Skip to main content
Glama

LiveDataLink

by io.github.blackboxfoundry

cve_search_by_vendor

Read-onlyIdempotent

Search CVEs by vendor with optional product and date range filters. Vendor is matched against the NVD CPE namespace, e.g. 'apache', 'microsoft'.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMax results to return (1-2000, default 20).
vendorYesVendor name, lowercase preferred.
productNoOptional product name filter.
pub_end_dateNoISO date or YYYY-MM-DD upper bound on published date.
pub_start_dateNoISO date or YYYY-MM-DD lower bound on published date.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool read-only, idempotent, and non-destructive. The description adds useful behavioral context by explaining that vendor values are matched against the NVD CPE namespace, which is non-obvious and important for correct invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with the primary action and key matching behavior front-loaded. There is no filler or redundant repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, read-only lookup with one required parameter and fully documented schema, the description is largely sufficient. It could explicitly mention the return shape, but since no output schema is required and the tool name implies CVE results, it does not create a significant gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds a clarifying example and CPE namespace interpretation for vendor, but does not meaningfully deepen understanding of the other parameters beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search CVEs by vendor') and adds the NVD CPE namespace matching detail with examples. This clearly distinguishes it from sibling tools like cve_search_by_keyword and cve_recent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use case is implied by 'Search CVEs by vendor with optional product and date range filters,' but there is no explicit when-to-use versus alternatives guidance. An agent must infer the appropriate choice from the tool name and sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All LiveDataLink toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

B3.2/5.0
Disambiguation2/5

Many tools overlap heavily across domains: caselaw_search vs court_case_search vs court_opinion_search, caselaw_citation_lookup vs court_citation_resolver, and a cluster of company due-diligence tools (company_trust_check, counterparty_risk_score, entity_dossier, issuer_diligence_dossier, kyb_aml_evidence_case_file) that all screen a company for sanctions/risk/standing. With 290 tools, an agent will frequently face multiple equally plausible choices for the same user intent.

Naming Consistency3/5

The vast majority of tools follow a clean domain-prefix + snake_case pattern (census_, eia_, fmcsa_, npi_, cfpb_, etc.), but there are notable exceptions: entity_resolve and resolve_entity are reversed duplicates, reg_search (Federal Register) sits next to reg_cfr_search (CFR) with confusingly similar names, and carrier_monitor_recheck deviates from the carrier_vetting_* family.

Tool Count1/5

290 tools is an extreme count under any rubric, far exceeding even the 50+ threshold for the lowest score. While the group-filtering mechanism and meta-tools like list_tool_groups and search_available_datasets mitigate the practical burden, the raw surface is still massively oversized for an agent to select from accurately and efficiently.

Completeness4/5

For a read-only data-aggregation server, coverage is remarkably comprehensive across 59 domains, and generic fallbacks like cdc_dataset_query, eia_series_lookup, fred_observations, and bls_series prevent most dead ends. Minor gaps exist (a single GitHub tool, demo-only property_lookup coverage, no write/update operations anywhere), but the stated data-access purpose is well served.

Resources