implies the use case (re-sync a stale inventory), but there is no explicit when-to-use statement, no exclusion of alternatives, and no note on how this differs from get_program (single lookup) or check_cves. Usage is only inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.