Skip to main content
Glama

npm

by io.github.pipeworx-io

Scan Dependency

scan_dependency
Read-onlyIdempotent

Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me". Returns a summary block (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable), per-advisory detail, links, and a list of recent alternative versions. NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly. Partial failures degrade gracefully — bundlephobia's first measurement on a new version can take 5-30s; sources_failed will list it if it times out, the rest still returns.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packageYesnpm package name. Scoped packages (e.g. "@types/node") are accepted.
versionNoSpecific version to check (e.g., "18.3.1"). Defaults to the latest published version when omitted.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Added

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, the description discloses valuable behavioral traits: it fans out across two services, handles partial failures gracefully, mentions possible 5-30s delay on first bundlephobia measurement, and explains the 'sources_failed' field. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense, front-loaded with the core purpose, followed by usage, return block, limitations, and failure behavior. Every sentence adds unique value; no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of a composite tool (two external services) and lack of output schema, the description is remarkably complete. It explains the return payload (summary fields, per-advisory details, links, alternatives), ecosystem limitation, and graceful degradation. No important behavioral or output aspect is left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already covers both parameters (package, version) at 100%, so baseline is 3. The description adds meaningful constraint context: 'NPM ecosystem only in v1' clarifies the valid values for 'package' and indicates when not to use this tool. It also describes the output structure, aiding parameter interpretation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states this is a 'Composite ... check in ONE call' for npm packages, with specific verb ('scan') and resource ('dependency'). It distinguishes itself from siblings by explicitly listing the data sources (deps.dev, bundlephobia) and the types of questions it answers ('is X safe / popular / small').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Use whenever an agent asks ...' and gives specific example queries. It also provides a when-not: 'NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly', guiding agents to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All npm toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.8/5.0
Disambiguation4/5

Descriptions are exceptionally detailed and differentiate tools well; the ask_pipeworx family (stable/beta/grounded), polymarket tools, and npm lookup tools each have clear separation of intent. Minor overlap exists between polymarket_edges and polymarket_arbitrage (both surface opportunities) and between discover_tools, suggest_questions, and pipeworx_trending (all aid discovery), but descriptions mostly resolve the ambiguity.

Naming Consistency3/5

All names are snake_case and several families are consistent (get_*, list_*, search_*, ask_pipeworx, polymarket_*), but the convention is inconsistent: verb-first names (resolve_entity, validate_claim, scan_dependency) coexist with noun-first or noun-only names (entity_profile, deep_research, bet_research, recent_alerts, ai_visibility_check, pipeworx_trending, polymarket_arbitrage). No clear governing pattern beyond snake_case.

Tool Count2/5

36 tools is well over the 25-tool heavy threshold, and the majority (~29) are unrelated to the server's declared 'npm' identity — they are Pipeworx data-query, prediction-market, memory, and subscription tools. Only about 7 tools (search_packages, get_package, get_version_info, list_versions, get_downloads, scan_dependency, generate_llms_txt) actually pertain to npm. The scope is a kitchen-sink mismatch with the server name.

Completeness3/5

For npm, the read-side surface is reasonably complete: search, inspect package metadata, version listings, download counts, and a dependency-safety composite check. However, there are no lifecycle operations (publish, unpublish, deprecate, set versions/tags), leaving a notable gap, and the bulk of the server's functionality (data queries, prediction bets) belongs to an entirely different domain that can't be cohesively evaluated against the npm purpose.

Resources