Skip to main content
Glama
Sign In
stepsecurity-mcp

stepsecurity-mcp

Official
by step-security
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

list_recent_workflow_runs

Lists the 100 most recent Harden-Runner-monitored workflow runs for a GitHub organization or repository, returning run IDs and clickable dashboard URLs for CI/CD security investigation.

Instructions

List the 100 most recent Harden-Runner-monitored workflow runs for a GitHub organization, optionally narrowed to one repository. Use this to discover run IDs when the user asks about a run without giving an explicit ID — e.g. 'the latest run of trivy-scan in poc-1'. Every result has a dashboard_url — when you present runs to the user you MUST include a clickable link per run, not just the first one.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "owner": "<owner>"
    },
    "name": "list_recent_workflow_runs"
  }
}

Input Schema

NameRequiredDescriptionDefault
ownerYesGitHub organization
repoNoRepository name (without owner). Omit for org-wide runs.
pageNoPage number (default 1)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.1

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the limit of 100 results, optional repository narrowing, and instructs to include clickable dashboard_url links per run. Missing details on authentication or rate limits, but the given behavioral details are valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, followed by usage guidance and a critical output instruction (clickable links). No filler words; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description provides essential context: result limit, optional filtering, and the presence of dashboard_url with a usage rule. Lacks detail on other output fields or pagination behavior, but sufficient for common use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by clarifying that omitting 'repo' gives org-wide runs and explains the 'page' default (implied). This extra context justifies a score of 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'list', the resource 'workflow runs', and the scope '100 most recent Harden-Runner-monitored' for a GitHub organization. It distinguishes from sibling tools, which are largely security-specific list tools, by focusing on workflow runs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Use this to discover run IDs when the user asks about a run without giving an explicit ID' with a concrete example. Lacks mention of when not to use it (e.g., if more than 100 runs needed or specific filtering), but the guidance is clear and helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools