Signal Oracle

PackageHealth — free preview

packagehealth_preview

Read-only

FREE preview of a dependency's health: current version, deprecation flag, OpenSSF Scorecard, SPDX license, and known-advisory count (via deps.dev). The full ship/avoid verdict — per-advisory CISA-KEV active-exploit cross-reference, license-fit judgement, and LLM recommendation — is the paid /v1/packagehealth/check.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`package`	Yes	Package name, e.g. 'lodash' or 'django'
`ecosystem`	No	npm \| pypi \| go \| maven \| cargo \| nuget (default npm)

Output Schema

TableJSON Schema

Name	Required	Description	Default
`hint`	No
`tier`	No
`error`	No
`stars`	No
`license`	No
`package`	No
`upgrade`	No
`version`	No
`ecosystem`	No
`scorecard`	No
`deprecated`	No
`knownAdvisories`	No

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and openWorldHint. The description adds behavioral context by specifying the data fields included in the free preview and what is reserved for the paid version. It aligns with the read-only nature and does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the core purpose, and avoids unnecessary details. Every sentence adds value, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, output scope (free vs paid), and key data points. Given the presence of an output schema and sibling tools with distinct domains, the description adequately informs an agent. Minor missing context (e.g., error handling) is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with clear descriptions for both parameters (package and ecosystem). The tool description does not add new information about the parameters beyond what is in the schema, so it meets the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides a free preview of a dependency's health, listing specific data points (current version, deprecation flag, OpenSSF Scorecard, etc.). It distinguishes itself from the paid version and sibling tools are in different domains (depwatch, list_feeds, etc.), so there is no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions it is a free preview and contrasts with the paid full verdict, but does not explicitly state when to use this tool versus sibling tools. The context implies it is for quick health checks, but no direct guidance on alternatives is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Signal Oracle tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0

Disambiguation4/5

Most tools target distinct areas (dependency changes, package health, regulatory actions, tariffs, vendor risk), but `preview_feed` is a generic preview that can overlap with the specific preview tools (e.g., `depwatch_preview`), potentially confusing an agent's tool selection.

Naming Consistency3/5

Tool names follow a mix of patterns: most use the suffix `_preview` (e.g., `depwatch_preview`, `regwatch_preview`), but `list_feeds` uses a verb prefix. Additionally, `depwatch` and `tariffwatch` use 'watch' while `packagehealth` does not, introducing inconsistency.

Tool Count5/5

Seven tools is an appropriate number for a monitoring service covering multiple categories (dependencies, health, regulatory, tariffs, vendor risk) without being overwhelming or insufficient.

Completeness2/5

The free tool set only provides previews (up to 5 items) and a listing of feeds, lacking full functionality for detailed queries, history, or actionable results. Users hit a dead end if they need complete data, which is a significant gap.

Resources

Need Help?