DataNexus MCP

security_audit_licence_compatibility

Read-onlyIdempotent

Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path. Package path resolves licences from deps.dev (max 10 concurrent). Max 50 items. Rate limit: 60/minute. No auth required. For developers and compliance teams auditing open source licence risk before shipping. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_licence_compatibility", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Input Schema

TableJSON Schema

Name	Required	Description	Default
`packages`	No	List of {name, ecosystem} dicts to check compatibility. Optional.
`spdx_ids`	No	List of SPDX licence identifiers to check compatibility. Optional.

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds substantial behavioral context: no network call for spdx_ids path, deps.dev resolution with max 10 concurrent, max 50 items, rate limit, and no auth. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: purpose first, then behavior details, constraints, target users, and fallback. It is slightly lengthy but every sentence adds value. Minor redundancy in stating 'max 10 concurrent' and 'max 50 items' could be merged, but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (two input modes, external dependencies, rate limits), the description covers all essential aspects: purpose, behavior, constraints, output type, and intended audience. It also provides a feedback fallback. The existence of an output schema means return details are not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with parameter descriptions. The description enhances understanding by explaining the two input paths: packages (with ecosystem) for dynamic resolution, and spdx_ids for static lookup. It clarifies that packages require deps.dev calls while spdx_ids do not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: auditing licence compatibility of dependency lists. It specifies input types (package names or SPDX IDs) and output (COMPATIBLE/CONFLICT verdict). It also distinguishes from siblings by mentioning the static SPDX table and deps.dev resolution, which are unique.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context: intended for developers and compliance teams, max 50 items, rate limit 60/min, no auth. It also suggests fallback to report_feedback if needed. However, it does not explicitly contrast with other license tools like security_fetch_licence_analysis, but the niche is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All DataNexus MCP tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0

Disambiguation4/5

Tools are grouped into clear domain prefixes (compliance, domain, frontend_security, etc.) with distinct purposes. Minor overlap exists between frontend_security_detect_typosquatting and security_detect_typosquatting, but descriptions clarify the different scope.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern with snake_case. Irregularities like 'fetch' vs 'audit' and two 'detect_typosquatting' tools exist, but overall naming is predictable within domains.

Tool Count3/5

55 tools is high for a single server given the breadth of domains. Some redundancy (e.g., two typosquatting tools) suggests possible trimming, but the count is justified by the wide coverage.

Completeness4/5

The tool surface covers key operations across domains like compliance, domain, security, legal, and nonprofit. Minor gaps exist, such as limited frontend audit beyond package.json and no general-purpose code scanning.

Resources

Need Help?