Check if a proposed read, write, or delete path stays within allowed boundaries, following existing symlinks but not authorizing the later filesystem operation.
Advisory path containment check; follows existing symlinks but does not authorize a later filesystem operation.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| operation | No |
| Name | Required | Description | Default |
|---|---|---|---|
| rule | Yes | ||
| status | Yes | ||
| remediation | Yes | ||
| resolved_path | No |
Changes observed during successful MCP inspections.
v0.1.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses that the check is advisory, follows existing symlinks, and does not authorize later filesystem operations—non-obvious traits. It does not cover permissions, side effects, or error behavior, but the core behavioral caveat is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; each clause (advisory, symlink following, non-authorization) adds distinct meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, 0% schema description coverage, and a non-obvious 'operation' enum, the description is too sparse. It covers the advisory caveat but omits parameter semantics and usage conditions; output schema covers returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention either parameter. The 'operation' enum (read/write/delete) is completely unexplained, and there is no indication of how 'path' is interpreted beyond the symlink note. Since the schema provides no descriptions, the description fails to compensate for this gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('check') and resource ('path containment'), and the advisory/symlink caveat clarifies scope. It does not differentiate from siblings dry_run_command, budget_guard, or secret_masker.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use as an advisory pre-check ('Advisory path containment check') and explicitly warns it does not authorize a later filesystem operation. However, it offers no alternatives or when-not conditions, and does not mention the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.