Skip to main content
Glama
Sign In
@writerslogic/ai-agents-mcp

@writerslogic/ai-agents-mcp

Official
by writerslogic
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

unicode_safety_gate

Scans GitHub repos, pull requests, diffs, or files for adversarial Unicode and Trojan Source risks, then returns a block/warn/pass verdict, risk score, locations, and fixes.

Instructions

Adversarial Unicode & Trojan Source gatekeeper. Scans a public GitHub repo, a pull request, a unified diff or a list of files for adversarial Unicode with the 19 rules (USC001-USC019) of dcondrey/unicode-safety-check: bidi controls (Trojan Source), invisible and default-ignorable characters, variation-selector and tag-character payloads (Glassworm), private-use code points, homoglyph and mixed-script identifiers, confusable collisions, misplaced BOM and control characters. Leads with a block/warn/pass verdict, a 0-100 risk score, the top locations (file:line:column) grouped so one trick reads as one finding, and the fix; also returns every finding, a SARIF 2.1.0 log for GitHub code scanning, and model-written exploit explanations that are checked against the findings. Findings and verdict come from deterministic rules; only the explanations use a model. Repo scans read up to 1,000,000 characters, shallowest files first, and list what they skipped.

Cost: 0.25 USDC per call, paid automatically over x402 on Base when AGENT_PRIVATE_KEY is configured and the price is within MAX_USDC_PER_CALL.

Input Schema

NameRequiredDescriptionDefault
refNoBranch, tag or commit for repo; defaults to the default branch.
diffNoUnified diff (git diff output). Only added lines are scanned; findings carry new-file line numbers.
repoNoAlternative to files and diff: a public GitHub repository, owner/repo or https://github.com/owner/repo[/tree/ref]. Read from its source archive; files are scanned shallowest first up to the character cap and the rest are listed as skipped.
filesNoFiles to scan in full. Provide exactly one of files, diff, repo or prUrl; total content is capped at 1000000 characters.
prUrlNoAlternative to files and diff: a public GitHub pull request, commit or compare URL. Only added lines are scanned.
scanExcludedNoAlso scan paths the upstream scanner skips (node_modules/, vendor/, dist/, build/, .lock, .min.js, images, archives). Default false.
identifierPolicyNoDefault ascii-only: any non-ASCII identifier is flagged (USC019).
permittedScriptsNoUsed with permitted-scripts. Default Latin, Common, Inherited.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations: discloses that findings/verdict are deterministic and only explanations are model-written, the 1,000,000-char repo cap with shallowest-first ordering and reported skips, default skipping of node_modules/vendor/dist, and that only added lines in diffs are scanned. It also discloses the per-call cost (0.25 USDC over x402 on Base) and its payment precondition, which the annotations say nothing about.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the identity and verdict, then outputs, then determinism caveat, then cost. It is long and the 19-rule enumeration is dense, but each clause carries information an agent could act on; a little tightening of the rule list would help.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by naming the return payload: verdict, 0-100 risk score, grouped top locations with file:line:column, fix, all findings, and SARIF 2.1.0. For a paid, multi-mode scanner whose annotations do not cover cost or limits, the remaining behavioral gaps are closed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so every parameter already carries its own description; the baseline is 3. The description adds only marginal meaning on top (char cap, shallowest-first, skip listing), all of which the schema also states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: 'scans ... for adversarial Unicode' with the named rule set (USC001-USC019) and the attack classes covered. The four input modes (repo, PR, diff, file list) plus the block/warn/pass verdict distinguish it from generic scanners, though no sibling (e.g. unicode_check, identifier_text_kit, diff_gatekeeper) is named for contrast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mutually exclusive 'exactly one of files, diff, repo or prUrl' selection is stated, which is real usage guidance, but it largely restates the schema. There is no explicit when-to-use versus the closely related unicode_check or pre_merge_review siblings, and no stated preconditions such as public-repo-only limits beyond 'public GitHub'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools