Skip to main content
Glama

@4da/mcp-server

npm version License: MIT Node

AI 코딩 에이전트를 위한 의존성 인텔리전스. 실시간 CVE 스캔, 의존성 상태 점검, 업그레이드 계획, 생태계 뉴스 및 지속적인 의사결정 메모리를 제공합니다. 제로 설정, 개인정보 보호 우선.

You:     "Check my dependency health"
Claude:  Health: 72/100. 47 dependencies scanned, 3 vulnerable, 1 deprecated, 8 outdated.

         CRITICAL  openssl-sys 0.9.93  CVE-2025-4231        -> 0.9.96
         HIGH      serde       1.0.197 RUSTSEC-2026-12      -> 1.0.210
         MEDIUM    cookie      0.17.0  deprecated           -> 0.18.1

         Quick wins: 6 patch upgrades, 2 minor. Run upgrade_planner for full plan.

명령어 하나로 설치 가능합니다. API 키나 계정이 필요 없습니다. 어떤 코드도 로컬 환경을 벗어나지 않습니다.

설치

claude mcp add 4da -- npx @4da/mcp-server

~/.cursor/mcp.json 또는 ~/.windsurf/mcp.json에 추가하세요:

{
  "mcpServers": {
    "4da": {
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}

~/.vscode/mcp.json에 추가하세요:

{
  "servers": {
    "4da": {
      "type": "stdio",
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) 또는 %APPDATA%\Claude\claude_desktop_config.json (Windows)에 추가하세요:

{
  "mcpServers": {
    "4da": {
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}
npx @4da/mcp-server --setup

그런 다음 AI에게 "Check my dependency health" 또는 **"Scan for vulnerabilities"**라고 요청하세요.

Related MCP server: oss-intel-mcp

작동 방식

시작 시 서버는 매니페스트 및 잠금 파일(package.json, Cargo.toml, go.mod, pyproject.toml)을 읽고, 정확한 의존성 버전을 확인하며 실시간 API를 쿼리합니다:

  • OSV.dev: 모든 생태계의 알려진 CVE 확인

  • npm registry: 버전 최신성, 지원 중단 상태 및 주간 다운로드 수 확인

  • crates.io sparse index: Rust 패키지 버전 확인 (1 req/s API 제한 방지)

  • PyPI JSON API: 라이선스 정규화가 포함된 Python 패키지 메타데이터 확인

  • Go module proxy: Go 모듈 버전 확인

  • Hacker News Algolia API: 기술 스택별로 필터링된 생태계 뉴스 확인

결과는 캐시되며(레지스트리 데이터 24시간, 취약점 1시간, 뉴스 30분), 소스별로 속도 제한이 적용됩니다.

네트워크 전송 데이터: 패키지 이름 + 버전, 일반적인 기술 키워드. package.json에서 볼 수 있는 것과 동일한 데이터입니다. 소스 코드, 파일 경로, 개인 정보는 전송되지 않습니다. 모든 네트워크 호출을 비활성화하려면 FOURDA_OFFLINE=true를 설정하세요.

지원 생태계: npm, crates.io (Rust), PyPI (Python), Go.

질문 예시

"Check my dependency health"                  -> dependency_health
"Scan for vulnerabilities"                    -> vulnerability_scan
"Which deps should I upgrade first?"          -> upgrade_planner
"What should I know before I start coding?"   -> what_should_i_know
"What's happening in the ecosystem?"          -> ecosystem_pulse
"What's my tech stack?"                       -> get_context
"Record a decision: we chose Postgres"        -> decision_memory
"Does switching to MySQL align?"              -> check_decision_alignment
"Remember: never use ORM for batch inserts"   -> agent_memory

14가지 도구 전체 목록

의존성 보안

도구

기능

vulnerability_scan

OSV.dev를 통한 실시간 CVE 스캔. 심각도, 수정 버전, CVSS 점수 제공.

dependency_health

상태 점수(0-100) + 버전 최신성, 지원 중단 여부, 의존성별 CVE 수 제공.

upgrade_planner

순위가 매겨진 업그레이드 권장 사항. 빠른 해결책 vs. 브레이킹 체인지. 위험도별 정렬.

인텔리전스

도구

기능

what_should_i_know

작업 전 인텔리전스 브리핑: 취약점, 결정 사항, 신호, 생태계 업데이트.

ecosystem_pulse

감지된 기술 스택으로 필터링된 Hacker News의 실시간 생태계 뉴스.

get_context

기술 스택, 확인된 의존성 버전, 관심사, 성향.

get_relevant_content*

점수가 매겨진 콘텐츠 피드 — 관련성에 따라 순위가 매겨진 기사, 권고 사항, 릴리스.

get_actionable_signals*

분류된 알림: 보안 권고, 브레이킹 체인지, 트렌딩 저장소.

knowledge_gaps*

매일 사용하지만 읽어본 적 없는 의존성. 놓친 CVE 및 업데이트를 표면화.

record_feedback*

항목을 저장하거나 무시하여 4DA에게 중요한 것을 학습시킴. 향후 점수 산정 정교화.

의사결정 및 메모리

도구

기능

decision_memory

세션 전반에 걸쳐 아키텍처 결정을 기록, 쿼리 및 관리.

check_decision_alignment

제안된 기술 변경 사항이 기록된 결정과 일치하는지 확인.

agent_memory

세션, 에이전트 및 에디터 전반에 걸쳐 유지되는 지속적인 메모리.

정체성

도구

기능

developer_dna*

개발자 기술 정체성: 주력 스택, 참여 패턴, 사각지대.

* 전체 데이터를 보려면 4DA 데스크톱 앱이 필요합니다.

독립형 vs. 전체 모드

MCP 서버는 데스크톱 앱 없이도 작동합니다. 처음 실행 시 로컬 데이터베이스를 생성하고 프로젝트를 스캔합니다:

기능

독립형

4DA 데스크톱 포함

취약점 스캔 (OSV.dev)

예

예

의존성 상태 점검 (4개 레지스트리)

예

예

업그레이드 플래너

예

예

생태계 뉴스 (Hacker News)

예

예

작업 전 인텔리전스 브리핑

예

예

기술 스택 감지 + 버전 확인

예

예

의사결정 메모리 + 정렬 확인

예

예

에이전트 메모리 (세션 간)

예

예

점수화된 콘텐츠 피드 (20개 이상 소스)

--

예

실행 가능한 신호 + 지식 격차

--

예

복합 인텔리전스 (시간 경과에 따른 학습)

--

예

**4DA 다운로드**를 통해 전체 기능을 경험하세요.

전송 방식

stdio (기본값) -- 모든 MCP 호스트와 작동:

npx @4da/mcp-server

Streamable HTTP -- 원격 또는 다중 클라이언트 설정용:

npx @4da/mcp-server --http --port 4840

CLI 참조

npx @4da/mcp-server              # Start server (stdio)
npx @4da/mcp-server --http       # Start server (Streamable HTTP)
npx @4da/mcp-server --setup      # Auto-configure your editors
npx @4da/mcp-server --doctor     # Verify installation health
npx @4da/mcp-server --version    # Print version

환경 변수

변수

설명

기본값

FOURDA_DB_PATH

4DA의 SQLite 데이터베이스 경로

자동 감지

FOURDA_OFFLINE

모든 네트워크 호출 비활성화

false

FAQ

코드가 외부로 전송되나요? 아니요. 서버는 패키지 이름과 버전을 공개 API(OSV.dev, npm 레지스트리, crates.io, PyPI, Go 프록시)로, 일반적인 기술 키워드를 HN Algolia로 전송합니다. 이는 package.json에서 볼 수 있는 공개 데이터와 동일합니다. 소스 코드, 파일 경로, 개인 정보는 전송되지 않습니다. 모든 네트워크 호출을 비활성화하려면 FOURDA_OFFLINE=true를 설정하세요.

4DA 데스크톱 앱이 필요한가요? 아니요. 취약점 스캔, 의존성 상태 점검, 업그레이드 계획, 생태계 뉴스, 작업 전 브리핑, 프로젝트 컨텍스트, 의사결정 메모리, 정렬 확인, 에이전트 메모리 등 9가지 도구는 독립적으로 작동합니다. 데스크톱 앱은 시간이 지남에 따라 복합적으로 학습되는 20개 이상의 소스에서 점수화된 콘텐츠를 추가로 제공합니다.

어떤 AI 도구와 함께 작동하나요? MCP를 지원하는 모든 도구: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code (Copilot) 및 모든 사용자 지정 MCP 클라이언트.

소스에서 빌드

git clone https://github.com/runyourempire/4DA.git
cd 4DA/mcp-4da-server
pnpm install
pnpm build
pnpm test    # 71 contract tests

라이선스

MIT


Built by 4DA

Available Tools

9 tools
agent_memoryA

Cross-agent persistent memory: what one agent learns, any agent can recall. Call to store a discovery, decision, or warning, or to recall prior context before starting work.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide no safety or behavioral hints (all false), so the description must convey behavior. It states that memory is persistent and cross-agent ('what one agent learns, any agent can recall'), which is useful. However, it doesn't describe side effects of storing (e.g., overwrite, conflict resolution, retention policy) or any auth/rate limits. The description is transparent about the core functionality but lacks deeper behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and front-loaded with the core concept ('Cross-agent persistent memory'). It efficiently conveys the purpose and provides a clear call to action with two examples. Every word earns its place, no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, no output schema, and no annotation hints, the description must fully explain how the tool operates. It says 'store' and 'recall' but fails to specify how the agent provides the content or key for storage, what the return format is, or how memory is organized. The lack of operational detail makes the tool difficult to use correctly without further context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is an empty object, so schema description coverage is effectively 100%. With no parameters to explain, the description doesn't need to add parameter semantics. Per the rubric, a baseline of 4 is appropriate for 0 parameters. The description makes no claims about parameters, which is fine.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: it provides cross-agent persistent memory for storing and recalling information. It names specific content types (discovery, decision, warning) and a use case (recall prior context). However, it doesn't explicitly differentiate it from sibling tools like 'get_context' or 'decision_memory', which could have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives some usage guidance: 'Call to store a discovery, decision, or warning, or to recall prior context before starting work.' This suggests when to use it, but it lacks explicit guidance on when NOT to use it or how it compares to alternatives like 'get_context' or 'decision_memory'. The guidance is implied rather than being definitive about selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_decision_alignmentA
Read-only

Check whether a technology or pattern aligns with the developer's recorded decisions. Call BEFORE suggesting a major tech change, new library, or architecture shift.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description's 'Check whether' aligns as a read-only operation. It adds a small behavioral detail by indicating the tool consults 'recorded decisions' as the data source, but it doesn't disclose error handling, return behavior, or what happens on misalignment, so it offers only marginal extra context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core verb ('Check'), and immediately followed by a practical trigger condition. Every word earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, no-parameter tool, the description covers the essentials: purpose and when to call. It could elaborate on how to interpret the result or whether the check is blocking, but given the absent output schema and simple nature, it's largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0 parameters and 100% schema description coverage, the rubric sets a baseline of 4. The description adds no parameter-specific meaning (none needed), but it does imply the tool operates on a global decision set without requiring arguments, which is consistent with a 0-param interface.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it checks whether a technology/pattern aligns with recorded decisions, using a specific verb+resource construction ('Check whether... aligns with the developer's recorded decisions'). It also differentiates from siblings like decision_memory and agent_memory by specifying its exact role in the workflow, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use context ('Call BEFORE suggesting a major tech change, new library, or architecture shift'), which effectively guides the agent on appropriate invocation timing. However, it does not name alternative tools or mention when *not* to use it, so it stops short of full 5-level guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decision_memoryA

Record, list, update, or supersede the developer's architectural and tech decisions. Call when the user makes, changes, or asks about a settled decision or convention.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description lacks behavioral details beyond listing actions. No mention of idempotency, side effects, authentication, or return format. Annotations are all false, so description carries full burden but fails to disclose important traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: two sentences with no wasted words. Front-loaded with actions, followed by usage trigger.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given empty schema and no output schema, description is too brief for a multi-action tool. Does not explain how the tool determines which operation to perform (e.g., via user intent or hidden parameters). Missing crucial operational logic.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist (empty schema), so description adds no parameter info. Baseline for 0 parameters is 4, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool records, lists, updates, or supersedes architectural decisions. It explicitly names the resource (decisions) and actions, and distinguishes from siblings like vulnerability_scan and get_context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear guidance: 'Call when the user makes, changes, or asks about a settled decision or convention.' No explicit when-not or alternatives, but siblings are sufficiently different to infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

dependency_healthA
Read-only

Dependency version freshness, deprecation, and CVE counts across npm/Rust/Python/Go. Call when the user asks whether their dependencies are outdated, stale, or need updating.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true. The description adds valuable context by specifying the ecosystems (npm/Rust/Python/Go) and the types of data (freshness, deprecation, CVE counts), implying external lookups. It does not contradict annotations and enriches the agent's understanding of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences: the first states what the tool does, the second gives the usage trigger. It is front-loaded, contains no filler, and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, read-only, no output schema), the description is complete. It covers the core purpose, the types of information it provides, and a clear use case. The agent has enough to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is trivially complete. The description does not need to explain parameters. The baseline for 0 params is 4, and the description wisely focuses on usage context rather than parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear function: it provides dependency version freshness, deprecation, and CVE counts across specific ecosystems. It also includes an explicit usage trigger ('Call when the user asks whether their dependencies are outdated, stale, or need updating'), which distinguishes it from sibling tools like vulnerability_scan or upgrade_planner.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear when-to-use scenario ('Call when the user asks whether their dependencies are outdated, stale, or need updating'). However, it does not explicitly mention alternatives or when not to use it, though the sibling tool names provide implicit context for comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ecosystem_pulseA
Read-only

Live Hacker News discussions filtered to the user's tech stack. Call when the user asks what is new or trending in their ecosystem.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint. The description adds that it is 'Live' and 'filtered to the user's tech stack', providing behavioral context beyond annotations. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the key action, no superfluous words. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no parameters, the description covers the tool's function sufficiently for an AI agent to understand its purpose and usage. Could benefit from mentioning the output format, but not essential.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters, so baseline is 4. The description implies implicit filtering (user's tech stack) but does not need to document parameters since schema coverage is 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it provides 'Live Hacker News discussions filtered to the user's tech stack', distinguishing it from siblings like vulnerability_scan and what_should_i_know. The verb 'filtered' specifies the action precisely.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Call when the user asks what is new or trending in their ecosystem', providing clear invocation context. Lacks guidance on when not to use or alternatives, but the strong positive directive earns a high score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_contextA
Read-only

What 4DA knows about the user: role, tech stack, interests, and learned affinities. Call FIRST when you need to know what the user works on before answering or recommending.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description aligns with the readOnlyHint annotation, indicating a safe read operation. It adds value by detailing the specific data returned (role, tech stack, interests, affinities), which is beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words: the first explains the output, the second gives usage guidance. Extremely efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description fully explains the tool's purpose and when to use it. The listed outputs are sufficient for an agent to know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description does not add parameter-level detail, but the baseline of 3 is appropriate as the schema already covers the lack of parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves user context including role, tech stack, interests, and learned affinities. It distinguishes itself from siblings like vulnerability_scan and decision_memory by focusing on user profile information.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Call FIRST when you need to know what the user works on before answering or recommending,' providing clear when-to-use guidance. However, it does not explicitly mention when not to use it or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_plannerA
Read-only

Prioritized upgrade plan (CVE severity, deprecation, version distance), quick wins vs breaking changes. Call when the user asks what to upgrade, or after dependency_health surfaces problems.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, and the description adds meaningful behavioral context about what the plan covers (CVE severity, deprecation, version distance, quick wins vs breaking changes). It does not contradict the annotations and provides useful detail beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core value proposition, and every phrase adds information. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless tool with no output schema, the description is complete: it states the output type, key content dimensions, and when to invoke it. The sibling context further clarifies its niche relative to dependency_health and vulnerability_scan.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema carries no burden. The description explains what the tool produces rather than parameter details, which is appropriate for a parameterless tool. Baseline of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's purpose: providing a prioritized upgrade plan with specific dimensions (CVE severity, deprecation, version distance, quick wins vs breaking changes). It distinguishes itself from siblings like vulnerability_scan and dependency_health by focusing on the planning/prioritization output rather than the scan or health check itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage triggers: 'when the user asks what to upgrade, or after dependency_health surfaces problems.' This is clear contextual guidance, though it does not mention when not to use the tool or name alternatives beyond dependency_health.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vulnerability_scanA
Read-only

Scan dependencies for known CVEs via OSV.dev across npm/Rust/Python/Go, zero config. Call when the user asks about security, vulnerabilities, or CVEs, or before you recommend a dependency.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint and openWorldHint. The description adds context by specifying the scanning source (OSV.dev) and supported ecosystems, and implies no side effects. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and includes usage guidance without any redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, the description covers the key aspects: what it does, when to use it, and the ecosystems involved. It could detail output format but isn't critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist; schema coverage is 100%. The description correctly does not need to explain parameters, and the baseline score of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'scan', the resource 'dependencies', and specifies the target CVEs across multiple ecosystems (npm, Rust, Python, Go). It distinguishes itself from sibling tools like 'ecosystem_pulse' or 'get_context' by focusing on security scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells when to call: 'when the user asks about security, vulnerabilities, or CVEs, or before you recommend a dependency.' This provides clear context for usage, though it does not mention when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

what_should_i_knowA
Read-only

Pre-task briefing: advisories, active decisions, signals, and ecosystem updates for a task. Call BEFORE starting any non-trivial task to get caught up first.

NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare 'readOnlyHint' true and 'openWorldHint' true, covering safety and openness. The description adds that the tool provides 'advisories, active decisions, signals, and ecosystem updates,' which offers some behavioral context but no additional details about side effects or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, with no wasted words. It front-loads the purpose and usage guidance effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, so the description must clarify what the output contains. It only vaguely mentions 'advisories, active decisions, signals, and ecosystem updates' without specifying format or structure. This gap reduces completeness, though the description is adequate for a simple briefing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is empty (zero parameters), and schema description coverage is 100% trivially. With no parameters, the description need not add parameter details. Baseline score of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool is a 'pre-task briefing' that provides 'advisories, active decisions, signals, and ecosystem updates.' It uses specific verbs and resources, and the instruction to call it 'BEFORE starting any non-trivial task' distinguishes it from sibling tools like 'ecosystem_pulse' or 'vulnerability_scan'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('Call BEFORE starting any non-trivial task'), providing clear context. While it does not mention when not to use or list alternatives, the guidance is sufficient for a typical use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv4.6.2
    • Addedagent_memory
    • Addedcheck_decision_alignment
    • Addeddependency_health
    • Addedupgrade_planner
  2. 4 tool updatesv4.6.1
    • Removedagent_memory
    • Removedcheck_decision_alignment
    • Removeddependency_health
    • Removedupgrade_planner
  3. 9 tool updatesv4.6.0
    • First observedagent_memory
    • First observedcheck_decision_alignment
    • First observeddecision_memory
    • First observeddependency_health
    • First observedecosystem_pulse
    • First observedget_context
    • First observedupgrade_planner
    • First observedvulnerability_scan
    • First observedwhat_should_i_know

TDQS

A3.9/5.0

Scored across 9 tools

Disambiguation3/5

Some tools are clearly distinct (vulnerability_scan vs dependency_health vs upgrade_planner), but get_context, what_should_i_know, and agent_memory all deal with context/memory and could cause misselection. check_decision_alignment overlaps with decision_memory's 'check' functionality.

Naming Consistency4/5

Tool names follow a consistent snake_case pattern, mixing noun_verb and verb_noun forms (vulnerability_scan, dependency_health, upgrade_planner) with a few verb-first names (get_context, check_decision_alignment). The style is consistent, but verb placement varies slightly.

Tool Count5/5

9 tools is appropriate for a developer-assistant server covering security, dependency, and memory features. Each tool seems purposeful and the count is within the ideal 3-15 range.

Completeness4/5

The security/dependency workflow is well covered (scan, health, plan), and memory tools cover both recording and recalling. Missing actions like clearing memory or comparing dependency versions are minor gaps that agents could work around.

Maintenance

ActivityActive
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    AI-powered dependency vulnerability and breaking change analyzer that scans dependencies, identifies vulnerabilities via OSV.dev, and uses AI to assess real impact and suggest fixes.
    3
    Apache 2.0
  • A
    license
    Not graded
    quality
    F
    maintenance
    Open source intelligence for AI agents — GitHub project-health scoring, package dependency-risk analysis, trending repositories, license checks, and side-by-side package comparison.
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Package intelligence for AI coding agents that checks npm and PyPI package health, deprecation, vulnerabilities, bundle size, and compares alternatives.
    5
    MIT