Skip to main content
Glama

Scan Dependency

scan_dependency
Read-onlyIdempotent

Composite "should I add this npm package to my project" check in ONE call — fans out across deps.dev (license + advisories + version history) and bundlephobia (gzipped/minified bundle size, dependency count, ESM/tree-shake support). Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me". Returns a summary block (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable), per-advisory detail, links, and a list of recent alternative versions. NPM ecosystem only in v1; PyPI / Maven / Cargo / Go fall under deps.dev:version directly. Partial failures degrade gracefully — bundlephobia's first measurement on a new version can take 5-30s; sources_failed will list it if it times out, the rest still returns.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packageYesnpm package name. Scoped packages (e.g. "@types/node") are accepted.
versionNoSpecific version to check (e.g., "18.3.1"). Defaults to the latest published version when omitted.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, destructiveHint. The description adds valuable context: partial failures degrade gracefully, bundlephobia may timeout (5-30s), sources_failed list returned. This goes beyond annotation coverage, though could mention more about network latency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single dense paragraph that front-loads the main purpose. Some redundancy in listing return types, but no fluff. Could be broken into bullet points for readability, but overall well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking output schema, the description fully enumerates return fields (summary block, per-advisory detail, links, alternatives). Covers ecosystem restriction, error handling (partial failures), and timing behavior. Complete for a composite tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers both parameters with descriptions (100% coverage). Description adds minor context: 'Scoped packages accepted' and 'Defaults to latest when omitted'. Baseline 3 is appropriate since no additional semantic depth beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool is a composite check for adding npm packages, fanning out to deps.dev and bundlephobia. The verb 'scan' and resource 'dependency' are clear, and it distinguishes from non-npm ecosystem tools by noting PyPI/Maven/etc. fall under deps.dev:version directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage trigger: 'Use whenever an agent asks 'is X safe / popular / small''. Also specifies when not to use (NPM only, other ecosystems via deps.dev:version) and mentions partial failure handling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.6/5.0
Disambiguation2/5

Many tools have overlapping purposes, especially the pipeworx family (ask_pipeworx, ask_pipeworx_beta, ask_pipeworx_grounded, deep_research) which all route to the same data sources. Additionally, the server includes unrelated meta-tools (remember/recall/forget, generate_llms_txt, pipeworx_feedback) that have no clear boundaries with the poverty data tools, and betting tools that seem out of place. The core poverty tools (get_poverty, get_poverty_regional, list_reference) are distinct, but the rest creates significant confusion.

Naming Consistency2/5

Tool names are a mix of styles: some use snake_case (get_poverty, list_reference, suggest_questions), some use camelCase (ask_pipeworx, bet_research, scan_competitor_ai_presence), and others are single words (recall, remember, forget, subscribe). The naming pattern is highly inconsistent, making it hard to predict related tool names.

Tool Count2/5

With 34 tools, this server is heavily overloaded for a 'Worldbank Poverty' server. The majority of tools are unrelated to poverty (Polymarket betting, AI marketing, npm package checks, LLM visibility). The core poverty functionality could be served by 3-5 tools, but instead the server includes dozens of extra tools from a generic data platform, making the count inappropriate for the stated domain.

Completeness4/5

For the poverty data domain, the tool surface is actually quite complete: get_poverty for country-level data, get_poverty_regional for aggregations, and list_reference for metadata. The only minor gap is a lack of a tool for comparing poverty across countries directly, but that is easy to work around by calling get_poverty multiple times. The extra meta-tools do not affect poverty data completeness.