Skip to main content
Glama
Sign In
codesearch MCP Server

codesearch MCP Server

by SK-DEV-AI
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

vulns

Scan packages for vulnerabilities, retrieve advisory details, check latest versions, or analyze licenses by PURL; falls back to OSV.dev when Sonatype access limits are hit.

Instructions

Sonatype Guide + OSV.dev fallback: scan packages, vulnerability details, latest version, or license analysis by PURL. scan needs platform+name+version (or coordinates) — on Sonatype 401/429/quota errors it falls back to keyless OSV.dev automatically. detail accepts Sonatype ids, GHSA-* (GitHub Advisory enrichment), or CVE-* ids. latest_version/license need purl. e.g. vulns(action='scan', name='lodash', version='4.17.20')

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "vulns"
  }
}

Input Schema

NameRequiredDescriptionDefault
nameNo
purlNo
actionNo
versionNo
vuln_idNo
platformNo
coordinatesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.1

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does disclose meaningful behavior: an auth/capacity failure mode (401/429/quota) and an automatic keyless fallback path, which materially affects trust in results. It omits return shape and any indication of rate limits or latency beyond the quota mention.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: the source/fallback framing leads, per-action requirements follow, and the concrete example at the end earns its place by showing correct invocation. Slightly run-on in the middle clauses but no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, zero-required multi-action dispatcher with no annotations and no output schema, the description covers invocation requirements well but never indicates what each action returns or how results differ between Sonatype and the OSV.dev fallback. Adequate for calling the tool, incomplete for interpreting its output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does map most parameters to actions: name/version/platform/coordinates for scan, purl for latest_version and license, and id formats (Sonatype, GHSA-*, CVE-*) for vuln_id in detail. Remaining gaps are the valid platform values and purl syntax, neither of which is documented anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs and resources (scan packages, vulnerability details, latest version, license analysis) and enumerates the action modes, so the agent knows the tool's scope without opening the schema. It does not, however, contrast itself against close siblings such as search_package, pkg, or enrich, which also deal with packages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives per-action preconditions explicitly: 'scan needs platform+name+version (or coordinates)' and 'latest_version/license need purl', plus the automatic OSV.dev fallback on Sonatype 401/429/quota errors. That's clear when-to-use context for each mode, though there are no explicit when-not-to-use rules or sibling routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools