Skip to main content
Glama
Synvoya

CodeInspectus

by Synvoya
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Local

Generate a software bill of materials

codeinspectus_generate_sbom
Idempotent

Generate a CycloneDX or SPDX SBOM for a project offline using Trivy and Pub lockfile data, then return the output file path and component count.

Instructions

Generate a CycloneDX or SPDX SBOM for the target project using Trivy plus the first-party offline Pub lockfile inventory, with native Pub fallback when Trivy is unavailable. Writes the SBOM file to the chosen output path and returns its location and component count. Offline.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path to the project to generate an SBOM for.
formatNoSBOM format (default: cyclonedx).
output_pathNoWhere to write the SBOM file. Default: ~/.codeinspectus/sbom/<project>.<fmt>.json.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteNo
formatYes
offlineYes
generatedYes
providersYes
ecosystemsYes
limitationsYes
output_pathYes
coverage_stateYes
component_countYes
lockfiles_analyzedYes

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed8 schema fields changedv2.5.0
    • changedInput schema / properties / output_path / description
      Previous value: -"Where to write the SBOM file. Default: <path>/codeinspectus-sbom.<fmt>.json."New value: +"Where to write the SBOM file. Default: ~/.codeinspectus/sbom/<project>.<fmt>.json."
    • addedOutput schema / properties / coverage_state
      Added value: +{
+  "enum": [
+    "combined",
+    "native_only",
+    "trivy_only",
+    "unavailable"
+  ],
+  "type": "string"
+}
    • addedOutput schema / properties / ecosystems
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / limitations
      Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedOutput schema / properties / lockfiles_analyzed
      Added value: +{
+  "minimum": 0,
+  "type": "integer"
+}
    • addedOutput schema / properties / offline
      Added value: +{
+  "type": "boolean"
+}
    • addedOutput schema / properties / providers
      Added value: +{
+  "items": {
+    "enum": [
+      "trivy",
+      "codeinspectus-pub"
+    ],
+    "type": "string"
+  },
+  "type": "array"
+}
    • changedOutput schema / required
      Previous value: -[
-  "format",
-  "output_path",
-  "component_count",
-  "generated"
-]New value: +[
+  "format",
+  "output_path",
+  "component_count",
+  "generated",
+  "offline",
+  "providers",
+  "ecosystems",
+  "coverage_state",
+  "lockfiles_analyzed",
+  "limitations"
+]
  2. First observedv0.2.1

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that it writes a file, returns a file location plus component count, uses Trivy with a first-party offline Pub lockfile inventory, and falls back to native Pub. It also explicitly states 'Offline,' adding meaningful behavioral context. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, each carrying significant information: what is produced, how, under which conditions, fallback behavior, and output semantics. There is no filler or redundant restatement of the tool name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the moderate complexity and the presence of a full output schema, the description sufficiently covers the tool's behavior, output, offline nature, and fallback paths. It provides enough context for an agent to select and invoke it appropriately without ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents all three parameters with clear descriptions and default values, so the description adds only minor reinforcement like 'chosen output path.' It does not introduce new meaning beyond the schema's existing high coverage, resulting in a baseline-level score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Generate'), the exact deliverable ('CycloneDX or SPDX SBOM'), and the target ('target project'), distinguishing it clearly from sibling tools like scanning or reporting. It also communicates the method and file output, making the tool's scope immediately obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use this tool: whenever an SBOM is needed for a target project, with explicit offline behavior and fallback logic. It does not list alternatives or exclusion conditions, but no sibling tool appears to duplicate SBOM generation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Synvoya/codeinspectus'

If you have feedback or need assistance with the MCP directory API, please join our Discord server