A
licenseA
qualityB
maintenanceSupply chain risk scoring for npm, PyPI, and GitHub repos
8
60 npm
9
MIT
Agnes
by dev.agnes
Server Details
Health scores for your team's frontend repos: findings, the fixes worth most points, and SBOMs.
If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
- Status
- Healthy
- Uptime
- 50.0% over the last 24 hours
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
A3.7/5.0
Scored across 6 tools
Disambiguation5/5
Each tool clearly targets a distinct output: raw findings, aggregate report, SBOM, scoring methodology, project list, and prioritized fix ranking. The only mild adjacency is between get_findings and rank_fixes (which includes one example finding), but the descriptions make the boundary clear — one lists findings, the other ranks rules by score impact.
Naming Consistency5/5
Uniform verb_noun snake_case pattern throughout: get_findings, get_report, get_sbom, get_scoring, list_projects, rank_fixes. The verb choice (get/list/rank) is consistent with the noun type rather than arbitrary.
Tool Count5/5
Six tools is well within the ideal range and each earns its place: one for listing, three distinct read views of an analysis (findings, report, SBOM), one explainer, one prioritization view. No filler tools.
Completeness3/5
The surface is read-only with no way to trigger an analysis or look up a single project, and despite references to 'the given run' there is no tool to list or fetch analysis runs. Core consumption workflows are covered, but these are notable gaps for a full lifecycle.
Available Tools
6 toolsget_findingsGet findingsARead-onlyInspect
A project's findings, most severe first, 50 per page, with file, line, message and a documentation link where there is one. Filter by rule, category, severity or file (or folder).
Inputs: project (required), file, page, runId, +3 more.
get_reportGet a reportBRead-onlyInspect
The overall score, the score per category, the findings per category and severity, and which checks did not run, for a project's latest successful analysis.
Inputs: project (required), runId.
get_sbomGet the SBOMARead-onlyInspect
The software bill of materials of a project's latest successful analysis (or the given run) as CycloneDX 1.6 JSON: every installed package with its purl, licence where known and dependencies, and the known vulnerabilities that affect them. Large for big projects; save it to a file rather than reading it all.
Inputs: project (required), runId.
get_scoringHow the score worksARead-onlyInspect
How Agnes turns findings into scores: the categories, their weights in the overall score, and how severity, confidence and codebase size count.
Inputs: no named parameters.
list_projectsList projectsBRead-onlyInspect
The projects of your team: each repository branch Agnes analyses, with its latest score.
Inputs: no named parameters.
rank_fixesRank fixes by score gainARead-onlyInspect
The rules whose findings cost the project the most points. Each entry says how many points the overall score and its category would gain if every finding of that rule were fixed (the report rescored without them), with one example finding.
Inputs: project (required), limit, runId.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Related MCP Connectors
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Software supply chain security: SBOMs, vulnerabilities, fixes, policies and compliance data.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables AI agents and developers to score npm packages, PyPI packages, and GitHub repositories for maintenance health, producing A–F grades, per-signal details, and plain-language risk lists before adoption. It supports checking individual packages, scanning manifests or lock files for transitive dependencies, and comparing alternatives.362 npmApache 2.0
- AlicenseAqualityBmaintenanceScores npm packages, PyPI packages and GitHub repositories 0-100 with an A-F grade and plain-language risks. Scans package.json, requirements.txt and lock files; no API key needed.362 npm1Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables maintainers to prioritize maintenance across GitHub repositories by converting repository, branch, CI, security, and release signals into deterministic, evidence-backed scores and ranked actions.MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd
Glama MCP Gateway
Add one secure layer between your agents and this server.