feldspar-scan
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_repositoryA | Clone a public git repository and run feldspar-scan: OSV.dev advisories for pinned dependencies in lockfiles (npm, pnpm, yarn, pip/uv/poetry, Cargo, Go, Gemfile.lock), secret patterns with redacted evidence, and configuration lint. Returns a JSON report with summary counts and per-finding severity, file, line, advisory id and fixed versions. Deterministic, no LLM involved. Takes 2-90 s depending on repository size. |
| audit_pricingA | Describe Project Feldspar's paid code audit (security, correctness, maintainability; three independent AI review passes), its price, delivery window, the Terms and the checkout URLs. No arguments. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 2 tools
The two tools are mostly distinct: scan_repository performs an actual repository scan, while audit_pricing only describes a paid audit service and checkout details. Mild conceptual overlap between "scan" and "audit" could still cause an agent to pick the informational tool when asked to audit a repository.
Both names follow the same clear verb_noun snake_case convention: scan_repository and audit_pricing. There are no mixed styles or vague standalone verbs.
Only two tools exist, and only one is an operational capability; the other is informational pricing/terms content. For a repository scanner this feels thin, though the small surface is at least focused.
The scan tool covers dependency advisories, secrets, and configuration lint in one call and returns structured findings, which is solid for the stated purpose. Minor gaps remain around scanning private or local repositories and retrieving/reporting scans separately.