Skip to main content
Glama
Ownership verified

Server Details

Search public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.

Status
Unhealthy
Last Tested
Transport
Streamable HTTP
URL
Repository
githits-com/githits-cli
GitHub Stars
76
Server Listing
GitHits

Glama MCP Gateway

Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.

MCP client
Glama
MCP server

Full call logging

Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.

Tool access control

Enable or disable individual tools per connector, so you decide what your agents can and cannot do.

Managed credentials

Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.

Usage analytics

See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.

100% free. Your data is private.
Tool DescriptionsA

Average 4.7/5 across 15 of 15 tools scored.

Server CoherenceA
Disambiguation5/5

Each tool targets a distinct action: code_files lists, code_read reads, code_grep greps, docs_list/docs_read handle docs, pkg_* tools cover distinct package metadata aspects, and search/get_example/search_status are clearly separated by use case. Even the three search-related tools are clearly scoped to different needs.

Naming Consistency2/5

Names are all lowercase snake_case but follow inconsistent patterns: code_read, docs_list are object-first verbs, whereas get_example and search_language are imperative verb-object, and pkg_info or feedback are noun-only. The prefixes (code_, docs_, pkg_, search_) help, but the mix of verb placement and noun-only names makes the set feel less coherent.

Tool Count5/5

15 tools is on the high end but well-scoped for a comprehensive code/package intelligence server. Each tool covers a distinct facet of the domain without redundancy, and the count does not feel padded.

Completeness5/5

The tool surface covers the full lifecycle for the domain: searching, listing, reading files, browsing docs, checking package metadata/deps/vulnerabilities/release notes, and getting examples. There is also feedback and async search follow-up, so no obvious dead ends or missing operations.

Available Tools

15 tools
code_filesAInspect

List files in an indexed dependency. First choice for file/path enumeration tasks such as files under a directory; use path_prefix for directory prefixes (e.g. lib/) and optional extensions for language filtering. Use this to discover paths before code_read (when code_read returns FILE_NOT_FOUND or you don't yet know the path) and to scope code_grep. Address via target.registry + target.package_name (package scope) or target.repo_url + optional target.git_ref (repo scope), mutually exclusive. Narrow with path, path_prefix, globs, extensions, file_types, languages, or file-intent filters. JSON envelope shape: {total, hasMore, files: [{path, name, language, fileType, byteSize}], resolution, indexedVersion}. When fresh data is not ready within the wait window, responses may include targetResolution provenance, indexingEstimate, and immediately-queryable alternatives. availableVersions and availableRefs are already indexed/queryable; suggestedRefs are fuzzy ref hints and may need indexing first. On an INDEXING error envelope, retry with a longer wait_timeout_ms or use a version/ref from details.availableVersions / details.availableRefs.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoExact target-relative file path to include. When combined with `path_prefix` or `globs`, files matching any selector are returned.
globsNoRepeatable glob selectors with real glob semantics (e.g. `src/**/*.ts`). OR-ed with `path` and `path_prefix`.
limitNoMax entries to return (1–1000, default 200). Out-of-range values return an `INVALID_ARGUMENT` envelope.
formatNoResponse format. Default `text-v1` — compact paths-only listing. Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. Errors stay JSON-formatted in either mode for now.text-v1
targetYes
languagesNoLanguage filters to include, matching aigrep language names.
extensionsNoFile extensions to include, without a leading dot.
file_typesNoFile type filters to include, matching aigrep file_type values such as `source` or `doc`.
file_intentNoSingle inclusive file-intent filter. Cannot be combined with `file_intents`. Valid values: production, test, benchmark, example, generated, fixture, build, vendor.
path_prefixNoLiteral directory prefix to filter by (e.g. `src/` or `lib/parser`). NOT a glob. OR-ed with `path` and `globs` when combined.
file_intentsNoInclusive file-intent filters. Cannot be combined with `file_intent`. Valid values: production, test, benchmark, example, generated, fixture, build, vendor.
include_hiddenNo
wait_timeout_msNoMax milliseconds to wait for indexing (0-60000, default 20000). On an `INDEXING` error envelope, use `details.indexingEstimate` when present to decide whether to wait longer, or pass an already-indexed version/ref from `details.availableVersions` / `details.availableRefs`; `suggestedRefs` are fuzzy hints and may need indexing first.
exclude_doc_filesNo
exclude_test_filesNo
exclude_file_intentsNoExclude these file intents after inclusive intent filtering. Valid values: production, test, benchmark, example, generated, fixture, build, vendor.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses response envelope shape, indexing behaviors (e.g., indexingEstimate, availableVersions/Refs, suggestedRefs), and error handling (INDEXING envelope, retry with longer wait_timeout_ms). This goes well beyond the sparse annotations (readOnlyHint=false, etc.) and adds meaningful context without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured: it starts with purpose, then usage, then response/error details. While it repeats some indexing notions near the end, every sentence contributes useful information for a complex tool. A slightly tighter structure would earn a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description correctly specifies the JSON envelope: {total, hasMore, files: [...], resolution, indexedVersion}. It also covers error cases and fallback strategies for indexing delays, making it complete for a tool with 16 parameters and no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is high (75%), so baseline is 3. The description adds value beyond the schema by explaining usage patterns for key parameters: path_prefix for directory prefixes, extensions for language filtering, and wait_timeout_ms for retry decisions. It does not individually describe all params (e.g., limit, format), but the schema already covers those well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb+resource statement: 'List files in an indexed dependency.' It further distinguishes itself from siblings by positioning as the 'first choice for file/path enumeration' and explicitly contrasts with code_read and code_grep ('discover paths before code_read', 'scope code_grep').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance: 'First choice for file/path enumeration tasks', 'Use this to discover paths before code_read... and to scope code_grep.' It also describes addressing modes (target.registry+package_name vs repo_url+git_ref) and filtering options, plus retry behavior on INDEXING errors. This is comprehensive guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

code_grepAInspect

Deterministic text or regex grep over indexed dependency and repository source files. Use this when you know the pattern (literal by default; pass pattern_type: "regex" for RE2). Use search for discovery instead. Whole-target grep is the default — narrow with path, path_prefix, globs, or extensions to keep responses small. Each match's filePath (or text file heading) chains into code_read.path; pick a window around match.line for code_read.start_line / end_line. When fresh data is not ready within the wait window, responses may include targetResolution provenance, indexingEstimate, and immediately-queryable alternatives in error details. availableVersions and availableRefs are already indexed/queryable; suggestedRefs are fuzzy ref hints and may need indexing first.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoExact file path to grep. Shares the same path vocabulary as `code_read`.
globsNoRepeatable glob scopes with real glob semantics (e.g. `src/**/*.ts`).
cursorNo
formatNoResponse format. Default `text-v1` — compact line-oriented output (matches grouped by file with grep -A/-B notation for context). Pass `format: "json"` for the structured envelope. `text` is an alias for `text-v1`. Errors stay JSON-formatted in either mode for now.text-v1
targetYes
patternNoText grep over indexed source files. `literal` (default) does substring matching. `regex` uses RE2 syntax (no lookaround, no backreferences); when scoping the whole target with no path, path_prefix, or glob, the regex must include at least one literal substring the index can use for pre-filtering. Pattern max 200 UTF-8 bytes. Matching is ASCII case-insensitive by default: non-ASCII letters match case-sensitively; pass case_sensitive: true for exact casing. When multiple selectors (`path`, `path_prefix`, `globs`) are combined, they are unioned — a file matches if any selector matches. Use `extensions` to intersect further.
extensionsNoExtensions to include, without a leading dot.
max_matchesNo
path_prefixNoLiteral directory prefix to scope grep, matching `code_files` / `search` naming.
pattern_typeNo
context_linesNo
symbol_fieldsNoHydrate these enclosing-symbol fields on each match; omit for no symbol hydration. Valid values: symbol_ref, name, qualified_path, kind, category, arity, is_public, file_path, start_line, end_line, code, caller_count, content_hash, parent_symbol_ref, parent_path.
case_sensitiveNo
wait_timeout_msNoMax milliseconds to wait for indexing (0-60000, default 20000). On an `INDEXING` error envelope, use `details.indexingEstimate` when present to decide whether to wait longer, or pass an already-indexed version/ref from `details.availableVersions` / `details.availableRefs`; `suggestedRefs` are fuzzy hints and may need indexing first.
exclude_doc_filesNo
exclude_test_filesNo
context_lines_afterNo
context_lines_beforeNo
max_matches_per_fileNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral detail beyond the annotations: deterministic matching, literal default vs. RE2 regex, ASCII case-insensitivity, indexing wait behavior, `targetResolution` provenance, and immediately queryable `availableVersions`/`availableRefs`. It does not contradict any annotation and enriches the agent's understanding of edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and long, but each clause earns its place by covering distinct behavioral or usage aspects. It is front-loaded with the core purpose and differentiation, followed by operational detail. It could be slightly more scannable, but the length is justified by the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 19 parameters, no output schema, and minimal annotations, the description covers a great deal: matching semantics, indexing fallback, error detail shape, and chaining to `code_read`. It does not explicitly address pagination via `cursor` or result limits like `max_matches`, leaving some completeness on the table.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 42%, so the description carries heavy weight. It meaningfully explains the most complex parameters: `pattern` semantics (literal vs. regex, case sensitivity, byte limit), `target` forms, and `wait_timeout_ms` behavior. However, some parameters like `cursor`, `max_matches`, and context-line controls are not covered in the description, leaving minor gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Deterministic text or regex grep over indexed dependency and repository source files' — a specific verb, resource, and scope. It actively distinguishes itself from the sibling `search` tool by saying 'Use `search` for discovery instead,' so there is no ambiguity about its role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance ('Use this when you know the pattern') and an explicit alternative ('Use `search` for discovery instead'). It also provides practical narrowing advice with `path`, `path_prefix`, `globs`, or `extensions`, and explains how to chain results into `code_read`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

code_readAInspect

Read one exact file from an indexed dependency; it does not list directories. Use code_files with path_prefix for file/path enumeration. MCP cap: 150 lines per call — broader requests (or no range) silently truncate to the first 150 lines from your start, with a hint describing what was returned vs. requested. Pick a focused window from a search / code_grep match. Response: {path, language, totalLines, startLine, endLine, content, isBinary, hint?}. Binary files set isBinary: true and omit content. Pass the same path emitted by code_files. Address via target.registry + target.package_name (package scope) or target.repo_url + optional target.git_ref (repo scope), mutually exclusive. When fresh data is not ready within the wait window, responses may include targetResolution provenance, indexingEstimate, and immediately-queryable alternatives. availableVersions and availableRefs are already indexed/queryable; suggestedRefs are fuzzy ref hints and may need indexing first. On INDEXING retry with a longer wait_timeout_ms or use a version/ref from error details. On NOT_FOUND / FILE_NOT_FOUND call code_files to discover the actual path.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesExact file path to read, not a directory. Package addressing: package-relative. Repo addressing: repo-relative. Use `code_files` with `path_prefix` to list directories, then pass an emitted `path` here.
formatNoResponse format. Default `text-v1` — line-numbered source content. Pass `format: "json"` for the structured envelope.text-v1
targetYes
end_lineNoEnding line (inclusive). Must be ≥ `start_line` when both are set. Omitting it implies `start_line + 149` because the MCP surface caps each read at 150 lines.
start_lineNoStarting line (1-indexed). Omit to start at line 1. The MCP surface caps any single read at 150 lines — pick a focused window from your prior `search` / `code_grep` hit.
wait_timeout_msNoMax milliseconds to wait for indexing (0-60000, default 20000). On an `INDEXING` error envelope, use `details.indexingEstimate` when present to decide whether to wait longer, or pass an already-indexed version/ref from `details.availableVersions` / `details.availableRefs`; `suggestedRefs` are fuzzy hints and may need indexing first.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the 150-line cap, silent truncation behavior, the `hint` field, binary file handling, target resolution provenance, indexing waits, and specific error types (`INDEXING`, `NOT_FOUND`). This goes well beyond the sparse annotations, which do not provide any of these behavioral details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured: it starts with purpose, then sibling relationship, then cap/truncation, response format, target scoping, and error handling. Every sentence carries useful information, though it could be tightened by removing a few schema-duplicated explanations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (6 params, no output schema, nuanced indexing behavior), the description is exceptionally complete. It explains the return shape, binary handling, truncation, target resolution, and concrete error-recovery steps, making the tool safe and effective to invoke without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema coverage is high (83%), the description adds critical context: 'Pass the same `path` emitted by `code_files`', mutual exclusivity of target scopes, and how to use `wait_timeout_ms` on `INDEXING` errors with `availableVersions`/`availableRefs`. It enriches the schema descriptions but doesn't fully restate every parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Read one exact file from an indexed dependency' and explicitly states 'it does not list directories', which clearly differentiates it from the sibling `code_files` tool. This is a specific verb+resource+scope statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool vs alternatives: 'Use `code_files` with `path_prefix` for file/path enumeration', 'Pick a focused window from a `search` / `code_grep` match', and 'On `NOT_FOUND` / `FILE_NOT_FOUND` call `code_files` to discover the actual path'. It also covers error-recovery usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docs_listAInspect

List mixed package documentation pages from hosted docs and repository-backed docs. This browses available pages; for topic search, use search with source: "docs" and pass the returned pageId to docs_read. Every entry includes a stable pageId, sourceKind (crawled or repo), and source URL; repo-backed entries also expose repoUrl / gitRef / filePath for exact file reads. Pass a returned pageId to docs_read. Use this to browse before reading a full page.

ParametersJSON Schema
NameRequiredDescriptionDefault
afterNoPagination cursor from a prior response.
limitNoMax pages to return (1-500, default 100).
formatNoResponse format. Default `text-v1` — compact page list with ready-to-call `docs_read` follow-ups. Pass `format: "json"` for the structured envelope.text-v1
versionNoOptional package version.
registryYesPackage registry. One of: npm, pypi, hex, crates, nuget, maven, zig, vcpkg, packagist, rubygems, go, swift.
package_nameYesPackage name (scoped names ok: @types/node).
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral details: entries include a stable pageId, sourceKind (`crawled` or `repo`), source URL, and repo-specific fields. It implies a read-only operation via 'browse,' but does not explicitly state that no writes or side effects occur; annotations mark readOnlyHint=false, but there is no outright contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded and clear, but it repeats the instruction 'Pass a returned pageId to docs_read' twice (once in the search workflow, once at the end), which is redundant. It could be tightened without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately explains return structure and usage flow. It relates to sibling tools (search, docs_read) and covers the key information needed to invoke the tool correctly. Pagination is left to the schema, which is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so parameters are already well-documented. The description adds context about output fields (pageId, sourceKind, etc.) but does not meaningfully enhance parameter understanding beyond the schema, which already covers `format`, `limit`, `after`, etc.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('List') and a precise resource ('mixed package documentation pages'), clearly distinguishing this tool from siblings like docs_read and search. It explicitly positions itself as a browsing tool, avoiding ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: use `search` for topic search, then pass the returned `pageId` to `docs_read`. It also states 'Use this to browse before reading a full page,' making the intended workflow unmistakable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docs_readA
Read-only
Inspect

