Skip to main content
Glama
Sign In
@4da/mcp-server

@4da/mcp-server

Official
by 4DA-Systems
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Dependency check

dependency_check
Read-onlyIdempotent

Check if a dependency version is safe to write to a manifest, returning verdicts on exact versions or safe releases within a constraint across npm, crates.io, PyPI, and Go.

Instructions

Is a dependency version safe to write? Verdict on an exact version, or safe releases in a constraint ("7.x", "~=3.1"); npm, crates.io, PyPI, Go. Call BEFORE writing any version to a manifest: add, pin, upgrade, bump, downgrade.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "items": "<items>"
    },
    "name": "dependency_check"
  }
}

Input Schema

NameRequiredDescriptionDefault
itemsYesThe proposed changes to check, 1 to 25.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv6.0.3
    • changedInput schema / properties / items / items / properties / ecosystem / enum
      Previous value: -[
-  "npm",
-  "crates.io"
-]New value: +[
+  "npm",
+  "crates.io",
+  "PyPI",
+  "Go"
+]
    • changedInput schema / properties / items / items / properties / package / description
      Previous value: -"Package name exactly as published (e.g. \"axios\", \"@scope/pkg\", \"serde_json\")."New value: +"Package name exactly as published (\"axios\", \"@scope/pkg\", \"serde_json\", \"Jinja2\", \"golang.org/x/net\", \"github.com/labstack/echo/v4\")."
    • changedInput schema / properties / items / items / properties / to / description
      Previous value: -"Exact version you intend to install (e.g. \"1.14.1\"), or \"latest\" for the newest stable release; not a range."New value: +"The version you intend to write (\"7.5.10\", \"3.1.4\", \"v0.23.0\"), \"latest\", or the constraint it must satisfy (\"7.x\", \"^1.20\", \"=0.17\", \"~=3.1\", \">=2,<3\", \"v1\") to get the safe releases in it."
  2. First observedv6.0.1

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so safety is covered. The description adds genuinely new behavioral context: the tool returns either a single verdict (exact version) or a set of safe releases (constraint), which is important since there is no output schema. It does not clarify what "safe" means (security vs. compatibility vs. licensing) despite sibling vulnerability_scan implying overlap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. The core purpose is front-loaded as a question, and the call-before-writing instruction is tight and actionable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly supplies the two return modes (verdict vs. safe releases in a constraint), which is the key missing structured information. The residual gap is the undefined meaning of "safe" and no failure/unknown-package behavior, but for a read-only advisory tool this is close to complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the one parameter and its nested fields (ecosystem, package, to, from) are fully documented in the schema. The description's constraint examples ("7.x", "~=3.1") and ecosystem list repeat the schema rather than extending it, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a concrete question that names the resource and the decision it supports ("Is a dependency version safe to write?"), and scopes it to an exact version or a constraint across npm/crates.io/PyPI/Go. The verb+resource are unambiguous, but it never distinguishes itself from close siblings like vulnerability_scan or dependency_health, so the agent cannot tell from the description alone which of the safety-oriented tools applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger and timing: "Call BEFORE writing any version to a manifest: add, pin, upgrade, bump, downgrade." That is strong condition-setting, but it offers no when-not guidance and never names an alternative tool, so the sibling routing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools