Skip to main content
Glama

Server Details

npm/PyPI dependency upgrades: package security, compatibility, target ranking, and migration plans.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP
URL
Repository
mattpicone/upgradelens
GitHub Stars
0
Tool DescriptionsA

Average 4.4/5 across 3 of 3 tools scored.

Server CoherenceA
Disambiguation5/5

Each tool has a clearly distinct purpose: finding a target, assessing a specific version pair for risk, and producing a migration plan. The descriptions explicitly cross-reference when to use one tool instead of another, so an agent should not confuse them.

Naming Consistency5/5

All tool names follow the same verb_dependency_upgrade pattern: check, find, and plan. This consistent verb-first naming makes the set predictable and the purpose of each tool easy to infer.

Tool Count5/5

Three tools is appropriate for a focused dependency-upgrade advisory server. Each tool covers one necessary phase of the workflow and none feel redundant or extraneous.

Completeness4/5

The set covers the core dependency-upgrade workflow: choosing a target, getting a go/no-go decision, and planning migration steps. It does not provide a direct tool for comparing multiple candidates side by side or executing the upgrade, but the tools are explicitly scoped as read-only and advisory, so the gap is minor.

Available Tools

3 tools
check_dependency_upgradeAssess a known dependency upgrade target (go/no-go)A
Read-onlyIdempotent
Inspect

Use when a coding agent needs a cited go/no-go risk decision without steps before changing an existing npm or PyPI dependency between two exact versions. Returns action_allowed, vulnerability delta, compatibility, EOL, and breaking-change evidence. Use plan_dependency_upgrade instead for ordered migration work. Do not use to choose a target, install a new package, search general docs, or analyze another ecosystem. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
cache_hitNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
recommended_targetNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful behavioral context: it returns action_allowed, vulnerability delta, compatibility, EOL, and breaking-change evidence, and clarifies that it does not produce migration steps. This goes beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: use case, return value summary, alternative tool, exclusions, and safety. The critical context is front-loaded and the description is tight despite covering a lot of ground.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema, detailed annotations, and clear sibling distinctions, the description covers everything needed to select and invoke the tool correctly. It explains what the tool returns, when to use it, when not to use it, and which alternative to prefer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the schema already documents most parameters. The description reinforces that exact versions are expected ('between two exact versions') but does not add substantial new meaning beyond the schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: assessing a known npm/PyPI dependency upgrade between two exact versions. It clearly differentiates from plan_dependency_upgrade and explicitly lists exclusions such as choosing a target, installing packages, or analyzing other ecosystems.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('needs a cited go/no-go risk decision without steps'), names the alternative (plan_dependency_upgrade), and lists concrete negative use cases. An agent can route correctly without additional inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_safe_upgrade_targetRank upgrade candidates (not a safety verdict; full check required)A
Read-onlyIdempotent
Inspect

Use only when an existing npm or PyPI dependency has an exact current version but no chosen target. Ranks candidates; candidates are not declared safe and require check_dependency_upgrade or plan_dependency_upgrade. Do not use when a target is stated, for a new install, or as authorization to edit files. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
max_major_jumpNoOptional major-version jump cap. 0 = stay in the same major.
current_versionYesExact installed version.
allow_prereleaseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
coverageNo
evidenceNo
ecosystemNo
freshnessNo
candidatesNo
confidenceNo
next_actionNo
latest_stableNo
action_allowedNo
current_versionNo
analysis_versionNo
recommended_targetNo
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, and the description reinforces this. It adds valuable context beyond the annotations by clarifying that candidates are not declared safe and require check_dependency_upgrade or plan_dependency_upgrade, which is important behavioral nuance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with clear usage conditions and exclusions in a few sentences. It loses a point because 'Read-only and safe to retry' repeats what the annotations already state, adding slight redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists and annotations cover safety and idempotency, the description provides all necessary invocation context: when to use it, when not to use it, what the output does not guarantee, and which sibling tools should be used instead. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the schema already documents most parameters. The description adds context about 'exact current version' and the npm/PyPI scope, but it does not meaningfully explain max_major_jump or allow_prerelease beyond the schema. This meets the baseline but does not substantially enrich parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool ranks upgrade candidates for existing npm/PyPI dependencies and explicitly distinguishes this from a safety verdict. It references the sibling tools and leaves no ambiguity about what the tool does versus what it does not do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditions for use: only when an existing dependency has an exact current version but no chosen target. It also states clear exclusions, such as when a target is stated, for new installs, or as authorization to edit files, and directs the agent to the appropriate sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_dependency_upgradePlan a known dependency upgrade (migration/review checklist)A
Read-onlyIdempotent
Inspect

Use when a coding agent needs a migration checklist, refactor actions, ordered review actions, changelog links, or test steps for exact current and target npm/PyPI versions. Use check_dependency_upgrade instead for a go/no-go without steps. Do not use to choose a target, install a package, or provide a general tutorial. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
cache_hitNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
changelog_urlsNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
migration_actionsNo
recommended_targetNo
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds 'Read-only and safe to retry,' which largely repeats those annotations rather than adding new behavioral context like auth needs or return-format caveats. Since the bar is lower with annotations and no contradiction exists, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first defines the deliverable, the second routes to the sibling, the third lists exclusions. Information is front-loaded with the most important condition first and no redundancy. This is a model of concise, structured tool documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool at this complexity (5 params, nested runtime object, output schema), the description covers trigger conditions, deliverable contents, alternative tool, and explicit non-goals. The output schema handles return-value details, and annotations cover safety, so nothing needed for correct invocation is missing. Complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 80% of the parameters with clear descriptions (exact package name, ecosystem enum with only npm/pypi, exact current/target versions). The description reinforces that versions are exact and tied to npm/PyPI, adding marginal clarity over the schema. Baseline 3 holds because the schema does the heavy lifting and the description doesn't add new parameter-level semantics beyond naming use cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: produces a migration checklist with refactor actions, ordered review actions, changelog links, or test steps for exact npm/PyPI versions. Explicitly contrasts with check_dependency_upgrade, distinguishing itself as the step-by-step planner rather than a go/no-go check. Clear scope that lets an agent select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Use when a coding agent needs...') and names the alternative ('Use check_dependency_upgrade instead for a go/no-go without steps'). Provides exclusions ('Do not use to choose a target, install a package, or provide a general tutorial'). This is exactly the when/when-not/alternatives guidance that earns a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Frequently Asked Questions

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Connectors

Related MCP Servers

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.