Skip to main content
Glama

dependency-trust

Get Package

get_package
Read-onlyIdempotent

List every version of a package and whether each is deprecated.

Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
systemYesPackage ecosystem.
packageYesPackage name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, and idempotentHint true, covering the safety profile. The description adds valuable behavioral detail beyond those hints by stating the tool returns all published versions with publish date, the default-version flag, and deprecation status. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the primary action. There is minor redundancy between 'List every version...' and 'Returns all published versions...', but the second sentence adds necessary field details. Overall, every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with two well-documented parameters and strong annotations, the description adequately covers the output contents and use cases. It lacks only explicit sibling alternatives or pagination/error details, which are not essential given the tool's simplicity and the absence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — 'system' is described as 'Package ecosystem' and 'package' includes encoding and scoped-name guidance. The tool description does not add parameter-level semantics beyond the schema, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('List') and identifies the exact resource: every version of a package, including deprecation status. It further specifies the returned fields (publish date, default-version flag, deprecation status), clearly distinguishing it from the sibling tool get_package_version, which targets a single version. This is a precise, non-tautological purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: 'find the latest version or check if a package is deprecated' and advises coding agents to call it before recommending a package or version. This is clear context but does not name alternatives or explicitly state when not to use it, so it lacks the full exclusionary guidance of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool targets a clearly distinct concern: package version listing, single-version metadata, dependency graph, advisory details, and project health. The descriptions explicitly link the tools together without making their responsibilities overlap.

Naming Consistency5/5

All five tool names follow a consistent get_ noun pattern, making the API predictable and easy to reason about. The noun choices are also specific and readable.

Tool Count5/5

Five tools is a well-scoped size for this security-focused dependency server. Each tool addresses a meaningful part of the trust assessment workflow without redundancy.

Completeness5/5

The tool set covers the essential workflow: discover versions, inspect a specific version's metadata and advisories, drill into advisory details, examine the dependency graph, and evaluate project health. The read-only trust model does not require create, update, or delete operations.

Resources