Skip to main content
Glama

Osv List Ecosystems

osv_list_ecosystems
Read-onlyIdempotent

Return the list of supported ecosystem identifier strings for use with osv_query_package and osv_query_batch. Ecosystem strings are case-sensitive exact matches — passing "pypi" instead of "PyPI" returns an error from the API. Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format. The list is static (maintained from the OSV schema spec) and may occasionally lag newly added ecosystems.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
noteNoAdvisory note about list currency and canonical source.
errorNoPresent when the call failed. Absent on success.
ecosystemsNoSupported ecosystem identifier strings. These are case-sensitive exact matches required by the ecosystem parameter of osv_query_package and osv_query_batch.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, and the description adds valuable behavioral context beyond that: case-sensitive exact matching (and the error consequence), the static nature of the list, and the potential to lag newly added ecosystems. This goes well beyond the structured hints and prepares the agent for real-world outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long with zero filler. It front-loads the primary purpose, then adds usage guidance and a critical caveat. Every sentence contributes useful information, and the structure is logical and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-parameter list tool, the description is complete. It explains what the tool returns, how to use it (including case sensitivity), why it exists (to support query tools), and a timing caveat. The output schema exists (likely listing the ecosystems), so return structure doesn't need explanation. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema covers 100% of them (vacuously). Per the rubric, 0 params sets a baseline of 4. The description doesn't need to elaborate on parameters; it provides context about the return values instead, which is appropriate. No additional param semantics are required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: returning the list of supported ecosystem identifier strings. It explicitly names the sibling tools it supports (osv_query_package, osv_query_batch), distinguishing its role as the discovery/validation tool versus the query tools. The verb 'Return' and resource 'list' are specific, leaving no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: 'Use this tool to discover valid ecosystem strings before querying, or to verify an ecosystem identifier from a lockfile format.' It also gives a concrete behavioral caveat about case-sensitivity and a note on potential lag, helping the agent decide when to rely on this tool. It doesn't explicitly say when not to use, but the alternatives (query tools) are obvious from the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.7/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: fetching by ID, listing ecosystems, querying a single package, and batch querying multiple packages. Even though query_package and query_batch both search for vulnerabilities, they differ in input type and use case, with descriptions explicitly stating the intended scenarios.

Naming Consistency5/5

All tools follow a uniform 'osv_verb_noun' pattern (get_vulnerability, list_ecosystems, query_batch, query_package) with consistent snake_case and no mixing of verb styles. The pattern is immediately predictable and reinforces the distinct actions each tool performs.

Tool Count5/5

At 4 tools, the server is tightly scoped to the OSV advisory domain without unnecessary bloat. Each tool is essential for the core workflows of listing acceptable ecosystems, querying individual and batch packages, and fetching full advisory details.

Completeness5/5

The tool surface covers the fundamental lifecycle of vulnerability lookup: discover valid ecosystems, query for known vulnerabilities (both single and batch), and retrieve full advisory context. There are no obvious dead ends—an agent can chain queries to get complete remediation information.