Skip to main content
Glama

lurq

Audit a whole project

audit
Read-only

Assess an entire project's dependencies in ONE call: which packages are outdated, deprecated or carry advisories for the exact installed version, and which configured MCP servers have drifted, need credentials, or cannot be observed at all. Send the inventory you read locally (names and versions only — never source). Returns a per-item verdict plus an explicit coverage count: how many were answered, how many are queued because the index has not seen them, and how many were skipped and why. An item lurq could not assess is reported as unassessed, never as clean.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packagesNonpm dependencies read from package.json + lockfile
mcpServersNoMCP servers read from .mcp.json / agent configs

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description adds real behavioral depth: the privacy contract ('names and versions only — never source'), the coverage accounting (answered vs queued vs skipped-and-why), and the failure semantics ('an item could not assess is reported as unassessed, never as clean'). The last point in particular prevents an agent from misreading silence as a pass.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences, front-loaded with the scope and output of the call, with the privacy constraint and coverage semantics compactly packed. No filler sentences, though the third and fourth sentences could be tightened slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries return-value explanation, and it does so well by describing the per-item verdict and the answered/queued/skipped coverage counts. It does not break down the verdict fields themselves, which is the one remaining gap for a tool this complex with nested array inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — name/range/installed and the mcpServers fields (kind, alias, version, endpoint, packageName) are all documented at the schema level. The description reinforces what the payload should be ('names and versions only') but adds no syntax or format meaning beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource — 'Assess an entire project's dependencies' — and enumerates the exact findings it produces (outdated, deprecated, advisory on the installed version, plus MCP drift/credential/observability states). It clearly scopes itself as the whole-project batch operation ('in ONE call'), but it never names a sibling such as mcp_drift or compat that an agent should pick for narrower checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete invocation guidance — send the inventory you read locally, names and versions only, never source — which tells the agent what input to marshal and what not to send. It also implies the batch-use case via 'ONE call,' but it stops short of explicit when-not conditions or named alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.