Snyk API & Web MCP Server
OfficialThe Snyk API & Web MCP Server connects AI coding assistants to the Snyk API & Web (formerly Probely) platform, enabling natural language management of DAST (Dynamic Application Security Testing) scanning and vulnerability triage.
Target Management
Create web targets and API targets from OpenAPI/Swagger schemas or Postman collections
List, get, update, and delete targets; assign labels, scanning agents, and configure settings
Authentication Configuration
Configure form-based login, sequence-based login flows, HTTP Basic Auth, and API header/cookie authentication
Create, update, and delete multi-step login sequences
Configure TOTP-based 2FA, generate TOTP codes, and disable 2FA
Configure logout detection using CSS selectors, text patterns, or redirect URLs
Credential Management
Securely create, list, get, update, and delete credentials (passwords, API keys, tokens)
Reference credentials via
credentials://<id>URI format
Scan Management
Start, stop, cancel, list, and get details of DAST scans
Configure scan profiles, excluded paths, and max scan duration
Findings & Reporting
List, get, and update security findings; bulk-update finding states (e.g., mark as fixed, false positive, accepted risk)
Generate and download scan reports in PDF or HTML format with types including default, executive, OWASP, PCI, HIPAA, and ISO 27001
Infrastructure & Team Management
List and manage scanning agents for internal/private targets
Manage extra hosts (hostname/IP mappings) for targets
List teams and users; create labels for organizing targets
Advanced
Make raw API requests for endpoints not covered by dedicated tools
Allows to interact with Snyk API & Web to onboard scan targets, configure authentication, run DAST scans, and triage findings.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Snyk API & Web MCP ServerConfigure a DAST scan for my web app at https://example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.

Snyk API & Web MCP Server
Connect your AI coding assistant to Snyk API & Web so it can onboard scan targets, configure authentication, run DAST scans, and triage findings — all through natural language.
Built on FastMCP 2.0, works with Cursor, Claude Code, Devin, and any MCP-compatible client.
Naming note: Snyk API & Web was formerly known as Probely. The API endpoints (
api.probely.com), web console (plus.probely.app), and MCP tool names (probely_*) still use the legacy domain and prefix. Environment variables and config sections use the newSAW/sawnaming.
See USER_GUIDE.md for usage, examples, and tool reference.
This repository is closed to public contributions. We appreciate community interest, but we do not accept pull requests, issues, or other contributions from external contributors at this time. If you have found a security issue, please see SECURITY.md.
Requirements
Python 3.10+
Node.js 18+ and npm (for web target login recording via
playwright-cli; optional if using Playwright MCP instead)Snyk API & Web API key
Related MCP server: Security-Use MCP Server
Quick Start
1. Get Your API Key
Go to https://plus.probely.app/api-keys and create an API key.
Important
Use a custom role, limited-scope API key for the Snyk API & Web MCP Server. Create the key only with the permissions required for the intended actions. Do not use a highly privileged or global API key, as this can affect your entire account and its resources.
2. Install
Cursor Marketplace (recommended for Cursor users)
Install directly from the Cursor Marketplace:
Open the Snyk API & Web plugin page and click Install, or go to Settings → Plugins and search for Snyk API & Web
Set your API key as an environment variable before launching Cursor:
export MCP_SAW_API_KEY="your-api-key"
The plugin installs the MCP server, rules, and skills automatically.
Devin MCP Marketplace (Devin users)
Install directly from Devin's MCP Marketplace:
Open Devin and go to Settings → Configuration.
Under MCP servers, click Open MCP Marketplace.
Search for Snyk API & Web and click Install.
When prompted, enter your API key.
No manual configuration needed — Devin handles the setup automatically.
One-command install (any MCP client)
uvx --from git+https://github.com/snyk/saw-mcp.git saw-mcpOr add to your MCP client configuration:
{
"mcpServers": {
"SAW": {
"command": "uvx",
"args": ["--from", "git+https://github.com/snyk/saw-mcp.git", "saw-mcp"],
"env": {
"MCP_SAW_API_KEY": "your-api-key"
}
}
}
}Install from release tarball
tar -xzvf SnykAPIWeb-<version>.tgz
cd SnykAPIWeb
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -r requirements.txtDownload from Releases and replace <version> with the actual version number (e.g., 1.0.0).
Clone from source
git clone https://github.com/snyk/saw-mcp.git
cd saw-mcp
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -r requirements.txt3. Store Your API Key
The server reads your API key from (in order of precedence): environment variable MCP_SAW_API_KEY → .env file → config/config.yaml.
Option A: Environment variable (recommended for Marketplace / uvx installs)
export MCP_SAW_API_KEY="your-api-key"Option B: .env file (recommended for source installs)
Run the setup script (prompts securely, no key in shell history):
./scripts/setup-env.shOr pipe from a secret manager: op read 'op://vault/item/key' | ./scripts/setup-env.sh
This writes a .env file in the project root (gitignored). The server loads it automatically at startup.
Option C: Secret reference (avoids storing the key in plaintext anywhere)
MCP_SAW_API_KEY and the config api_key field also accept a reference that is resolved at runtime, so the literal key never sits in a file:
export MCP_SAW_API_KEY="op://vault/saw-mcp/api-key" # resolved via the 1Password CLI (`op`)
export MCP_SAW_API_KEY="env:MY_SAW_KEY" # read from another environment variableAvoid committing a plaintext key.
config/config.yamlis gitignored, and a plaintext key read from it logs a warning at startup.
4. Install Browser Automation (web targets with login)
Web target onboarding records login sequences in a real browser. Preferred for coding agents: playwright-cli via Shell:
npm install -g @playwright/cli@latest
playwright-cli install-browser chromiumOr run ./scripts/setup-playwright.sh from a cloned repo.
Alternative: install Playwright MCP as a second MCP server (better for MCP-only clients without Shell). See Web target prerequisites.
5. Configure Your IDE
If you installed from the Cursor or Devin marketplace, configuration is automatic. For other clients, add to your MCP client configuration:
{
"mcpServers": {
"SAW": {
"command": "uvx",
"args": ["--from", "git+https://github.com/snyk/saw-mcp.git", "saw-mcp"],
"env": {
"MCP_SAW_API_KEY": "your-api-key"
}
}
}
}For host-specific setup see the Installation Guides.
Override the base URL: add
"MCP_SAW_BASE_URL": "https://your-instance-url"to theenvblock.Use a config file: set
"MCP_SAW_CONFIG_PATH": "/path/to/config.yaml"instead.Set log level: add
"MCP_SAW_LOG_LEVEL": "DEBUG"(options: DEBUG, INFO, WARNING, ERROR, CRITICAL; default: INFO).
6. Start Using
Ask your AI assistant to:
"Configure a Snyk API & Web API target from this OpenAPI schema / Swagger document / Postman collection."
"Configure a Snyk API & Web web target for this authenticated application."
See prompts.md for a full catalog of example prompts — from simple one-liners to complex multi-target workflows.
Web target prerequisites
The SAW MCP server talks to the Snyk API & Web platform — it does not include a browser. To onboard web targets with login sequences, the AI needs browser automation via one of:
Path | Best for | Setup |
| Cursor, Devin, Claude Code, Cloud Agents with Shell |
|
Playwright MCP (fallback) | MCP-only clients without Shell (e.g. Claude Desktop) | Add Playwright MCP to your IDE's MCP config |
Workflow:
Prompt with the target URL and credentials — e.g. "Add target example.com with credentials user@example.com / password123".
The AI records the login in a browser (
playwright-clior Playwright MCP).SAW MCP tools create the target and upload the sequence in the Probely sequence-recorder format.
Without browser automation, the AI falls back to form login (probely_configure_form_login) — simple single-page login only; no multi-step flows or 2FA.
See the Cursor installation guide for setup details.
IDE Integration
Detailed per-host guides live in docs/installation-guides/:
Host | Guide |
Cursor | |
Claude Desktop | |
Devin / Other IDEs |
Packaging
bash scripts/package.shCreates dist/SnykAPIWeb-<version>.tgz (version from snyk_apiweb/__init__.py).
Development & Testing
Run the Server (standalone)
Running the server directly starts it and waits for an MCP client connection. This is mainly useful for development and debugging:
./venv/bin/python -m snyk_apiweb.serverDevelopment Mode (hot reload)
For active development with automatic reload on file changes:
./scripts/dev.shLicense
This project is licensed under the Apache License 2.0.
Available Tools
51 toolsprobely_bulk_update_findingsB
Bulk update finding states (e.g. fixed, false_positive, accepted_risk). This tool will automatically ask the user for confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| findingIds | Yes | ||
| state | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description notes that the tool will automatically ask for user confirmation, which is a behavioral trait. However, with no annotations, additional important behaviors (e.g., permissions, reversibility, side effects) are not disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences: first states purpose, second adds a behavioral note. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and sibling tools, the description lacks details on return values, prerequisites, and limits. The confirmation note adds some context but overall is minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning. It only provides examples for the 'state' parameter, leaving 'targetId' and 'findingIds' unexplained. Partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: bulk updating finding states, with examples of valid states (fixed, false_positive, accepted_risk). It distinguishes from the sibling 'probely_update_finding' by indicating bulk operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. The description does not indicate when to use this tool versus alternatives (e.g., probely_update_finding for single updates), nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_cancel_scanD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| scanId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_configure_2fa_totpA
Configure TOTP-based 2FA for a target. Automatically generates a TOTP code from the secret and configures it as the OTP placeholder for the login sequence.
Call this BEFORE creating/updating the login sequence. The response includes an
otp_code field — use this exact code hardcoded in the sequence's fill_value step
for the OTP input. Probely will auto-convert that step to fill_otp at scan time.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| otp_secret | Yes | ||
| otp_algorithm | No | SHA1 | |
| otp_digits | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description bears full burden. It discloses automatic TOTP generation and configuration, and mentions Probely auto-converts the fill_otp step. Missing side effects like overwriting existing 2FA, but overall transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise paragraphs, front-loaded with key action and usage context. No wasted words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, description explains the otp_code field and usage flow. For a 4-param tool with 2 required, it provides sufficient context to use correctly, though could add more on param specifics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must compensate. It mentions 'secret' and 'TOTP code' but does not explain individual parameters like targetId, otp_algorithm, otp_digits. Parameter names are somewhat self-explanatory, but description lacks explicit semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool configures TOTP-based 2FA for a target, generating a TOTP code and configuring it as the OTP placeholder. This is distinct from sibling tools like configure_form_login or configure_sequence_login.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Call this BEFORE creating/updating the login sequence' and explains how to use the returned otp_code in a fill_value step. It provides clear when-to-use guidance but does not mention when not to use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_configure_form_loginA
Configure form-based login authentication. Only use this as a fallback when Playwright is NOT available. When Playwright IS available, always record a login sequence instead (probely_create_sequence).
To reference saved credentials, use URI format 'credentials://' (e.g., 'credentials://4DY4qGohso1r'). Get credential URIs from probely_list_credentials or probely_create_credential.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| login_url | Yes | ||
| username_field | Yes | ||
| password_field | Yes | ||
| username | Yes | ||
| password | Yes | ||
| check_pattern | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description must cover behavioral aspects. It describes the authentication method and fallback nature, but does not disclose side effects, whether it overwrites existing configuration, or any other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, well-structured paragraphs. Front-loaded with purpose and usage guidance. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having output schema (not shown) and 7 parameters, the description is missing explanations for most parameters and lacks behavioral details about the configuration process.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description only explains the credential URI format and does not elaborate on the other 7 parameters (targetId, login_url, username_field, password_field, username, password, check_pattern).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool configures form-based login authentication, and distinguishes it from the preferred alternative (sequence recording) by specifying it as a fallback.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use (as fallback when Playwright unavailable) and when not (prefer probely_create_sequence). Also explains credential URI format and references related tools for obtaining URIs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_configure_logout_detectionA
Configure logout detection for a target. This helps the scanner detect when it needs to re-authenticate.
The Probely API requires BOTH check_session_url AND at least one logout detector to be defined before logout detection can be enabled. This function handles the proper ordering automatically.
When no detector is specified, the tool automatically extracts a CSS selector from the target's login sequence (typically the username field) and uses it as the logout detector. This is the most reliable approach: if the login form elements appear on the page, the user is logged out.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | The target ID | |
| enabled | No | Whether to enable logout detection (default: True) | |
| check_session_url | No | URL to check if session is still valid. Should return 200 when logged in, and 401/403 when logged out. Common examples: /api/me, /api/user, /api/session | |
| logout_detector_type | No | Type of logout detector to create if none exist. Options: 'sel' (CSS selector - recommended), 'text' (text after logout), 'url' (redirect URL). If not provided, auto-extracts CSS selector from login sequence, or falls back to 'text: Login'. | |
| logout_detector_value | No | Value for the logout detector. Required if logout_detector_type is provided. | |
| logout_condition | No | When to consider the target logged out based on detectors. 'any' (default) = logged out if ANY detector matches (OR logic). 'all' = logged out only if ALL detectors match (AND logic). Use 'all' when some detector patterns also appear on the logged-in page. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It discloses automatic extraction of CSS selector from login sequence when no detector is provided, and the requirement for both parameters. Lacks details on idempotency or overwriting behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is mostly concise, but the requirement for both check_session_url and a detector is mentioned twice. Could be slightly more streamlined, but overall it's well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 parameters, full schema coverage, and an output schema, the description covers all key behavioral aspects: purpose, prerequisites, automatic behavior, and condition logic. It is complete for an AI agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds substantial meaning: explains automatic fallback for logout_detector_type, clarifies the 'any' vs 'all' condition, and emphasizes the requirement for both check_session_url and a detector, which goes beyond schema parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool configures logout detection for a target to help the scanner re-authenticate. It distinguishes from sibling tools like probely_create_logout_detector by describing its higher-level configuration role, including automatic detector extraction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains prerequisites (both check_session_url and a detector needed) and when to use 'any' vs 'all' condition. However, it does not explicitly state when not to use this tool or direct users to alternatives like probely_create_logout_detector for manual detector creation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_configure_sequence_loginA
Enable or disable sequence-based login. Call this after creating a login sequence.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| enabled | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states 'enable or disable' without disclosing side effects, error conditions, or permissions. The mutation nature is implied but not detailed, leaving significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, no fluff. The action verb is front-loaded, and every word adds value. Optimal length for a simple toggle tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema (not shown) and the tool's simplicity, the description covers basic functionality. However, it omits parameter semantics and does not clarify the relationship with sibling tools like probely_create_sequence or probely_update_sequence, leaving moderate gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It does not describe targetId (likely the sequence ID) or the enabled parameter's effect. The vagueness forces reliance on parameter names alone, which may cause confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: enabling or disabling sequence-based login. It distinguishes from siblings like probely_configure_form_login by specifying 'sequence-based' and provides a usage hint ('after creating a login sequence').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly directs to call this after creating a login sequence, providing clear temporal context. It does not specify when not to use it or name alternative tools, but the guidance is sufficient for an agent to infer the intended usage scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_api_target_from_openapiA
Create an API target from an OpenAPI/Swagger schema. Provide either openapi_schema_url or openapi_schemajson. When the user provides openapi_schema_url, do not fetch the openapi_schemajson from that url.
Set allow_duplicate=True to create a target even if another target with the same URL already exists. This is useful when you want multiple targets for the same URL with different configurations (e.g., different auth methods, different test scenarios).
If target creation fails because the target is unreachable or the domain cannot be resolved, ask the user whether to retry with skip_reachability_check=True.
IMPORTANT: The response contains a top-level id (the target ID) and a nested
site.id (the site ID). Always use the top-level id as the targetId
parameter for all subsequent tool calls (update_target, start_scan, etc.).
Do NOT use the nested site.id field for target operations.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| target_url | Yes | ||
| openapi_schema_url | No | ||
| openapi_schemajson | No | ||
| desc | No | ||
| labels | No | ||
| allow_duplicate | No | ||
| skip_reachability_check | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses behavioral details such as the need to use top-level 'id' instead of 'site.id', and the option to retry with skip_reachability_check. With no annotations, the description has gaps: no mention of authorization, rate limits, or destructive nature beyond creation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with clear sections and front-loaded purpose. The IMPORTANT note is necessary but slightly verbose. Overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers critical aspects like input methods, duplicate handling, and response ID usage. However, lacks explanation for some parameters (desc, labels) and does not fully detail output schema despite its existence. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Explains key parameters (openapi_schema_url, openapi_schemajson, allow_duplicate, skip_reachability_check) but does not cover desc or labels. Since schema description coverage is 0%, the description partially compensates but leaves gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Create an API target from an OpenAPI/Swagger schema' with specific verb and resource. Distinguishes from sibling tools like probely_create_web_target and probely_create_api_target_from_postman.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use parameters like allow_duplicate and skip_reachability_check, and how to handle failures. However, does not explicitly contrast with sibling tools or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_api_target_from_postmanA
Create an API target from a Postman collection. Provide either postman_collection_url or postman_collectionjson.
Set allow_duplicate=True to create a target even if another target with the same URL already exists. This is useful when you want multiple targets for the same URL with different configurations (e.g., different auth methods, different test scenarios).
If target creation fails because the target is unreachable or the domain cannot be resolved, ask the user whether to retry with skip_reachability_check=True.
IMPORTANT: The response contains a top-level id (the target ID) and a nested
site.id (the site ID). Always use the top-level id as the targetId
parameter for all subsequent tool calls (update_target, start_scan, etc.).
Do NOT use the nested site.id field for target operations.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| target_url | Yes | ||
| postman_collection_url | No | ||
| postman_collectionjson | No | ||
| desc | No | ||
| labels | No | ||
| allow_duplicate | No | ||
| skip_reachability_check | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses behavior: creation process, duplicate handling, reachability check failure, and response structure (top-level id vs nested site.id). This is comprehensive for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear paragraphs and front-loaded purpose. It is somewhat lengthy but each sentence adds value. Minor redundancy could be trimmed, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters (2 required), no annotations, and presence of output schema, the description fully covers purpose, parameter usage, error handling, and response semantics. It equips the agent to handle edge cases like duplicates and unreachability, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description adds meaning for key parameters: postman_collection_url, postman_collectionjson, allow_duplicate, skip_reachability_check. However, it does not describe 'desc' or 'labels', leaving some ambiguity. Overall good coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates an API target from a Postman collection, distinguishing it from siblings like probely_create_api_target_from_openapi and probely_create_web_target. It specifies the resource (API target) and source (Postman collection).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use which parameters (postman_collection_url vs postman_collectionjson), when to set allow_duplicate and skip_reachability_check, and instructs the agent to ask the user on failure. Also clarifies that the top-level 'id' should be used for subsequent calls, not 'site.id'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_credentialA
Create a credential for secure storage. Use is_sensitive=True for passwords. Returns the credential with id and uri. Use the uri (e.g. "credentials://xxxx") as the value in custom_field_mappings to link it to a sequence.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| value | Yes | ||
| is_sensitive | No | ||
| description | No | ||
| team | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool creates a credential, returns an id and uri, and that the URI can be used for linking. However, it omits details like whether duplicate names cause errors, required permissions, or rate limits, leaving gaps for a first-time agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with four short sentences, no fluff, and front-loaded with the primary purpose. Every sentence adds distinct value: creation action, sensitive flag tip, return structure, and linking usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (5 parameters, no schema descriptions, no annotations), the description explains the return value and a key usage pattern but does not cover all input parameters or error cases. The presence of an output schema reduces the need to explain return values, but input semantics remain incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must add meaning for 5 parameters. It only addresses is_sensitive ('Use is_sensitive=True for passwords') and implies value is for 'secure storage,' but ignores name, description, and team. This is insufficient for an agent to correctly populate all parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a credential for secure storage,' using a specific verb and resource. It distinguishes from siblings like probely_update_credential, probely_get_credential, and probely_list_credentials, leaving no ambiguity about the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage guidance: 'Use is_sensitive=True for passwords' and explains how to link the credential to a sequence via the URI. While it lacks explicit when-not-to-use or alternatives, the context is clear for typical credential creation scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_extra_hostD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| hostname | Yes | ||
| ip_address | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_labelD
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| color | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_logout_detectorC
Create a logout detector for a target.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | The target ID | |
| detector_type | Yes | Type of detector - 'text' (text that appears after logout), 'url' (redirect URL after logout), or 'sel' (CSS selector after logout) | |
| value | Yes | The value for the detector (e.g., "Login", "/login", ".login-form") |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description merely states the action without revealing behavioral traits such as whether existing detectors are overwritten, authentication requirements, or side effects. With no annotations, the description should carry more burden, but it does not.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence), but it is too brief to be informative. It lacks structure and does not earn its place beyond stating the obvious.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a creation tool with three required parameters and an output schema, the description is incomplete. It does not explain the effect on the system, the meaning of the detector types, or provide any usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, providing clear definitions for all parameters (targetId, detector_type, value). The description adds no additional semantic value beyond what the schema already offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it creates a logout detector for a target, using the verb 'Create' and the resource 'logout detector'. However, it does not differentiate from the sibling tool 'probely_configure_logout_detection', which may have overlapping functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'probely_configure_logout_detection'. There is no mention of prerequisites, recommended scenarios, or cases where this tool should be avoided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_scanreportA
Create a report for a scan. Returns report metadata including the report ID.
| Name | Required | Description | Default |
|---|---|---|---|
| scanId | Yes | The scan ID to generate the report for | |
| report_type | No | Type of report - "default", "executive", "owasp", "pci", "hipaa", "iso27001" | default |
| format | No | File format - "pdf" or "html" |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It only states the action and return value, but fails to disclose behavioral traits like whether the scan must be completed, whether the tool is idempotent, or any side effects (e.g., overwriting existing reports). This is a significant gap for a create operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundancy, front-loaded with the core purpose. Every word contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (context signal), the description need not detail return values, but it does mention 'report metadata including report ID'. However, it omits prerequisites like scan state (e.g., completed scan) and does not explain the meaning of report_type or format parameters beyond what the schema provides. For a simple tool, it's adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds no additional meaning beyond the input schema. The description's mention of 'report metadata including the report ID' is generic and does not elaborate on parameters. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Create', the resource 'report for a scan', and explicitly mentions returning metadata including the report ID. It distinguishes from siblings like probely_downloadreport and probely_getreport by focusing on creation rather than retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for generating a new report but provides no explicit guidance on when to use this tool versus alternatives (e.g., probely_getreport to retrieve existing reports, probely_downloadreport to download). No when-not or prerequisite conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_sequenceA
Create a login sequence. Content must be a JSON string of the sequence steps array. Use custom_field_mappings to configure credentials.
IMPORTANT: After creating a login sequence, you MUST call probely_configure_sequence_login(targetId, enabled=True) to enable sequence-based authentication on the target. Creating a sequence does NOT automatically enable it for authentication.
Use credentials management by default: link a credential (created via probely_create_credential) for the password. If the user explicitly declines, inline values are allowed.
Password credential: [{"name": "[CUSTOM_PASSWORD]", "value": "credentials://", "value_is_sensitive": true, "enabled": true}]
When multiple targets share the same credential and it already exists and is_sensitive=True, prompt the user to deobfuscate it in order to allow reuse.
For username: [{"name": "[CUSTOM_USERNAME]", "value": "user@example.com", "value_is_sensitive": true, "enabled": true}]
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| name | Yes | ||
| content | Yes | ||
| sequence_type | No | login | |
| enabled | No | ||
| custom_field_mappings | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that creating a sequence does NOT automatically enable it, and explains credential linking behavior. However, it does not mention idempotency or whether overwriting is possible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is thorough but structured: first sentence states purpose, then content requirement, important note, then credential instructions. It is front-loaded but could be more concise; however, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 params, 3 required), missing annotations, and existing output schema, the description covers creation process and post-condition well. It lacks details on return values or errors, but output schema likely fills that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It explains 'content' as a JSON string of the sequence steps array, and provides example formats for credential mappings. It does not explain 'targetId' or 'name', but those are common and partially inferred. Adds significant value over bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a login sequence', which is a specific verb+resource. It distinguishes from siblings by mentioning the need to call probely_configure_sequence_login after creation, contrasting with other credential-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides when-to-use (credential vs inline values) and a required post-step (call probely_configure_sequence_login). It also gives alternative approaches (use existing credential or inline).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_create_web_targetA
Create a new target. Use labels to assign label names (e.g. ["Agentic", "Production"]). Existing labels are reused; missing ones are created automatically. Use scanning_agent_id to assign a scanning agent for internal/private targets.
Set allow_duplicate=True to create a target even if another target with the same URL already exists. This is useful when you want multiple targets for the same URL with different configurations (e.g., different auth methods, different test scenarios).
If target creation fails because the target is unreachable or the domain cannot be resolved, ask the user whether to retry with skip_reachability_check=True.
IMPORTANT: The response contains a top-level id (the target ID) and a nested
site.id (the site ID). Always use the top-level id as the targetId
parameter for all subsequent tool calls (sequences, scans, logout detection, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| url | Yes | ||
| desc | No | ||
| labels | No | ||
| scanning_agent_id | No | ||
| allow_duplicate | No | ||
| skip_reachability_check | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must cover behavioral traits. It explains that existing labels are reused and missing ones created automatically, and that allow_duplicate bypasses duplicate URL checks. It also highlights the response structure and correct ID to use. However, it does not disclose side effects, permissions needed, or rate limits. Adequate but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with separate paragraphs for key aspects. It uses clear language, includes an IMPORTANT note for post-creation, and avoids redundancy. Every sentence adds value without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and low schema coverage, the description covers creation behavior, error handling, and response guidance. It lacks details on default values for unused parameters and authentication requirements, but output schema may compensate. Overall, it is sufficiently complete for effective tool usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description alone explains labels, scanning_agent_id, allow_duplicate, and skip_reachability_check meaningfully. It gives examples and usage notes. 'name' and 'url' are self-explanatory, and 'desc' is omitted but optional. Most critical parameters are well-covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Create a new target' with a specific verb and resource. Among siblings like probely_create_api_target_from_openapi, it distinguishes itself as a web target. It also provides details on labels, scanning_agent_id, and duplicate handling, making purpose crystal clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear guidance on when to use parameters: labels for naming, scanning_agent_id for private targets, allow_duplicate for same URL with different configs, and skip_reachability_check for retrying after failure. However, it does not explicitly differentiate from sibling create tools (e.g., labels vs create_label tool) or state when not to use it. Still, it provides practical usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_delete_credentialD
| Name | Required | Description | Default |
|---|---|---|---|
| credentialId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_delete_extra_hostD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| extraHostId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_delete_sequenceD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| sequenceId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_delete_targetD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_disable_2faC
Disable 2FA/OTP for a target.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Minimal description with no behavioral details. No disclosure of side effects, reversibility, or required permissions. Annotations absent, so description should cover these.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no extraneous text. Efficient but lacks substance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even though tool is simple, the description fails to explain what disabling entails (e.g., removes TOTP only? Other methods?). Output schema exists but not utilized.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% parameter description coverage, and the description does not elaborate on the meaning or format of targetId beyond the generic word 'target'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states action (disable) and resource (2FA/OTP for a target). Distinguishes from sibling probely_configure_2fa_totp which likely enables 2FA.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool over alternatives. Does not mention prerequisites or context like requiring user permissions or current 2FA status.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_downloadreportC
Download a report by its ID.
| Name | Required | Description | Default |
|---|---|---|---|
| reportId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description must disclose behavior. It only states 'download' without mentioning side effects, auth needs, or output format. Not transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely short and front-loaded. However, it could include more info without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, description should clarify what is returned (e.g., file content, binary). No mention of error conditions or typical usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must add parameter meaning. It says 'by its ID', which is already implied by parameter name and requirement. No added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'download' and resource 'report', but does not differentiate from sibling probely_getreport which may retrieve a report in a different format. Lacks specification of what downloading entails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like probely_getreport. No prerequisites or context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_generate_totpA
Generate a TOTP code from a secret/seed. Use this when recording login sequences that require 2FA. Returns the current TOTP code and its remaining validity in seconds.
| Name | Required | Description | Default |
|---|---|---|---|
| secret | Yes | ||
| algorithm | No | SHA1 | |
| digits | No | ||
| period | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It indicates the tool generates a TOTP code and returns the code plus remaining validity. It does not mention any side effects, permissions, or constraints, but for a generation tool these are minimal. The description is adequate but lacks details about algorithm defaults or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, both essential. First sentence states the core action, second gives usage context and output summary. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (4 parameters, 1 required) and the presence of an output schema (though not shown), the description covers the basics: what it does, when to use it, and what it returns. However, the lack of parameter explanations leaves a notable gap. For a tool with zero schema coverage, the description should provide more parameter context to be fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the input schema provides no descriptions for parameters. The description only mentions 'secret' (implied from 'secret/seed'), but does not explain 'algorithm', 'digits', or 'period'. This leaves the AI agent to rely on defaults or conventions, which is insufficient for correct invocation. The description should at least briefly describe each parameter or refer to TOTP standard defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'Generate a TOTP code from a secret/seed', providing a specific verb and resource. It clearly distinguishes from sibling tools (none of which generate TOTP codes). The context of recording login sequences with 2FA further clarifies its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes 'Use this when recording login sequences that require 2FA.', which gives clear guidance on when to use the tool. However, it does not explicitly state when not to use it or mention alternatives, but the context is sufficient for most use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_credentialA
Get a credential by ID. Value is null if sensitive.
Returns the credential with its 'uri' field (e.g., 'credentials://4DY4qGohso1r'). Use this URI to reference the credential in authentication configs.
| Name | Required | Description | Default |
|---|---|---|---|
| credentialId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that sensitive credentials have their value set to null, and that the tool returns a URI for referencing. This reveals important behavioral traits beyond a simple 'get'. However, it does not mention error cases or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, front-loaded with the primary purpose. Every sentence adds value: first states action, second clarifies output, third gives usage advice. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 parameter, read-only operation) and the presence of an output schema, the description adequately covers key aspects. It explains the null value and URI output. However, it could mention potential errors (e.g., credential not found) for full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter (credentialId) with 0% description coverage. The description does not explain what credentialId is or its expected format (e.g., string format, example). It adds no semantic value beyond the schema parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get a credential by ID') and the resource ('credential'). It specifies the unique identifier (ID) and mentions additional details about the response (value null if sensitive, URI field). Among siblings, it is distinct from other 'get' tools by naming the credential resource explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a usage hint ('Use this URI to reference the credential in authentication configs'), but does not provide explicit guidance on when to choose this tool versus alternatives like probely_list_credentials or probely_create_credential. There is no mention of when not to use it or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_extra_hostD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| extraHostId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_findingD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| findingId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_getreportC
Get report metadata/status by ID.
