Skip to main content
Glama

Review a dependency update before merging

review_dependency_upgrade
Read-onlyIdempotent

Use when an agent reviews a Dependabot, Renovate, npm, or PyPI version change before merge. One cited result combines security delta, runtime compatibility, breaking changes, go/no-go risk, and ordered migration actions for exact current and target versions. Do not use for new installs, unknown versions, general documentation, or other ecosystems. Read-only and safe to retry.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
detailNocompact is optimized for agent decisions; full includes the complete legacy plan payload.compact
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
detailNo
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
headlineNo
cache_hitNo
citationsNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
changelog_urlsNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
migration_actionsNo
recommended_targetNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint; the description reinforces these and adds the behavioral trait that it produces a single 'cited result' combining multiple analyses for exact current and target versions. This is useful context beyond the annotations, though it doesn't detail citation mechanics or output structure (covered by output schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, each earning its place: when-to-use, what result contains, and exclusions/safety. The critical scoping is front-loaded in the first sentence; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a read-only review tool with an output schema and high schema coverage. It covers use case, exclusions, safety, and key result contents, so an agent has enough to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, so the schema already documents most parameter meanings. The description reinforces 'exact current and target versions' but adds no new semantics for detail, runtime, or ecosystem beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific verb ('reviews'), resource (Dependabot, Renovate, npm, or PyPI version change), and precise scope ('before merge'). It lists the distinct output components (security delta, runtime compatibility, breaking changes, go/no-go risk, migration actions), which differentiates it from sibling tools by deliverable, not just name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('reviews a ... version change before merge') and what not to use for ('new installs, unknown versions, general documentation, or other ecosystems'). However, it does not name sibling tools or explicitly route to check_dependency_upgrade, find_safe_upgrade_target, or plan_dependency_upgrade, so the guidance is clear but not fully alternative-aware.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.