Skip to main content
Glama

Commit — Supply Chain Risk Scoring

get_api_key

Create a free Commit API key instantly — no browser required.

When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekly alerts when your dependencies get riskier).

After creating the key, configure your MCP client to pass it: Authorization: Bearer sk_commit_

Example: get_api_key({ email: "dev@company.com" })

One key per email. 3 keys per IP per day (anti-abuse).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
emailYesYour email address — used for alert delivery and key recovery. One key per email.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses rate limit changes ('lifts the rate limit to 200 audits/day'), enables monitoring, and states constraints: 'One key per email. 3 keys per IP per day (anti-abuse).' It also explains the returned key and usage in an MCP client configuration, providing strong behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately sized but well-structured: it leads with the core purpose, explains the benefit, gives an example, and lists constraints. All sentences carry useful information, though the second sentence partially restates the first. It earns a 4 for effective structure with minor redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given it's a simple one-parameter tool with no output schema, the description covers the purpose, usage trigger, benefits, and post-process configuration. It doesn't explicitly detail the response format, but the example and statement 'returned directly in the chat' are sufficient. The tool is adequately contextualized within the sibling set.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers the email parameter with a detailed description and validation. The tool description adds extra context about why the email is needed and the rate limit benefits, enriching the parameter semantics. Since schema coverage is 100%, the baseline is 3, and the added context justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Create a free Commit API key instantly — no browser required,' which clearly states a specific action (create) and resource (Commit API key). This distinguishes it from the sibling audit/lookup tools that retrieve data rather than generate credentials.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit usage context: 'When you've hit the daily free query limit (or just want faster access), call this tool with your email...' This tells the agent when to invoke the tool, though it does not explicitly state alternatives or when not to use it. Sibling tools are all lookup/audit operations, so the use case is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation4/5

Most tools are clearly distinct by ecosystem and action, but the pair audit_github_repo and lookup_github_repo could be confused since both operate on GitHub repos (one audits dependencies, the other profiles the repo itself). The descriptions help, but the naming is similar enough to cause occasional misselection.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern: 'audit_' for dependency auditing, 'lookup_' for single-entity profiles, plus 'get_api_key' and 'query_commitment'. The 'lookup_business_by_org' variant is a clear sub-pattern, not a deviation.

Tool Count5/5

12 tools is well-scoped for a multi-ecosystem supply chain risk scoring server. Each tool covers a distinct ecosystem or operational function (auditing, lookup, API key management, domain commitment), and none feel redundant.

Completeness4/5

Coverage is strong: flat audits for npm/PyPI/Cargo/Go, npm dependency tree traversal, GitHub repo audits, and single-package lookups across all major ecosystems. Minor gaps include no explicit tool for managing the monitoring/alerts feature mentioned in get_api_key, and no dependency tree traversal for non-npm ecosystems, but these are acceptable workarounds.