Skip to main content
Glama

Inspect Lockfile Pin Delta

lockfile_pin_delta

Inspect two caller-supplied npm package-lock.json objects and return added, removed, and changed name+version+integrity+resolved pins. Supply JSON before and after lockfile objects, not filesystem paths, URLs, or commands. An identical pin set is informational, not a failure. HTML, package.json, and unsupported lockfileVersion values are refused before payment. This is not an npm install, audit, or purchase. Ordinary wallets sign through examples/customer-x402 (inspect, explicit approve, attempt-receipt, read-only reconcile), not a precomputed signature. Initial live release accepts x402 only. Payment challenge and credentials are bound to https://agents.samedaydesk.com/lockfile-pin-delta, not mcp://. Retry the identical authorized arguments and credential.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
afterYesnpm package-lock.json object (lockfileVersion 2 or 3). Not a filesystem path, URL, or command.
beforeYesnpm package-lock.json object (lockfileVersion 2 or 3). Not a filesystem path, URL, or command.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
okYes
errorNo
quoteYes
digestYes
engineYes
limitsYes
chargedYes
productYes
analysisYes
boundaryYes
markdownNo
transportYes
costInputsYes
owedDeliveryNo
schemaVersionYes
markdownOmittedNo
engineProvenanceYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses pre-payment validation refusals, x402-only live payment, credential/host binding to the https endpoint rather than mcp://, and idempotent retry semantics. It does not state whether the operation is read-only in a machine-readable sense or describe latency/limits, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Opens with the core operation and output, then moves to input constraints and payment prerequisites – correctly front-loaded. The payment/wallet/retry sentences are long and somewhat dense but each carries information the agent needs to complete a paid x402 call, so little is truly wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is optional, yet the description still summarizes the delta contents helpfully, and it covers validation refusals, payment prerequisites, and retry behavior. For a paid two-object comparison tool this is close to complete; only error/response specifics around refused lockfileVersions are left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are fully documented in the schema (100% coverage), so the baseline is 3. The description's note that inputs are objects rather than paths/URLs/commands is useful but largely repeats the schema's own parameter descriptions, and it adds no format detail (e.g., how lockfileVersion mismatches are reported).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource ('inspect two npm package-lock.json objects') plus the exact output shape (added/removed/changed name+version+integrity+resolved pins). Explicitly excludes the nearby-but-different operations (npm install, audit, purchase), so an agent can place it against siblings without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete input requirements (caller-supplied JSON objects, not paths/URLs/commands), declares that an identical pin set is informational rather than a failure, and names refusal conditions (HTML, package.json, unsupported lockfileVersion) before payment. It stops short of naming an alternative tool to use, but no sibling overlaps functionally, so the routing need is low.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.