Read a documentation page by page ID. Works for both hosted/crawled docs and repository-backed docs. Pass start_line / end_line to fetch only a slice when a page is too long — response carries totalLines so you can target the next slice. Repo-backed results additionally include exact file follow-up metadata for code_read.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1` — raw markdown content capped to 150 lines by default. Pass `format: "json"` for the structured envelope; explicit ranges still slice JSON content.text-v1
page_idYesDocumentation page ID from `docs_list` or `search` results. Pass through unchanged; repo-backed IDs are snapshot-pinned.
end_lineNoEnding line (inclusive). Omit for end of page. Must be ≥ `start_line` when both are set.
start_lineNoStarting line (1-indexed). Omit for the full page. Use with `end_line` to bound how much content the tool returns when a page is large.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses behavioral details beyond the annotations: it supports both hosted/crawled and repository-backed docs, includes totalLines in responses for pagination, and has repo-backed metadata for code_read. These are not present in the readOnlyHint/destructiveHint annotations and add useful context for the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences: purpose, usage guidance, and a bonus detail about repo-backed metadata. It is front-loaded and every sentence earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the annotations (read-only, non-destructive) and a fully descriptive schema, the description covers the essential behavioral aspects: purpose, pagination strategy, and repo-backed follow-up. It is complete enough even without an output schema, as it explains totalLines and metadata behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all parameters thoroughly (100% coverage), so the baseline is 3. The description adds value by explaining the start_line/end_line workflow and the role of totalLines in fetching slices, which goes beyond the schema's individual parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Read a documentation page by page ID', which clearly states the tool's function with a specific verb and resource. It also distinguishes from siblings by noting support for both hosted/crawled and repository-backed docs, and mentions follow-up metadata for code_read, which helps differentiate it from code reading tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete usage guidance: how to read a page, when to use start_line/end_line for long pages, and that repo-backed results include metadata for code_read. It implies when to use the tool but doesn't explicitly state exclusions or name alternatives like docs_list for finding page IDs, though the schema does mention docs_list as a source for page_id.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

feedbackAInspect

Use after a GitHits result was helpful, unhelpful, wrong, incomplete, slow, or confusing. Submit feedback on a tool result or the GitHits experience.

Two modes:

  1. Solution-tied — pass the solution_id from a prior get_example response to rate that specific result.

  2. Generic — omit solution_id to send session feedback about any tool (search, code_grep, code_read, code_files, docs_*, pkg_*) or the overall experience.

accepted is always required (true = positive, false = negative). Add feedback_text for context — strongly recommended in generic mode. Pass tool_name when rating a specific tool result. Feeds ranking and product quality.

ParametersJSON Schema
NameRequiredDescriptionDefault
acceptedYesTrue for positive feedback (helpful/good), False for negative (unhelpful/bad). Always required.
tool_nameNoOptional name of the GitHits tool or CLI command that produced the result being rated.
solution_idNoOptional. Pass the `solution_id` from a prior `get_example` response (shown on the trailing line of the markdown result, or under the `solution_id` key in JSON mode) to anchor feedback to that specific result. Omit for generic feedback about any tool (code/package navigation, search, docs) or the overall experience.
feedback_textNoOptional context (e.g., "This solved problem X" or "code_grep regex over npm:lodash missed Foo function"). Strongly recommended when `solution_id` is omitted, since there is no specific result to anchor to.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With all annotations false (readOnlyHint, openWorldHint, destructiveHint), the description carries the burden of behavioral disclosure. It explains that feedback 'feeds ranking and product quality' (an effect) and emphasizes accepted is always required. It does not discuss side effects like data persistence or non-reversibility in detail, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a front-loaded trigger ('Use after...'), clear mode markers, and no filler. Every sentence contributes to understanding the tool. It is appropriately sized for a 4-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a feedback tool: it covers both usage modes, all parameter roles, and the downstream effect on ranking/quality. No output schema exists, but return values are not critical for this simple tool. It fully compensates for the lack of annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds meaningful semantics beyond the schema by explaining the two modes: solution-tied vs. generic, and clarifying that feedback_text is strongly recommended in generic mode. This helps the agent decide how to populate parameters effectively.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Submit feedback on a tool result or the GitHits experience.' It uses a specific verb ('submit') and resource ('feedback'), and the 'Use after a GitHits result was helpful...' trigger contextualizes when it applies. It is easily distinguished from sibling navigation/search tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: use after a GitHits result is helpful/unhelpful/etc. It explicitly explains two modes (solution-tied vs. generic) and when to choose each by passing or omitting solution_id. There are no alternative tools to reference, but it lacks an explicit 'when not to use' exclusion, which would push it to a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_exampleAInspect

Use when the user needs a canonical open-source example, usage pattern, or API snippet that is not tied to one already-known dependency/repository. Best for "how do I use X", cross-project patterns, up-to-date examples, or when package-scoped search was not enough. For inspecting a specific known package or repository, use search, code_*, or docs_* instead.

Default output is markdown, with source repository provenance when available and a trailing solution_id: ... line when available. When presenting an example to a user, report the source repositories/citations from GitHits' generated references/provenance section whenever present; they are core evidence, not optional metadata. Pass format: "json" for {result, solution_id?}. Pass solution_id to feedback after using or rejecting the example. For searching indexed dependency and repository code/docs, use the unified search tool instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesNatural-language example-search query for canonical code examples.
formatNoResponse format. Default `text-v1` returns markdown directly with source repository provenance when available and a trailing `solution_id` line when available. Pass `format: "json"` for `{result, solution_id?}`.text-v1
languageNoOptional programming language. If omitted, GitHits tries to infer it automatically. Use search_language first only when you need to force a specific language and the exact name is uncertain.
license_modeNoLicense filtering mode: strict (default), yolo, or custom.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral traits beyond annotations, including default output format (markdown), source repository provenance, trailing solution_id, the need to report citations to the user, the format: 'json' option, and how to pass solution_id to feedback. Since annotations are minimal (all false), this description fully carries the transparency burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with two paragraphs and front-loaded with usage guidance. However, it has minor redundancy: the instruction to use the unified `search` tool appears twice. Still, every sentence contributes meaningful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, minimal annotations, and lack of output schema, the description is remarkably complete. It covers when to use, output behavior, provenance handling, and integration with `feedback`. It also handles edge cases like when package-scoped search is insufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds extra value by explaining the default `format` behavior, the JSON output structure, language inference, and when to use `search_language` to force a language. This goes beyond simply restating the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: fetching canonical open-source examples, usage patterns, or API snippets. It uses a specific verb (needs, get) and resource, and explicitly distinguishes from sibling tools by saying to use `search`, `code_*`, or `docs_*` for known repositories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: 'Use when...', 'Best for...', and when not to use (e.g., when package-scoped search was not enough, or for specific known repositories). It names alternative tools, making the decision process clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkg_changelogA
Read-only
Inspect

Use when the user asks what changed in a package, wants release notes, or needs changelog evidence for a manual upgrade review. Release notes for a package or GitHub repo, newest-first. Default latest mode returns the ten most recent entries (limit 1–50). With from_version, returns every entry in the [from_version, to_version] range (range mode, no count cap). Address via registry + package_name or repo_url (mutually exclusive). Response includes optional source ("releases" / "changelog_file" / "hexdocs") when a concrete changelog source exists, mode ("latest" or "range"), and entries with markdown body previews. Example: {"registry":"npm","package_name":"express","limit":2}. Text output previews 10 body lines by default; use body_lines to tune the preview or verbose:true for full text bodies. Set omit_bodies: true for a version / date / URL timeline only; pass format: "json" for the complete structured envelope. Package-version entries without changelog text succeed with source omitted; no-source plus no entries returns NOT_FOUND. Supports npm, PyPI, Hex, Crates, NuGet, Maven, Zig, vcpkg, Packagist, RubyGems, Go, and Swift.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoLatest-mode cap on entry count (1–50, default 10). Rejected with `INVALID_ARGUMENT` when `from_version` is also set or when out of range.
formatNoResponse format. Default `text-v1` — compact entry timeline with body previews. Pass `format: "json"` for the structured envelope with full markdown bodies.text-v1
git_refNoGit branch or tag for CHANGELOG.md source (no effect on GitHub Releases or HexDocs). Defaults to the repository's default branch.
verboseNoText output only. Show full body previews. Mutually exclusive with omit_bodies:true and body_lines.
registryNoPackage registry (with `package_name`). Mutually exclusive with `repo_url`. Supported: npm, pypi, hex, crates, nuget, maven, zig, vcpkg, packagist, rubygems, go, swift.
repo_urlNoGitHub repository URL (https://…). Mutually exclusive with `registry` + `package_name`. Use when agents have a repo URL without a registry mapping.
body_linesNoText output only. Number of body lines to preview per entry (1-50, default 10). Ignored for format=json and omit_bodies:true. Mutually exclusive with verbose:true.
to_versionNoEnd of range / latest-mode cap. Works in either mode. Defaults to latest on the wire. Tag-style `v`-prefixed inputs are rejected except for Swift.
omit_bodiesNoWhen true, each entry in `entries.items[]` omits its `body` field. Default false. Use when you only need the version / date / URL timeline — drops 10 KB+ per entry on large release notes.
from_versionNoStart of version range. When set, the response returns every entry between `from_version` and `to_version` (or latest) with no count cap — range mode. Mutually exclusive with `limit`. Tag-style `v`-prefixed inputs are rejected except for Swift.
package_nameNoPackage name (with `registry`). Scoped names ok (`@types/node`). Mutually exclusive with `repo_url`.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description discloses many behavioral traits: two modes (latest/range), default limit of 10, mutual exclusivity rules, error behavior (NOT_FOUND), response structure (source, mode, entries), output formatting options (body_lines, verbose, omit_bodies, format), and supported registries. This is rich behavioral context above what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence serves a purpose, with a clear front-loaded 'Use when' directive followed by mode, addressing, output, and error details. It is well-structured and avoids redundancy, balancing density with completeness for a complex 11-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description fully explains return values and edge cases: source omission, NOT_FOUND, output previews, and formats. It also covers the full range of supported registries and the distinction between addressing modes. This makes the tool self-contained and complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by explaining how parameters interact (e.g., from_version triggers range mode, mutual exclusivity), the meaning of modes, and gives a concrete example. However, many individual parameter details are already in the schema, so the description augments rather than fully compensates; a 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Release notes for a package or GitHub repo, newest-first' and gives explicit usage triggers: 'when the user asks what changed in a package, wants release notes, or needs changelog evidence for a manual upgrade review.' This differentiates it from siblings like pkg_info or pkg_deps by focusing on changelog/release notes specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit 'Use when' scenarios, including mentions of manual upgrade review, which helps an agent decide when to invoke it. However, it does not explicitly name sibling tools as alternatives or state when not to use this tool, so it falls short of the 'explicit when-not/alternatives' bar for a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkg_depsA
Read-only
Inspect

Use when the user asks what a package depends on, wants dependency groups, or needs a bounded transitive dependency footprint. Analyze a package's dependency graph. Lists direct runtime dependencies with resolved versions; non-runtime groups are omitted by default. Use lifecycle with a concrete value for matching dependency groups, or all for every available group. Runtime group rows include resolved versions when available. Pass max_depth to add a transitive block with the capped install footprint, conflict detection, and circular-dependency flags; layer include_importers: true on top when you also need per-package provenance. Supports npm, PyPI, Hex, Crates, Zig, vcpkg, RubyGems, Go, and Swift.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1` — compact dependency listing. Pass `format: "json"` for the structured envelope.text-v1
versionNoSpecific version to inspect. Defaults to latest when omitted. Tag-style inputs with a leading `v` (for example `v4.18.0`) are rejected except for Swift — pass the canonical version (`4.18.0`) for other registries.
registryYesPackage registry. Dependency data is available on npm, pypi, hex, crates, zig, vcpkg, rubygems, go, swift.
lifecycleNoLifecycle breadth. Omit for runtime-only. Use `runtime` for explicit runtime-only, a concrete non-runtime lifecycle (`development`, `build`, `peer`, `optional`) for runtime plus matching groups, or `all` for runtime plus all available groups. Accepts a single value, a comma-separated string, or an array; `all` cannot be combined with other values. Uppercase is tolerated.
max_depthNoAdd a `transitive` block and cap traversal at this depth (1-10). Omit for direct dependencies only.
package_nameYesPackage name (scoped names ok: @types/node).
include_importersNoWhen true, each entry in `transitive.packages[]` also carries an `importers` array — every upstream package that pulls it in, with that importer's own resolved version and the constraint it declared. Off by default because adding provenance roughly quadruples the envelope size on heavy graphs. If `max_depth` is omitted, this also requests the full transitive block.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint, the description explains default runtime-only behavior, the transitive block with conflict detection and circular-dependency flags, and the performance trade-off of include_importers (quadrupling envelope size). This gives the agent useful operational context not conveyed by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense yet efficient: it leads with use cases, explains default behavior, parameter interplay, and supported registries in about four sentences. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no output schema, the description covers return behavior (direct runtime deps, transitive block, importers), parameter effects, and performance implications, leaving little ambiguity about what the agent will receive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, but the description adds cross-parameter guidance: how lifecycle accepts concrete values or 'all,' that max_depth introduces conflict detection, and how include_importers layers provenance on top. This elevates the parameter semantics above the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with explicit use cases ('what a package depends on, dependency groups, bounded transitive dependency footprint') and states the core action 'Analyze a package's dependency graph.' This clearly distinguishes it from sibling tools like pkg_info or pkg_vulns, which cover other aspects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance in the opening sentence ('Use when...'), which covers the primary intents. It doesn't name alternative tools for exclusions, but the context is clear enough for deciding to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkg_infoA
Read-only
Inspect

Use for a quick latest-version package adoption or health check: license, description, repository health, downloads, publish age, and latest vulnerability status. Latest-version package overview for dependency triage. Provide registry and package_name (for example npm + express). Default text returns license, description, repository popularity (stars/forks/issues and [ARCHIVED] when applicable), downloads, publish age, and vulnerability status. Set verbose: true for GitHub language/topics/last-pushed, recent advisories, and recent changes. Pass format: "json" for structured fields. Use pkg_vulns for version-specific vulnerability details.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1` — compact package overview. Pass `format: "json"` for the structured envelope.text-v1
verboseNoText only. Adds GitHub language/topics/last-pushed, recent advisories, and recent changes. Ignored for format=json.
registryYesPackage registry. One of: npm, pypi, hex, crates, nuget, maven, zig, vcpkg, packagist, rubygems, go, swift.
package_nameYesPackage name (scoped names ok: @types/node).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are readOnlyHint=true and destructiveHint=false; description does not contradict them. It goes beyond annotations by detailing default output fields (license, description, repo popularity, downloads, publish age, vulnerability status), verbose additions (GitHub language/topics/last-pushed, advisories, changes), and format=json behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is dense but well-organized: purpose, usage, default output, verbose option, format option, sibling pointer. Minor repetition of 'latest-version' but no fluff. Appropriate length for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description must explain return values; it does by enumerating default text fields, verbose additions, and json structured mode. It also directs to pkg_vulns for version-specific details, covering edge cases and making the description complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so baseline is 3. Description adds value with a concrete example ('npm' + 'express'), clarifies that verbose is 'Text only' and ignored for json, and explains that format=json gives a structured envelope. This exceeds schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Use for a quick latest-version package adoption or health check', clearly specifying verb and resource. It distinguishes from sibling pkg_vulns by explicitly stating 'Use pkg_vulns for version-specific vulnerability details.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description gives explicit usage context ('dependency triage') and clear when-to-use guidance. It names the alternative tool pkg_vulns for version-specific vulnerability details, and provides the required inputs (registry, package_name) with an example.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkg_upgrade_reviewA
Read-only
Inspect

Use when the user asks whether to accept, assess, review, or investigate a dependency update from one version to another. Report package-upgrade evidence by comparing current and target versions with direct vulnerability checks, changelog range evidence, target deprecation metadata, peer dependency changes, and optional transitive evidence diffs. The tool reports facts only and does not assign risk or decide whether to accept an upgrade. Use this instead of inferring acceptability from semver, including patch bumps. Accepts either one package via registry/package_name/current_version/target_version or batch packages[]. Batch execution is capped internally to avoid flooding the package-intelligence backend.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1`; pass `json` for structured output.text-v1
verboseNoText output only. Include dependency change examples, including transitive version changes.
packagesNoBatch mode. Mutually exclusive with single-package fields.
registryNoPackage registry for single-package mode. Supported: npm, pypi, hex, crates, nuget, maven, zig, vcpkg, packagist, rubygems, go, swift.
min_severityNoMinimum direct-advisory severity: low, medium, high, or critical.
package_nameNoPackage name for single-package mode.
target_versionNoTarget version for single-package mode. Tag-style v-prefixes are rejected except for Swift.
current_versionNoCurrently used version for single-package mode. Tag-style v-prefixes are rejected except for Swift.
skip_transitive_securityNoWhen true, skip current-vs-target transitive vulnerability summary diffs. Defaults false, so transitive security evidence is included unless explicitly skipped.
include_dependency_issuesNoWhen true, diff current vs target transitive deprecated/outdated/duplicate/conflict summaries. Defaults false.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description states 'The tool reports facts only and does not assign risk or decide whether to accept an upgrade' and discloses internal batch execution caps. These are meaningful behavioral traits not visible in structured metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: usage trigger, evidence categories, fact-only limitation, and mode/semver guidance. Front-loaded with the most important selection information, no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 10 parameters and no output schema, the description covers what to expect from results (facts only, evidence categories), how to invoke single vs batch, internal limitations, and exclusions. It is sufficiently complete for an agent to select and call the tool appropriately.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description mentions single vs batch mode and optional transitive evidence, but these are largely already in the schema (e.g., packages[] description says 'Mutually exclusive with single-package fields'). It does not add per-parameter meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with an explicit purpose: 'Use when the user asks whether to accept, assess, review, or investigate a dependency update from one version to another.' It names specific evidence categories (vulnerability checks, changelog range, deprecation metadata, peer dependency changes, transitive diffs), clearly distinguishing this tool from siblings like pkg_vulns or pkg_changelog.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('Use when the user asks whether to accept, assess, review, or investigate a dependency update') and a clear exclusion ('Use this instead of inferring acceptability from semver, including patch bumps'). This helps the agent select the tool over less precise reasoning paths.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkg_vulnsA
Read-only
Inspect

Use when the user asks whether a package or pinned version has known vulnerabilities, advisories, CVEs, malware, affected ranges, or fix versions. Check known vulnerabilities for a package on npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, or Swift (vcpkg and Zig are not supported for vulnerability data). Returns a count summary, each advisory with OSV ID, severity, affected ranges, and fix versions. Malicious-package advisories surface in a separate bucket. Example: {"registry":"npm","package_name":"lodash","version":"4.17.20","min_severity":"high"}. Pass version to inspect a pinned release; omit it for latest. Default text is capped for readability; use verbose:true for all selected advisory rows or format:"json" for the complete envelope. Use min_severity to filter to a threshold (low, medium, high, critical) and include_withdrawn to also see retracted advisories. Use advisory_scope:"non_affecting" to list historical advisories that do not affect the inspected version, or advisory_scope:"all" to list affected and historical advisories together.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1` — compact advisory summary. Pass `format: "json"` for the structured envelope.text-v1
verboseNoText output only. Show every advisory and full detail rows; format=json always returns the complete structured envelope.
versionNoSpecific version to check. Defaults to latest when omitted. Tag-style `v`-prefixed inputs are rejected except for Swift.
registryYesPackage registry. Vulnerability data is available for npm, pypi, hex, crates, nuget, maven, packagist, rubygems, go, and swift; unavailable for vcpkg and zig.
min_severityNoOnly return advisories at or above this severity (`low`, `medium`, `high`, `critical`; uppercase tolerated). Omit to see all, including null-severity advisories.
package_nameYesPackage name (scoped names ok: @types/node).
advisory_scopeNoAdvisory rows to return: `affected` (default), `non_affecting` for historical advisories that do not affect the inspected version, or `all` for both affected and historical advisories. Counts always include affected/non-affecting/all totals.
include_withdrawnNoInclude retracted advisories (default: false).
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, destructiveHint=false, openWorldHint=false, and the description adds rich behavioral context beyond that: it describes the return payload (count summary, per-advisory OSV ID, severity, affected ranges, fix versions), the separate malicious-package bucket, default text caps, and the effects of `verbose` and `format`. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph, but every sentence earns its place: trigger, example, parameter explanations, and edge cases (unsupported registries, withdrawn advisories). It could benefit from bullet points or headings for scannability, but it remains efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of explaining return values, and it does: count summary, advisory fields, malicious-package separation, and format/verbosity options. All 8 parameters are mentioned, along with limitations and example usage, making the tool fully understandable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description enhances every parameter with usage semantics: `version` for pinned vs latest, `min_severity` as a threshold with severity order, `advisory_scope` values and their effect, and `format` with default behavior. The example demonstrates correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear trigger: 'Use when the user asks whether a package or pinned version has known vulnerabilities, advisories, CVEs, malware, affected ranges, or fix versions.' This specifies the verb (check) and resource (package vulnerabilities) and explicitly distinguishes it from sibling tools like pkg_info or pkg_deps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a 'Use when' statement plus a concrete JSON example, explains when to pass `version` (pinned) vs omit it (latest), and notes unsupported registries (vcpkg and Zig). It also explains how to use `min_severity`, `include_withdrawn`, and `advisory_scope`, giving unambiguous usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_languageA
Read-only
Inspect

Use before get_example only when you need to force a language and are unsure of GitHits' exact language name. Finds supported language names and aliases; returns up to 5 matches. Default output is one language per line; pass format: "json" for the structured array.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesLanguage name or partial name to search for (e.g., "python", "type", "java")
formatNoResponse format. Default `text-v1` returns one language per line. Pass `format: "json"` for the structured array.text-v1
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context: returns up to 5 matches, default output format, and the effect of passing format:json. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—two sentences that front-load the key usage guidance and include the essential behavior and format options. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple lookup tool with two parameters, complete annotations, and a full schema, the description covers purpose, usage time, return limits, and output format. No output schema exists, but the description sufficiently explains what to expect. It is complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so a baseline of 3 applies. The description adds extra non-schema semantics, such as 'returns up to 5 matches' and clarifies the default and alternative output formats. It also reinforces that the query is a language name or partial name, which is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to find supported language names and aliases. It uses a specific verb ('finds') and resource ('language names and aliases'), and distinguishes itself from siblings by explicitly tying its use to `get_example` and language forcing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: 'Use before get_example only when you need to force a language and are unsure of GitHits' exact language name.' This includes a clear when-to-use and a restrictive 'only' that implies exclusions. It also explains the output format options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_statusA
Read-only
Inspect

Use only after search returns a searchRef. Check progress, fetch partial hits (when the original request used allow_partial_results: true), or fetch final results for a prior search that returned a searchRef. Pass the searchRef from that response as search_ref here (response field is camelCase; this parameter is snake_case).

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoResponse format. Default `text-v1` — compact line-oriented output matching `search`. Pass `format: "json"` for the structured envelope.text-v1
search_refYesThe `searchRef` field from a prior `search` response (camelCase in the response, snake_case as this parameter). Pass it through unchanged.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and destructiveHint, covering safety. The description adds behavioral context: it is a follow-up polling/retrieval operation, it can return partial hits only when `allow_partial_results: true` was set, and it consumes a `searchRef`. It also highlights the camelCase/snake_case naming mismatch, which is useful. However, it does not describe error conditions or the response envelope, though format options are in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, front-loaded with the critical precondition ('Use only after...'), and every sentence earns its place. It covers when, why, and the key parameter mapping without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 2 well-documented parameters and no output schema, the description provides sufficient context: it explains the prerequisite (prior `search` returns `searchRef`), the three usage modes, and the parameter naming convention. It could mention response shape or termination behavior, but the format parameter already hints at it. Overall, it is complete enough for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds little beyond the schema: it reiterates that `search_ref` comes from a prior `search` response and passes through unchanged. The camelCase/snake_case note is already in the schema description, so the description does not significantly elevate parameter understanding. The `format` parameter is fully described in the schema with enums and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to check progress, fetch partial hits, and retrieve final results for a prior `search` that returned a `searchRef`. It uses specific verbs (check, fetch) and identifies the resource (search results), distinguishing it from the `search` sibling tool which initiates the search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'Use only after `search` returns a `searchRef`'. It enumerates three concrete scenarios (progress check, partial hits, final results) and implicitly excludes using it before a search or for new searches. This provides clear guidance against misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Servers

View all MCP Servers

Try in Browser

Your Connectors

Sign in to create a connector for this server.