| Name | Required | Description | Default |
|---|---|---|---|
| reportId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description only implies a read operation but does not disclose side effects, permissions, or idempotency. For a tool with no annotation safety net, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundancy. It is concise but could benefit from additional context without losing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple parameter and existing output schema, the description could explain what metadata/status fields are returned and how to obtain the reportId. The current level is inadequate for a complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about the 'reportId' parameter beyond its name and requirement. The format or source of the ID is not explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves report metadata/status by ID, using a specific verb and resource. It distinguishes from siblings like 'probely_downloadreport' and 'probely_create_scanreport'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites or exclusions. The description does not help the agent decide between this and similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_scanD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| scanId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_scanning_agentC
Get details of a specific scanning agent.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It only says 'Get details,' implying a read operation, but does not disclose what details are returned, whether the operation is idempotent, or any side effects. However, the existence of an output schema partially covers return structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is concise but lacks any structure or front-loading of critical information. It is adequate but not optimized for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema, the description is insufficient. It fails to link to sibling tools like 'probely_list_scanning_agents', explain prerequisite steps, or clarify parameter expectations, leaving gaps in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no meaning beyond the parameter name 'agentId'. It does not explain the format, source, or constraints of the agentId, leaving the parameter entirely opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get details of a specific scanning agent,' using a specific verb ('Get') and resource ('scanning agent'). It distinguishes from sibling 'probely_list_scanning_agents' by implying retrieval of a single agent vs. listing all.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance provided on when to use this tool, such as that it requires an agentId from 'probely_list_scanning_agents' or any prerequisites. No alternatives or exclusions mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_sequenceC
Get details of a specific login sequence.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| sequenceId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description only states 'Get details' which implies read-only, but fails to disclose any behavioral traits such as idempotency, safety, or required permissions. No annotations are provided to fill this gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words, but it is too brief and lacks detail that would improve clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description omits context like relationship to other sequences or targets, prerequisites, or typical usage scenarios, making it incomplete for effective tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain the two required parameters (targetId, sequenceId) beyond their names. With 0% schema description coverage, it provides no added value for understanding parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves details of a login sequence, using a specific verb and resource. It distinguishes from sibling tools like create, update, delete, and list sequences.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like probely_list_sequences. There is no mention of context or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_targetD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_target_settingsD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_teamD
| Name | Required | Description | Default |
|---|---|---|---|
| teamId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_get_userD
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_credentialsA
List credentials. Sensitive values are not returned.
Returns credentials with their 'uri' field (e.g., 'credentials://4DY4qGohso1r'). Use this exact URI format when configuring authentication (basic_auth, headers, etc.). Do NOT use template syntax like {{cred-name}}.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| search | No | ||
| is_sensitive | No | ||
| length | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Given no annotations, the description carries the full burden. It discloses that sensitive values are not returned and specifies the URI format, which are key behavioral traits. It does not mention pagination or rate limits, but for a list tool this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only four sentences, each providing essential information: purpose, missing sensitive values, return format, and proper usage. It is front-loaded and avoids unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description covers purpose and return format, it does not explain how to use the filtering parameters or handle pagination. Given the output schema exists, return values are partly covered, but behavioral details for parameters are missing, leaving gaps for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the four parameters (page, search, is_sensitive, length). The agent must infer their meaning from common conventions, which is risky. The description fails to add value for parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'List credentials' which clearly states the action and resource. It differentiates from other credential tools by focusing on listing and returning URI format, which is distinct from creating, deleting, or updating credentials.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage guidance on URI format and warns against template syntax, but does not explicitly compare when to use list vs get_credential or other credential operations. It implies use in authentication configuration but lacks explicit exclusions or alternative suggestions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_extra_hostsD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_findingsD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| page | No | ||
| severity | No | ||
| state | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_logout_detectorsC
List all logout detectors for a target.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only states the basic action, omitting details like error handling for invalid targetId, whether the list is paginated, or if it returns an empty collection. The output schema may cover return structure, but the description does not add behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence), but it lacks necessary details for a tool with no annotations. It is not overly verbose, but conciseness is not an advantage when content is insufficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, output schema exists), the description is incomplete. It omits usage guidance, parameter clarification, and behavioral traits. The output schema may compensate for return values, but the description does not leverage it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the targetId parameter. The description mentions 'for a target' but does not explain what a targetId represents or how to obtain it, adding minimal meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'logout detectors', specifying the scope 'for a target'. This distinguishes it from sibling tools like probely_create_logout_detector or probely_configure_logout_detection, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or contextual cues, leaving the agent to infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_scanning_agentsC
List scanning agents. Use status to filter: 'connected', 'connected_with_issues', 'disconnected'.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| length | No | ||
| status | No | ||
| search | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description does not disclose behavioral traits such as pagination behavior, rate limits, authentication needs, or what actions are performed. It only hints at filtering without deeper context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two short sentences. Every word is useful, and it front-loads the main action. No unnecessary content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters (0 required) and an output schema, the description only covers status filtering. It does not mention pagination (page/length), search, or provide any context about the response format. For a list tool, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds value only for the status parameter by listing valid filter values ('connected', 'connected_with_issues', 'disconnected'). However, it completely ignores page, length, and search parameters, leaving them unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List scanning agents') and mentions filtering by status. The name and description together make the purpose obvious, but it does not explicitly differentiate from sibling tools like probely_list_scans or probely_list_targets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only says 'Use status to filter', providing minimal guidance on when to use this tool. No mention of when not to use it or alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_scansD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_sequencesB
List all login sequences for a target.
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must bear full transparency burden. It identifies the operation as a read-only list, but does not disclose pagination behavior despite the 'page' parameter, nor does it mention permissions or side effects. Minimal but acceptable for a simple list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence that conveys the core purpose without unnecessary words. It is appropriately front-loaded and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite an output schema existing, the description lacks completeness. It does not specify pagination behavior (even though a 'page' parameter exists), nor does it provide usage context relative to sibling tools. For a tool with two parameters and no schema descriptions, the description is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It fails to explain the 'targetId' or 'page' parameters beyond their names. The description adds no meaning to the input schema, leaving the agent without guidance on how to use these parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'login sequences', with scope 'for a target'. It distinguishes from sibling list tools (e.g., credentials, findings) and specific sequence tools (e.g., get_sequence).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies listing all sequences for a target, but does not explicitly state when to use this tool vs alternatives like probely_get_sequence (single sequence) or probely_list_credentials. No when-not or alternative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_targetsD
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| search | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_list_teamsD
| Name | Required | Description | Default |
|---|---|---|---|
| page | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probelyrequestA
Make a raw request to Probely API (path relative to base).
IMPORTANT: For authentication configuration, use probely_update_target instead:
HTTP Basic Auth: use basic_auth_username and basic_auth_password parameters
API Headers/Cookies Auth: use api_auth_headers and api_auth_cookies parameters
This tool is for advanced use cases or API endpoints not covered by dedicated tools.
When using this tool, reference saved credentials using the URI format 'credentials://' (e.g., 'credentials://4DY4qGohso1r'). Get credential URIs from probely_list_credentials or probely_create_credential. Do NOT use template syntax like {{cred-name}}.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | ||
| path | Yes | ||
| params | No | ||
| json | No | ||
| data | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses important behavioral traits like credential referencing using 'credentials://<credential_id>' and forbids template syntax. However, it doesn't describe side effects or error behavior, which is acceptable for a raw request tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (about 5 sentences) and front-loaded with the purpose. It includes vital notes in a logical order, though it could be structured into bullet points for clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a raw request tool with 5 parameters, no annotations, and existing output schema, the description covers purpose, usage guidelines, and credential handling. However, it omits explanation of data/params/json parameters, which is a gap for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 5 parameters (method, path, params, json, data) with 0% description coverage. The description only mentions path is relative and method/path are required; it does not explain params, json, or data, leaving the agent to infer their purpose from generic HTTP knowledge.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Make a raw request to Probely API (path relative to base).' It specifies the verb 'make' and the resource 'Probely API,' and distinguishes from siblings by noting it's for advanced use cases or endpoints not covered by dedicated tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use this tool versus alternatives: for authentication configuration, use probely_update_target. Also states it's for advanced use cases or endpoints not covered by dedicated tools, providing clear exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_start_scanD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_stop_scanD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| scanId | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_credentialC
Update a credential (partial update).
| Name | Required | Description | Default |
|---|---|---|---|
| credentialId | Yes | ||
| name | No | ||
| value | No | ||
| is_sensitive | No | ||
| description | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. 'Partial update' indicates idempotent behavior, but no disclosure of side effects, auth requirements, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise but sacrifices necessary detail. Acceptable for a simple tool but insufficient for full clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters (1 required) and no parameter descriptions, the tool is incompletely documented. Output schema exists but description offers no context on return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Description provides no parameter details. Schema coverage is 0%, and the description does not compensate by explaining fields like name, value, is_sensitive, or description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'Update a credential (partial update)', making the action and scope clear. It distinguishes from sibling tools like probely_create_credential and probely_delete_credential by specifying update semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like creating or deleting credentials. Prerequisites (e.g., obtaining credentialId) are not mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_extra_hostD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| extraHostId | Yes | ||
| hostname | No | ||
| ip_address | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_findingD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| findingId | Yes | ||
| state | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_sequenceC
Update a login sequence. Use custom_field_mappings to configure credentials instead of hardcoding them in the sequence content. Use credential URIs for sensitive values by default.
custom_field_mappings should be a JSON array string, e.g.: [{"name": "[CUSTOM_USERNAME]", "value": "user@example.com", "value_is_sensitive": false, "enabled": true}]
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| sequenceId | Yes | ||
| name | No | ||
| content | No | ||
| enabled | No | ||
| custom_field_mappings | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It indicates 'update' which implies mutation, but fails to disclose important behavioral traits such as whether the update overwrites or merges fields, authentication requirements, or any side effects. The description only offers a best-practice tip, not behavioral specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description contains two sentences plus an example JSON. It is moderately concise, but the example is useful. The first sentence is clear; the second sentence and example add value but could be condensed slightly. Still, it is not overly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, 2 required, no annotations), the description lacks completeness. It does not explain the update behavior (e.g., whether it is a partial update or full replacement), prerequisites (e.g., sequence must exist), or what the output contains (despite an output schema existing). The custom_field_mappings guidance is helpful, but many other aspects are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only provides a detailed explanation for the custom_field_mappings parameter, including its JSON array format and an example. The other five parameters (targetId, sequenceId, name, content, enabled) are not described at all, leaving significant gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Update a login sequence', which clearly indicates the verb (update) and resource (login sequence). It is not a tautology. However, it does not explicitly differentiate from sibling tools like probely_create_sequence or probely_configure_sequence_login, but the name itself clarifies the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using custom_field_mappings and credential URIs for sensitive values, implying best practices. However, it does not explicitly state when to use this tool versus alternatives (e.g., creating a new sequence or configuring sequence login). Usage context is implied, not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_targetA
Update a target. Use labels to assign label names (e.g. ["Agentic", "Production"]). Existing labels are reused; missing ones are created automatically. Use scanning_agent_id to assign or change the scanning agent. Pass "" to remove it.
IMPORTANT: The headers/cookies parameters are for general custom headers/cookies sent with every scan request (NOT for authentication). They use a simple structure: {"name": "...", "value": "..."}.
For HTTP Basic Auth authentication: Use basic_auth_username and basic_auth_password parameters. Both must be provided together. Example: probely_update_target( targetId, basic_auth_username="credentials://xxx", # or inline: "api-user" basic_auth_password="credentials://yyy" # or inline: "secret123" )
For API authentication with static headers/cookies: Use api_auth_headers and/or api_auth_cookies parameters with full structure including authentication flags. The tool automatically sets api_login_enabled=true and api_login_method='headers_or_cookies'. Example: probely_update_target( targetId, api_auth_headers=[{ "name": "X-API-Key", "value": "credentials://xxx", "value_is_sensitive": false, "allow_testing": false, "authentication": true, "authentication_secondary": false }], api_auth_cookies=[{ "name": "session", "value": "credentials://yyy", "value_is_sensitive": false, "allow_testing": false, "authentication": true, "authentication_secondary": false }] )
Reference saved credentials using URI format 'credentials://' (not {{cred-name}}).
