Skip to main content
Glama
4DA-Systems

@4da/mcp-server

Official
by 4DA-Systems
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Vulnerability scan

vulnerability_scan
Read-only

Scan project lockfiles for OSV.dev vulnerabilities, including transitive dependencies, with fix versions and where each is pinned. Check security, CVEs, or a single package before adding a dependency.

Instructions

Scan this project's lockfiles (npm/pnpm/yarn/bun, Cargo, Python, Go) for known OSV.dev vulnerabilities, transitives included, with fix versions and where each is pinned; package for one dep. Call when the user asks about security, vulnerabilities or CVEs, or before recommending a dependency.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
packageNoOnly this package (any ecosystem, every installed copy, transitives included), with a `package_note` saying what the lockfiles hold for it. Use it to ask about one dependency instead of reading the whole report.
include_devNoInclude known direct devDependencies. Transitive dev/runtime scope may be unknown. Default: false.
project_pathNoProject directory to scan. Default: current working directory.
force_refreshNoIgnore the OSV advisory cache and fetch fresh advisory data from OSV.dev (dependency versions are re-read on every lockfile change regardless). Default: false.
response_formatNoconcise (default): one row per vulnerable package version (worst severity, the version that fixes all its advisories, advisory count and first ids, where it is pinned), the 40 most severe and 25 recommendations, with counts of anything left out. detailed: one row per advisory with references, plus platform-inactive advisories, maintenance notices, install drift and resolution provenance.
severity_filterNoOnly show vulnerabilities whose presented severity is at or above this level.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv6.0.1

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so safety is covered; the description adds useful behavior beyond them by stating transitives are included, that fix versions and pin locations are returned, and that advisories come from OSV.dev. It does not mention caching/refresh behavior or output size limits, which are only in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence front-loads the scope (lockfiles, ecosystems) and closes with the trigger condition; every clause earns its place and nothing is repeated from structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scan with no output schema and full schema coverage, the description covers scope, ecosystems, transitives and the returned fix/pin information. Minor gaps remain around output limits and caching, but these are addressed in the schema rather than being genuinely missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters including enums, defaults and the `package` scoping mode. The description's '`package` for one dep' merely echoes the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Scan this project's lockfiles ... for known OSV.dev vulnerabilities'), enumerates the ecosystems covered (npm/pnpm/yarn/bun, Cargo, Python, Go) and scope (transitives included, fix versions, pin locations). It is clearly a vulnerability scanner, but it never names or contrasts the closest siblings (dependency_check, dependency_health), so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger: 'Call when the user asks about security, vulnerabilities or CVEs, or before recommending a dependency,' plus a scoped-query mode ('`package` for one dep'). It provides clear positive context but no when-not conditions and does not route to an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools