Skip to main content
Glama

Scan Dependency

scan_dependency
Read-onlyIdempotent

Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me". Returns a summary block (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable), per-advisory detail, links, and a list of recent alternative versions. NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly. Partial failures degrade gracefully — bundlephobia's first measurement on a new version can take 5-30s; sources_failed will list it if it times out, the rest still returns.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packageYesnpm package name. Scoped packages (e.g. "@types/node") are accepted.
versionNoSpecific version to check (e.g., "18.3.1"). Defaults to the latest published version when omitted.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint as false. The description adds value by detailing the composite nature, graceful degradation on partial failures, and the potential 5-30 second first measurement for bundlephobia. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is relatively long but well-structured, with the core purpose and use case front-loaded. Every sentence provides useful information, though slight trimming could improve conciseness without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only 2 parameters (both documented), no output schema, and rich annotations, the description covers all essential aspects: composite behavior, return structure (summary block, advisories, alternatives), limitations (NPM only, timeouts), and error handling (sources_failed). It is sufficiently complete for an AI agent to understand and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, but the description adds extra meaning: it clarifies that scoped packages (e.g., '@types/node') are accepted for the 'package' parameter and that 'version' defaults to the latest. This goes beyond the schema's basic descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool as a composite check for npm packages, combining deps.dev and bundlephobia data. It specifies the exact use case ('should I add this npm package to my project') and distinguishes from siblings by stating 'NPM ecosystem only in v1' and directing other ecosystems to an alternative tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool ('is X safe / popular / small', 'what does adding lodash cost me'), mentions partial failures and timeouts, and notes alternatives for other ecosystems. It could improve by explicitly stating when not to use it, but the guidance is already effective.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.9/5.0
Disambiguation3/5

Most tools have distinct purposes, but the ask_pipeworx family (ask_pipeworx, ask_pipeworx_beta, ask_pipeworx_grounded) plus deep_research creates real boundary confusion, and the six polymarket_* tools overlap enough to require careful reading. The few Scryfall card tools are clearly distinct from the Pipeworx bulk, but the name mismatch adds selection friction.

Naming Consistency4/5

All tool names use snake_case and most follow a verb_noun pattern (get_card, search_cards, resolve_entity, validate_claim). There are deviations like entity_profile, deep_research, and pipeworx_trending, but the nested families (ask_pipeworx*, polymarket_*) are internally consistent and predictable.

Tool Count2/5

35 tools is above the 25+ threshold and is especially mismatched with the server name 'Scryfall', which implies a focused MTG card server. Only 4 of 35 tools relate to Scryfall; the remaining 31 form a sprawling data-research platform that would be more appropriately split into separate servers.

Completeness4/5

The dominant Pipeworx data-research surface is remarkably complete: universal lookup, grounded answers, deep research, entity profiles, comparisons, entity resolution, claim validation, change feeds, subscriptions, memory, and discovery. The Scryfall subset covers core card lookup (search, get by name, random, list sets) but lacks rulings, set details, and card-by-ID lookups, which is a minor gap relative to the server's stated name.