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| name | No | ||
| url | No | ||
| desc | No | ||
| labels | No | ||
| scanning_agent_id | No | ||
| headers | No | Custom HTTP headers sent with every scan request (for general use, NOT for authentication). Each entry: {"name": "<header-name>", "value": "<header-value>"}. Replaces all existing custom headers. To reference saved credentials in header values, use URI format 'credentials://4DY4qGohso1r'. For API authentication using static headers, use api_auth_headers parameter instead. | |
| cookies | No | Custom cookies sent with every scan request (for general use, NOT for authentication). Each entry: {"name": "<cookie-name>", "value": "<cookie-value>"}. Replaces all existing custom cookies. To reference saved credentials in cookie values, use URI format 'credentials://4DY4qGohso1r'. For API authentication using static cookies, use api_auth_cookies parameter instead. | |
| basic_auth_username | No | Username for HTTP Basic Auth. Use credential URI format 'credentials://xxx' to reference saved credentials. When set, basic_auth_password must also be provided. | |
| basic_auth_password | No | Password for HTTP Basic Auth. Use credential URI format 'credentials://xxx' to reference saved credentials. When set, basic_auth_username must also be provided. | |
| api_auth_headers | No | Authentication headers for API targets. Full structure with authentication flags. Each entry: {"name": "X-API-Key", "value": "credentials://xxx", "value_is_sensitive": false, "allow_testing": false, "authentication": true, "authentication_secondary": false}. Automatically sets api_login_enabled=true and api_login_method='headers_or_cookies'. | |
| api_auth_cookies | No | Authentication cookies for API targets. Full structure with authentication flags. Each entry: {"name": "session", "value": "credentials://xxx", "value_is_sensitive": false, "allow_testing": false, "authentication": true, "authentication_secondary": false}. Automatically sets api_login_enabled=true and api_login_method='headers_or_cookies'. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must carry the transparency burden. It discloses key behaviors: labels are reused/created automatically, scanning_agent_id can be removed with empty string, and auth parameters have specific structures. However, it does not mention idempotency, permission requirements, or whether the update is partial or full replacement. More behavioral context would be beneficial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose, bullet points, and examples for different authentication methods. It is somewhat verbose with repeated credential URI notes, but the organization helps readability. Could be more concise, but effective overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and a complex 12-parameter tool, the description covers major usage scenarios, including labels, scanning agents, and authentication types. It does not mention the return value (though an output schema exists), nor does it address idempotency or concurrency. For a mutation tool, some operational context is missing, but the description is still fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (6/12 parameters have descriptions). The global description adds significant meaning for complex parameters like labels, scanning_agent_id, and authentication parameters, including examples and credential URI format. Simpler parameters like name, url, desc rely on schema alone, but overall the description compensates well for the gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Update a target' which is a clear verb+resource combination. It distinguishes the tool from siblings like probely_update_target_settings by focusing on target properties such as labels, scanning agent, and authentication configurations. However, it does not explicitly differentiate from all siblings, so score is 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides extensive guidance on using labels, scanning_agent_id, and the distinction between general headers/cookies and authentication parameters. Includes examples for Basic Auth and API auth. However, does not explicitly state when to use this tool versus alternative tools like probely_update_target_settings, so score is 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
probely_update_target_settingsD
| Name | Required | Description | Default |
|---|---|---|---|
| targetId | Yes | ||
| excluded_paths | No | ||
| max_scan_duration | No | ||
| scan_profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Tool has no description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tool has no description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has no description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Tool has no description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Tool has no description.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tool has no description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
51 tool updates
v1.1.3- First observed
probely_bulk_update_findings - First observed
probely_cancel_scan - First observed
probely_configure_2fa_totp - First observed
probely_configure_form_login - First observed
probely_configure_logout_detection - First observed
probely_configure_sequence_login - First observed
probely_create_api_target_from_openapi - First observed
probely_create_api_target_from_postman - First observed
probely_create_credential - First observed
probely_create_extra_host - First observed
probely_create_label - First observed
probely_create_logout_detector - First observed
probely_create_scanreport - First observed
probely_create_sequence - First observed
probely_create_web_target - First observed
probely_delete_credential - First observed
probely_delete_extra_host - First observed
probely_delete_sequence - First observed
probely_delete_target - First observed
probely_disable_2fa - First observed
probely_downloadreport - First observed
probely_generate_totp - First observed
probely_get_credential - First observed
probely_get_extra_host - First observed
probely_get_finding - First observed
probely_get_scan - First observed
probely_get_scanning_agent - First observed
probely_get_sequence - First observed
probely_get_target - First observed
probely_get_target_settings - First observed
probely_get_team - First observed
probely_get_user - First observed
probely_getreport - First observed
probely_list_credentials - First observed
probely_list_extra_hosts - First observed
probely_list_findings - First observed
probely_list_logout_detectors - First observed
probely_list_scanning_agents - First observed
probely_list_scans - First observed
probely_list_sequences - First observed
probely_list_targets - First observed
probely_list_teams - First observed
probely_start_scan - First observed
probely_stop_scan - First observed
probely_update_credential - First observed
probely_update_extra_host - First observed
probely_update_finding - First observed
probely_update_sequence - First observed
probely_update_target - First observed
probely_update_target_settings - First observed
probelyrequest
TDQS
Many tools lack descriptions (e.g., cancel_scan, create_label, delete_target), making it hard for agents to distinguish them. Additionally, tools like probelyrequest overlap with dedicated tools, increasing ambiguity.
Most tools follow a probely_verb_noun pattern, but a few deviate (downloadreport, getreport, probelyrequest) and one uses a number (configure_2fa_totp). Overall pattern is strong but not flawless.
With 51 tools, the server is far beyond the typical 3-15 well-scoped range. While it comprehensively wraps the Probely API, the large number can overwhelm agents and suggests lack of curation.
The set covers major domains (targets, scans, findings, credentials, authentication), but there are gaps like missing label management beyond creation and no update/delete for some resources. Some tools are missing descriptions, obscuring coverage.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- mcpOAuthcom.vibgrate
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
AI pentesting: run scans, triage vulnerabilities, review PRs, manage schedules and assets.
Connects AI assistants to CloudQuell multi-cloud and AI cost, savings, anomaly, and budget data.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceProvides security scanning capabilities through Snyk CLI tools and REST API, enabling AI assistants to test projects for vulnerabilities, retrieve security issues, and manage Snyk projects with comprehensive SAST, container, and infrastructure as code scanning.2MIT
- AlicenseAqualityDmaintenanceEnables AI assistants to scan project dependencies and Infrastructure as Code files for security vulnerabilities and misconfigurations. It also provides automated fixing capabilities to remediate identified security issues.183MIT
- FlicenseAqualityDmaintenanceExposes Burp Suite's REST API to AI assistants, enabling users to trigger vulnerability scans, monitor progress, and manage security tasks through natural language. It also provides programmatic access to Burp's security knowledge base for querying vulnerability definitions and remediation advice.81-

Cybrium MCP Serverofficial
AlicenseNot gradedqualityBmaintenanceProvides AI coding assistants with real-time security scanning superpowers, including SAST, secrets detection, dependency CVE scanning, and web vulnerability assessment.27Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/snyk/saw-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server