Skip to main content
Glama
Sign In

pkgxray

by io.github.adamsjack711-ux
OverviewDiscussionsAdmin

Check npm metadata and known vulnerabilities

check_npm_package_metadata
Read-onlyIdempotent

Check registry metadata and OSV advisories for one exact public npm version. Does not inspect package source, verify provenance, install or execute code. An advisory-free result is still REVIEW, not installation approval.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>",
      "version": "<version>"
    },
    "name": "check_npm_package_metadata"
  }
}

Input Schema

NameRequiredDescriptionDefault
nameYesPublic npm package name, such as express or @scope/package. Supply the name only, without a version suffix, registry URL, or local path.
versionYesExact published npm version, such as 4.21.0. Semver prerelease and build suffixes are accepted; tags such as latest and version ranges such as ^4.0.0 are not.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • addedInput schema / properties / name / description
      Added value: +"Public npm package name, such as express or @scope/package. Supply the name only, without a version suffix, registry URL, or local path."
    • addedInput schema / properties / version / description
      Added value: +"Exact published npm version, such as 4.21.0. Semver prerelease and build suffixes are accepted; tags such as latest and version ranges such as ^4.0.0 are not."
  2. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld/idempotent/non-destructive, and the description goes well beyond them: it enumerates what is deliberately out of scope (source, provenance, install, execution) and, crucially, how to interpret a clean result — 'advisory-free is still REVIEW, not installation approval' — which prevents a downstream agent from over-reading the output as a safety verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with zero filler: scope first, exclusions second, interpretation caveat last. Every clause carries information an agent would otherwise have to guess.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, fully documented schema with no output schema, the description covers scope, non-goals, and result interpretation. The only gap is that it never sketches what a result actually contains (metadata fields vs. advisory list), which matters somewhat given there is no output schema to fall back on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already spells out the name format (scoped names, no version suffix/URL/path) and the exact-version rule (prerelease/build allowed, tags and ranges rejected). The description only echoes the 'exact public npm version' constraint, adding the 'public' qualifier but no new syntax or format meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource set ('Check registry metadata and OSV advisories') and pins the scope to 'one exact public npm version', which cleanly separates it from the sibling supply-chain audit tool that operates on agent extensions rather than registry packages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly frames the usage context (metadata plus advisory lookup for a single published version) and gives explicit exclusions — no source inspection, no provenance verification, no install or execution — so an agent knows when this tool is not the right one. It stops short of naming an alternative tool or stating prerequisites, which keeps it below a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All pkgxray toolsInspect
Try in Browser
Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources