Skip to main content
Glama

Data Providence

by io.github.pipeworx-io

Scan Dependency

scan_dependency
Read-onlyIdempotent

Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me". Returns a summary block (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable), per-advisory detail, links, and a list of recent alternative versions. NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly. Partial failures degrade gracefully — bundlephobia's first measurement on a new version can take 5-30s; sources_failed will list it if it times out, the rest still returns.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packageYesnpm package name. Scoped packages (e.g. "@types/node") are accepted.
versionNoSpecific version to check (e.g., "18.3.1"). Defaults to the latest published version when omitted.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds valuable behavioral details: fans out to two services, returns a summary block with specific fields, mentions possible 5-30s delay for bundlephobia first measurement, and describes graceful partial failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite its length, every sentence serves a purpose. The description is front-loaded with the main composite check purpose, followed by use cases, return format, and caveats. No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description comprehensively covers what the tool does, what it returns, limitations (NPM only, bundlephobia first-measurement delay), and partial failure behavior. With no output schema, it adequately describes return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds context beyond schema: version defaults to latest, and scoped packages are accepted. This provides useful clarification.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool performs a composite check for evaluating npm packages, fanning out to deps.dev and bundlephobia. It specifies the verb 'scan' and resource 'dependency', and distinguishes from siblings by noting that other ecosystems are handled by deps.dev:version directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me".' It also advises that for non-NPM ecosystems, users should use deps.dev:version directly, providing clear guidance on when to use versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Data Providence toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation3/5

Most tools have distinct purposes, but several clusters overlap: ask_pipeworx vs ask_pipeworx_beta are currently functionally identical, polymarket_arbitrage / polymarket_edges / polymarket_kalshi_spread all hunt mispricings via different mechanisms, ai_visibility_check is wrapped by scan_competitor_ai_presence, and discover_tools vs suggest_questions both serve tool discovery. The rich descriptions mitigate but do not eliminate misselection risk.

Naming Consistency4/5

Names are all snake_case and follow recognizable conventions: verb_noun for actions (compare_entities, resolve_entity, validate_claim), domain-prefixed families (polymarket_*, pipeworx_*, recent_*, ask_pipeworx_*), and a few bare verbs (remember, recall, query). Minor deviations like bet_research (noun_verb) and noun-only names (datasets, metadata) break the pattern, but the overall scheme is predictable.

Tool Count2/5

At 34 tools, this exceeds the 25+ threshold for 'too many' and bundles several distinct domains — general data querying, prediction markets, AI visibility, memory, subscriptions, open data, and npm auditing — into one server. The breadth is defensible for a data platform, but the agent-facing surface is sprawling and would benefit from splitting into focused servers.

Completeness4/5

The core data workflow is well covered: discover (discover_tools, suggest_questions), resolve (resolve_entity), query (ask_pipeworx), ground (ask_pipeworx_grounded, validate_claim), research (deep_research), compare (compare_entities), profile (entity_profile), and changes (recent_changes). Prediction markets, memory, and subscriptions each have full lifecycles. The main gap is no tool for fetching returned pipeworx:// citation URIs directly, plus a few soft-failing sources.

Resources