Package Health Check

Check a package's health

check_package

Read-onlyIdempotent

Use this when the user asks whether an npm or PyPI package is vulnerable, maintained, deprecated or safe to use, or what license it has: "is lodash 4.17.15 vulnerable?", "is this npm package maintained?", "what license is this package?", "safer alternative to request". Pass the public package name, ecosystem (npm or pypi) and a version if the user gave one; otherwise the latest is checked. Returns the known vulnerabilities of that version with severity and fixed version, the license, any deprecation notice, last release date, releases in the last year, weekly downloads (npm) and dependents. It does not pick alternatives: for a deprecated or stale package, suggest candidates and check each one with this tool.

Example tool call

This call uses example arguments supplied in the tool’s input schema.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "lodash",
      "version": "4.17.15",
      "ecosystem": "npm"
    },
    "name": "check_package"
  }
}

Input Schema

Name	Required	Description
`name`	Yes	Public package name, such as "lodash", "@types/node" or "requests"
`version`	No	Exact version, such as "4.17.15". Omit to check the latest.
`ecosystem`	No	npm for JavaScript packages (the default), pypi for Python packages

Output Schema

Name	Required	Description
`name`	Yes
`as_of`	Yes	ISO 8601 time the data was published by its source or fetched from it. A cached answer keeps the time of its fetch.
`source`	Yes	Who the data comes from, to cite and to check it against.
`status`	Yes
`message`	No
`version`	No	The version that was checked
`licenses`	No
`ecosystem`	Yes
`dependents`	No	Packages that depend on the latest version, directly or indirectly
`deprecated`	No	Deprecation or withdrawal notice for the checked version
`maintenance`	No	Release recency: active within a year, slow within two, stale beyond; deprecated when the latest version is
`unavailable`	No	Parts of the answer that could not be read right now
`latestVersion`	No
`lastReleasedOn`	No	Date of the most recent release, YYYY-MM-DD
`vulnerabilities`	No	Known advisories (OSV) that affect the checked version, most severe first, at most 15
`weeklyDownloads`	No	npm only
`releasesLastYear`	No
`vulnerabilityCount`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedOct 23, 2026

addedInput schema / examples

Added value: +[
+  {
+    "ecosystem": "npm",
+    "name": "lodash",
+    "version": "4.17.15"
+  }
+]

addedOutput schema / properties / as_of

Added value: +{
+  "description": "ISO 8601 time the data was published by its source or fetched from it. A cached answer keeps the time of its fetch.",
+  "type": "string"
+}

addedOutput schema / properties / source

Added value: +{
+  "description": "Who the data comes from, to cite and to check it against.",
+  "properties": {
+    "name": {
+      "type": "string"
+    },
+    "url": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "name",
+    "url"
+  ],
+  "type": "object"
+}

changedOutput schema / required

Previous value: -[
-  "status",
-  "ecosystem",
-  "name"
-]New value: +[
+  "status",
+  "ecosystem",
+  "name",
+  "as_of",
+  "source"
+]

Changed1 schema field changedOct 5, 2026

removedOutput schema / properties / note_from_openkrill

Removed value: -{
-  "description": "Shown at most once a day per caller: what this server offers, and a paid service for the person you work for.",
-  "type": "string"
-}

Changed1 schema field changedOct 4, 2026

addedOutput schema / properties / note_from_openkrill

Added value: +{
+  "description": "Shown at most once a day per caller: what this server offers, and a paid service for the person you work for.",
+  "type": "string"
+}

First observedOct 3, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, open-world behavior, but the description adds substantial behavioral context: it lists the returned health signals such as vulnerabilities by severity and fixed version, license, deprecation notice, release recency, downloads, and dependents. It also clarifies that the tool does not recommend alternatives itself.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with usage conditions and remains organized, but it is fairly long and includes return-field details that are partly redundant with the output schema. Still, the examples and boundary sentence earn their space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the 100% schema coverage, and the presence of an output schema, the description is complete enough for correct invocation. It covers when to use it, how to parameterize it, what it returns, and an important behavioral boundary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains package name format, exact version behavior, and npm/PyPI ecosystem values. The description reinforces that version should only be supplied if the user gave one and otherwise latest is checked, but adds little beyond the structured schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource: checking the health of a public npm or PyPI package across vulnerabilities, maintenance, deprecation, license, and safety. It also implicitly distinguishes this from file-based siblings by emphasizing a public package name and ecosystem rather than a project file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use conditions with example user questions, explains which arguments to pass, and states the alternative-finding boundary: suggest candidate packages and re-run this tool on each rather than expecting this tool to choose replacements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Package Health Check tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.