Skip to main content
Glama

dependency-trust

Get Dependencies

get_dependencies
Read-onlyIdempotent

Get the resolved dependency graph for one package version.

Returns the full resolved dependency graph (direct and indirect) for a version — each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
systemYesPackage ecosystem.
packageYesPackage name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'.
versionYesExact version string, e.g. '18.2.0'.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds meaningful behavioral detail beyond these hints by explaining the returned graph's structure: each node carries the exact dependency version and a SELF/DIRECT/INDIRECT relation. This is valuable given there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and every clause adds value. It efficiently communicates scope, output structure, and intended use without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderately complex read-only tool with complete parameter schemas and safety annotations, the description fully compensates for the absence of an output schema by describing the returned graph nodes and relation types. It also gives an explicit use case, making the tool self-contained enough for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are already well documented (ecosystem enum, package name conventions, exact version format). The description reinforces that a single version is queried but adds no new parameter-specific semantics beyond the schema, matching the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'gets the resolved dependency graph for one package version' and explicitly notes it covers direct and indirect dependencies. This resource-level specificity uniquely distinguishes it from siblings like get_package or get_project_health, which target other data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: 'Use it to reason about transitive dependencies and supply chain.' It does not explicitly name alternative tools or when not to use it, but the use-case guidance is sufficient for a focused read-only query tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool targets a clearly distinct concern: package version listing, single-version metadata, dependency graph, advisory details, and project health. The descriptions explicitly link the tools together without making their responsibilities overlap.

Naming Consistency5/5

All five tool names follow a consistent get_ noun pattern, making the API predictable and easy to reason about. The noun choices are also specific and readable.

Tool Count5/5

Five tools is a well-scoped size for this security-focused dependency server. Each tool addresses a meaningful part of the trust assessment workflow without redundancy.

Completeness5/5

The tool set covers the essential workflow: discover versions, inspect a specific version's metadata and advisories, drill into advisory details, examine the dependency graph, and evaluate project health. The read-only trust model does not require create, update, or delete operations.

Resources