Batch analyze dependency lists for security signals, checking npm package versions and heuristics to surface potential risks. Pass package names with version specifiers to run grouped checks.
Batch analyze a provided list of dependencies for security signals
| Name | Required | Description | Default |
|---|---|---|---|
| skipCache | No | Skip cache and fetch fresh data | |
| dependencies | Yes | Map of package names to version specifiers |
Changes observed during successful MCP inspections.
v0.1.2Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but only says it 'analyzes for security signals.' It does not disclose what signals are returned, whether results are cached, the effect of skipCache, or any auth/rate-limit constraints. For a tool with a cache-skipping parameter, the behavioral picture is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the core action and input are stated immediately. However, the brevity borders on under-specification for a batch analysis tool rather than being optimally informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description is the only source of return-value and behavior information, and it omits both. An agent cannot tell what a 'security signal' result contains or how batch results are structured.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (dependencies map, skipCache) are documented in the schema itself. The description adds no format details, examples of the dependency map shape, or version-specifier syntax beyond what the schema states, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb ('batch analyze'), resource ('list of dependencies'), and purpose ('security signals'), and the word 'list' implicitly contrasts with the sibling pkg-booper-big-sniff-file. It stops short of explicitly naming or differentiating from siblings like pkg-booper-sniff or pkg-booper-boop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus pkg-booper-sniff (single package?) or pkg-booper-big-sniff-file (file-based input). No prerequisites, no conditions, no exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.