Scan a public website for TLS and browser security header weaknesses and return a security score with fixes.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes |
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | Structured Web security audit result | |
| meta | Yes | ||
| service | Yes | ||
| version | Yes | ||
| request_id | Yes | Unique request identifier |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Output schema / properties / data / properties / cookieFlags / itemsRemoved value: -{}Output schema / properties / data / properties / cookieFlags / typePrevious value: -"array"New value: +"object"Output schema / properties / data / properties / present / itemsRemoved value: -{}Output schema / properties / data / properties / present / typePrevious value: -"array"New value: +"object"Output schema / properties / meta / properties / next_actions / items / properties / checkout_pathAdded value: +{
+ "pattern": "^/try/",
+ "type": "string"
+}Output schema / properties / meta / properties / next_actions / items / properties / executes_automaticallyAdded value: +{
+ "const": false,
+ "type": "boolean"
+}Output schema / properties / meta / properties / next_actions / items / properties / handoff_pathAdded value: +{
+ "description": "Free full contract and spend-capped command handoff; reading it does not execute or purchase the follow-up.",
+ "pattern": "^/catalog/",
+ "type": "string"
+}Output schema / properties / meta / properties / next_actions / items / properties / handoff_payment_requiredAdded value: +{
+ "const": false,
+ "type": "boolean"
+}Output schema / properties / meta / properties / next_actions / items / properties / maximum_atomic_usdcAdded value: +{
+ "pattern": "^[1-9][0-9]*$",
+ "type": "string"
+}Output schema / properties / meta / properties / next_actions / items / properties / sample_pathAdded value: +{
+ "pattern": "^/samples/",
+ "type": [
+ "string",
+ "null"
+ ]
+}Output schema / properties / meta / properties / next_actions / items / requiredPrevious value: -[
- "service",
- "title",
- "reason",
- "method",
- "path",
- "price",
- "input_template",
- "use_output",
- "authorization_required"
-]New value: +[
+ "service",
+ "title",
+ "reason",
+ "method",
+ "path",
+ "price",
+ "input_template",
+ "use_output",
+ "handoff_path",
+ "checkout_path",
+ "sample_path",
+ "maximum_atomic_usdc",
+ "handoff_payment_required",
+ "executes_automatically",
+ "authorization_required"
+]Output schema / properties / meta / properties / next_actionsAdded value: +{
+ "description": "Optional separately priced follow-up calls. Each action requires a new payment challenge and explicit buyer authorization.",
+ "items": {
+ "properties": {
+ "authorization_required": {
+ "const": true,
+ "type": "boolean"
+ },
+ "input_template": {
+ "description": "Client-side template only: $request refers to the original input, $result to this response, and $json(...) serializes its argument. The server does not execute the follow-up.",
+ "type": "object"
+ },
+ "method": {
+ "const": "POST",
+ "type": "string"
+ },
+ "path": {
+ "pattern": "^/v1/",
+ "type": "string"
+ },
+ "price": {
+ "pattern": "^\\$[0-9]+",
+ "type": "string"
+ },
+ "reason": {
+ "type": "string"
+ },
+ "service": {
+ "type": "string"
+ },
+ "title": {
+ "type": "string"
+ },
+ "use_output": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "service",
+ "title",
+ "reason",
+ "method",
+ "path",
+ "price",
+ "input_template",
+ "use_output",
+ "authorization_required"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+}Output schema / properties / meta / requiredPrevious value: -[
- "duration_ms",
- "cached",
- "sources",
- "warnings"
-]New value: +[
+ "duration_ms",
+ "cached",
+ "sources",
+ "warnings",
+ "next_actions"
+]Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the description only needs to add nuance. It does add that the scan targets a public website and returns a score with fixes, but it does not disclose methodology, rate limits, or other behavioral details. This is similar to the get_calls calibration, where annotations cover safety and the description adds limited context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action (scan), the target (public website), the specific focus (TLS/header weaknesses), and the outcome (score with fixes). There is no redundant or unnecessary wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, output schema present), the description covers the core aspects: purpose, target, checks, and result. The 'public website' qualifier is a useful constraint. It does not need to describe return values in detail because the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the single 'url' parameter. The description implicitly tells the agent the URL must be for a public website, which adds some semantic value beyond the schema's URI format, but it does not explicitly explain the parameter's role or format beyond what the parameter name and schema imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans a public website for TLS and browser security header weaknesses, with an explicit outcome of a security score and fixes. It distinguishes itself from sibling audit tools like web.seo-audit or web.performance-profile by focusing specifically on security headers and TLS.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool by specifying the exact security scope, making it clear this is for TLS/header security audits. However, it does not explicitly mention alternatives or when not to use it, so it lacks the explicit comparison seen in top-tier descriptions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Tools are grouped into clear domain prefixes (crypto, data, developer, document, research, web) and each tool name describes a specific function; however, a few umbrella tools like web.full-audit and data.contract overlap with their more targeted counterparts, creating minor ambiguity.
All tool names follow a consistent pattern: a domain prefix, a dot, and a hyphenated lowercase compound name (e.g., crypto.base-block-inspect, web.seo-audit). This makes naming predictable and easy to scan.
At 63 tools, the surface area is very large and exceeds the 50+ threshold for extreme mismatch. While the tools are organized into six domains, the sheer number makes it difficult for an agent to select efficiently, and some tools are bundled combinations of others.
Each domain offers a thorough set of operations: crypto covers address, account, block, contract, events, gas, and transaction inspection; data covers cleaning, conversion, schema, and validation; developer covers code review, dependency/license audits, and test generation; research covers SEC, OFAC, GLEIF, and USAspending; web covers extraction, SEO, security, and performance. No obvious dead ends exist for the read-only/inspection purpose.