Public assessment

sevalla-hosting/mcp (sevalla-mcp)

sevalla-mcp · v1.0.0 · scanned Aug 3, 2026

What changed in the harness

Selection accuracy 100→100, token cost up 3%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

19.4 / 30

19.4 out of 30

03Economics

7.3 / 20

7.3 out of 20

04Discoverability

9.3 / 20

9.3 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

42 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`sevalla.applications.create`	params_unexplained	Create a new application from a Git repository, provisioning the compute resources needed to run it. Provide a display name, repository URL, and branch to deploy; optionally set the build mechanism (nixpacks, buildpacks, or dockerfile) that determines how the source is compiled and the data center location. Returns the created application with its UUID.
`sevalla.databases.reset-password`	name_restates_behavior	Reset the password for the specified database, generating a new credential for connecting to it. Requires the database UUID. Returns the updated database along with the new password.
`sevalla.databases.backups.list`	name_restates_behavior	Retrieve all backups that exist for the specified database, including their identifiers and timestamps, so one can be selected for restore. Requires the database UUID. Returns the list of backups.
`sevalla.databases.backups.create`	name_restates_behavior	Trigger an on-demand managed backup of the specified database immediately, in addition to any scheduled backups. Requires the database UUID. Returns the created backup record.
`sevalla.databases.backups.restore`	name_restates_behavior	Restore the specified database to the state captured in the given backup, overwriting current data. Requires the database UUID and the backup UUID to restore from. Returns the result of the restore operation.
`sevalla.static-sites.list`	name_restates_behavior	Retrieve a paginated list of all static sites for the company, optionally scoped by company UUID, limit, and offset. Returns the static sites with their identifiers and basic details.
`sevalla.static-sites.get`	name_restates_behavior	Retrieve the full configuration and current status of a single static site, including its deployment information. Requires the static site UUID. Returns the site details.
`sevalla.static-sites.create`	name_restates_behavior params_unexplained	Create a new static site from a Git repository, configuring how it is built and published. Provide a display name, repository URL, and branch to deploy; optionally specify the build command to run, the publish directory (the folder containing the built files to serve), and the data center location. Returns the created static site with its UUID.
`sevalla.static-sites.update`	name_restates_behavior	Update the configuration of an existing static site, such as its display name. Requires the static site UUID. Returns the updated static site.
`sevalla.static-sites.delete`	name_restates_behavior	Permanently delete a static site along with all of its associated deployments and resources. This action cannot be undone. Requires the static site UUID.
`sevalla.static-sites.get-deployment`	name_restates_behavior	Retrieve the details and status of a specific deployment for a static site, useful for verifying whether a deploy succeeded. Requires the static site UUID and the deployment UUID. Returns the deployment details.
`sevalla.static-sites.purge-cache`	name_restates_behavior	Clear the edge cache for a static site so that new deployments or content changes are served immediately instead of stale cached copies. Requires the static site UUID.
`sevalla.pipelines.stages.create`	name_restates_behavior	Add a new stage to an existing deployment pipeline, providing the stage name. Requires the pipeline UUID. Returns the created stage.
`sevalla.pipelines.stages.delete`	name_restates_behavior	Remove a stage from a deployment pipeline. Requires the pipeline UUID and the stage UUID to remove. Returns the updated pipeline.
`sevalla.pipelines.enable-preview`	name_restates_behavior	Turn on preview environments for the pipeline so that branches or pull requests get temporary deployable environments for review. Requires the pipeline UUID.
`sevalla.pipelines.disable-preview`	name_restates_behavior	Turn off preview environments for the pipeline, stopping automatic preview deploys for branches or pull requests. Requires the pipeline UUID.
`sevalla.applications.domains.list`	name_restates_behavior	Retrieve all custom domains attached to the application, including their verification and SSL status. Requires the application UUID. Returns the list of domains.
`sevalla.applications.domains.add`	name_restates_behavior	Attach a new custom domain, such as example.com, to the application so traffic for that hostname is routed to it. Requires the application UUID and the hostname. Returns the added domain, after which DNS and SSL verification typically follow.
`sevalla.applications.domains.set-primary`	name_restates_behavior	Make the given domain the primary domain for the application, so that requests to the default Sevalla URL redirect to it. Requires the application UUID and the domain UUID. Returns the updated domain.
`sevalla.load-balancers.list`	name_restates_behavior	Retrieve a paginated list of all load balancers for the company, optionally scoped by company UUID, limit, and offset. Returns the load balancers with their identifiers and details.
`sevalla.load-balancers.get`	name_restates_behavior	Retrieve the full configuration and status of a single load balancer, including its attached destinations. Requires the load balancer UUID. Returns the load balancer details.
`sevalla.load-balancers.create`	name_restates_behavior	Provision a new load balancer to distribute inbound traffic across multiple backend destinations. Provide a display name and optionally the data center location. Returns the created load balancer with its UUID.
`sevalla.load-balancers.update`	name_restates_behavior	Update the configuration of an existing load balancer, such as its display name. Requires the load balancer UUID. Returns the updated load balancer.
`sevalla.load-balancers.delete`	name_restates_behavior	Permanently delete a load balancer and stop routing traffic through it. This action cannot be undone. Requires the load balancer UUID.
`sevalla.load-balancers.destinations.list`	name_restates_behavior	List all backend destinations currently attached to a load balancer, including their target references. Requires the load balancer UUID. Returns the destinations.
`sevalla.load-balancers.destinations.add`	name_restates_behavior	Attach a target resource, such as an application, to the load balancer so it can begin receiving traffic. Requires the load balancer UUID and the target UUID. Returns the added destination.
`sevalla.load-balancers.destinations.remove`	name_restates_behavior	Detach a destination from the load balancer so it no longer receives traffic. Requires the load balancer UUID and the destination UUID to remove. Returns the updated load balancer.
`sevalla.load-balancers.destinations.toggle`	name_restates_behavior	Enable or disable a destination on the load balancer, turning its traffic on or off without removing it. Requires the load balancer UUID and the destination UUID. Returns the updated destination.
`sevalla.object-storage.list`	name_restates_behavior	Retrieve a paginated list of all object storages for the company, optionally scoped by company UUID, limit, and offset. Returns the object storages with their identifiers and details.
`sevalla.object-storage.get`	name_restates_behavior	Retrieve the configuration and status of a single object storage, including its endpoints and usage. Requires the object storage UUID. Returns the object storage details.
`sevalla.object-storage.create`	name_restates_behavior	Provision a new object storage bucket for storing files and assets. Provide a display name and optionally a data center location. Returns the created object storage with its UUID.
`sevalla.object-storage.update`	name_restates_behavior	Update the configuration of an existing object storage, such as its display name. Requires the object storage UUID. Returns the updated object storage.
`sevalla.object-storage.delete`	name_restates_behavior	Permanently delete an object storage along with all of its stored objects. This action cannot be undone. Requires the object storage UUID.
`sevalla.object-storage.cdn.enable`	name_restates_behavior	Turn on the CDN for the object storage so its objects are delivered from edge locations for faster global access. Requires the object storage UUID. Returns the updated object storage.
`sevalla.object-storage.cdn.disable`	name_restates_behavior	Turn off the CDN for the object storage so objects are served directly from the origin. Requires the object storage UUID. Returns the updated object storage.
`sevalla.object-storage.objects.list`	name_restates_behavior	List the objects stored in the object storage, including their keys and metadata, to inspect what has been uploaded. Requires the object storage UUID. Returns the list of objects.
`sevalla.object-storage.objects.delete`	name_restates_behavior	Permanently delete one or more objects stored in the object storage by their keys. This action cannot be undone. Requires the object storage UUID and an array of object keys to delete.
`sevalla.webhooks.roll-secret`	name_restates_behavior	Regenerate the signing secret for the webhook so outgoing event payloads are signed with a new key; existing consumers must update to the new secret. Requires the webhook UUID. Returns the new signing secret.
`sevalla.webhooks.event-deliveries.list`	name_restates_behavior	Retrieve the event delivery attempts for a webhook, including their statuses and response codes, to debug failed or delayed deliveries. Requires the webhook UUID. Returns the list of event deliveries.
`sevalla.projects.services.add`	name_restates_behavior params_unexplained	Add a service to an existing project to group related cloud resources. Requires the project UUID, the service UUID to add, and the service_type describing what kind of resource it is (e.g., application, database, or static site). Returns the updated project.
`sevalla.projects.services.remove`	name_restates_behavior	Remove a service from a project, detaching it from that group. Requires the project UUID and the service UUID to remove. Returns the updated project.
`sevalla.api-keys.list`	name_restates_behavior	Retrieve all API keys for the company, including their names and enabled or disabled status, to manage programmatic access. Optionally scoped by company UUID. Returns the list of API keys.

Selection evidence

Confusable tool pairs.

14 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`sevalla.object-storage.list`	`sevalla.object-storage.objects.list`	medium	A task like 'list the objects in my storage' hinges entirely on singular/plural ('object storages' vs 'objects in an object storage'); users often drop the scope cue, and both descriptions share list/object/storage, so the agent can pick the wrong level.
`sevalla.object-storage.delete`	`sevalla.object-storage.objects.delete`	medium	'Delete the objects from my storage' vs 'delete the storage' differ only by the plural 'objects' token; both descriptions are destructive ('cannot be undone') and share delete/object/storage, so an agent may delete the whole storage when the user meant contained objects, or vice versa.
`sevalla.static-sites.get`	`sevalla.static-sites.get-deployment`	medium	A task like 'get the details of the static site deployment' is ambiguous: it could match 'Get details of a specific static site' via prefix similarity or the deployment-specific tool; the target object (site vs site deployment) is unclear in natural phrasing.
`sevalla.deployments.get`	`sevalla.static-sites.get-deployment`	medium	Both fetch 'details of a specific deployment'; a task like 'get the deployment details' for a static site could route to either the generic deployments.get (app-based) or the static-sites version, especially since the user rarely names the resource kind explicitly.
`sevalla.resources.database-resource-types`	`sevalla.resources.process-resource-types`	medium	Both describe 'available machine sizes and configurations'; a task like 'what sizes/configs are available' is underspecified unless the user says database or process, so an agent using only the descriptions can select the wrong resource kind.
`sevalla.applications.env-vars.create`	`sevalla.applications.env-vars.update`	medium	A task like 'set FOO to bar' or 'add this env var' is ambiguous between create and update when it is unknown whether the variable already exists; both descriptions are nearly identical apart from 'new' vs 'existing'.
`sevalla.applications.env-vars.create`	`sevalla.global-env-vars.create`	medium	'Create a new environment variable' without specifying application vs company scope matches both descriptions equally, and the two differ mainly in the 'for an application' vs 'global' qualifier.
`sevalla.applications.env-vars.update`	`sevalla.global-env-vars.update`	medium	Both read 'Update an existing ... environment variable'; a task like 'update the API_KEY env var' is plausible for either scope, and the app-level variant is only distinguished by its app_id parameter.
`sevalla.applications.env-vars.delete`	`sevalla.global-env-vars.delete`	medium	'Delete this environment variable' is equally applicable to the application-scoped and global tools; the distinguishing scope must be inferred from the task, which often does not state it.
`sevalla.applications.env-vars.list`	`sevalla.global-env-vars.list`	medium	'List my environment variables' is ambiguous between per-application and company-global lists; both are 'List all ... environment variables' with only scope differing.
`sevalla.databases.create`	`sevalla.databases.backups.create`	low	A task like 'create a new database backup' is dominated by the tokens create/database and could be matched to the root databases.create ('Create a new database') rather than the backup tool, though descriptions do disambiguate on the object noun.
`sevalla.pipelines.create`	`sevalla.pipelines.stages.create`	low	'Add a new stage to my pipeline' risks being matched to pipelines.create ('Create a new deployment pipeline') due to shared create/pipeline tokens, but both descriptions specify pipeline vs stage in a pipeline fairly clearly.
`sevalla.api-keys.create`	`sevalla.api-keys.rotate`	low	A task like 'generate a new token' could match either 'Create a new API key' or 'Generate a new token for an API key', since both are creation-like operations over the same resource.
`sevalla.webhooks.event-deliveries.list`	`sevalla.webhooks.event-deliveries.get`	low	'Show me the event deliveries for this webhook' could be read as listing all deliveries or retrieving a specific delivery's details; descriptions share event/delivery/webhook and differ only in list-vs-get nuance.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard