Skip to main content
Glama
TheAlchemist6

CodeCompass MCP

analyze_dependencies

Analyze GitHub repository dependencies to identify security vulnerabilities, version conflicts, and outdated packages for improved code reliability.

Instructions

📦 Comprehensive dependency analysis including external packages, internal dependencies, security vulnerabilities, and version conflicts.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesGitHub repository URL
optionsNo

Implementation Reference

  • MCP tool handler function that parses arguments, delegates to GitHubService.analyzeDependencies, creates standardized response, and formats for MCP protocol.
    async function handleAnalyzeDependencies(args: any) {
      try {
        const { url, options = {} } = args;
        
        const dependencies = await githubService.analyzeDependencies(url);
        
        const response = createResponse(dependencies);
        return formatToolResponse(response);
      } catch (error) {
        const response = createResponse(null, error);
        return formatToolResponse(response);
      }
    }
  • Tool schema definition including input schema for parameters like repository URL and analysis options.
    {
      name: 'analyze_dependencies',
      description: '📦 Comprehensive dependency analysis including external packages, internal dependencies, security vulnerabilities, and version conflicts.',
      inputSchema: {
        type: 'object',
        properties: {
          url: {
            type: 'string',
            description: 'GitHub repository URL',
          },
          options: {
            type: 'object',
            properties: {
              include_dev_dependencies: {
                type: 'boolean',
                description: 'Include development dependencies',
                default: true,
              },
              include_security_scan: {
                type: 'boolean',
                description: 'Include security vulnerability scanning',
                default: true,
              },
              include_version_analysis: {
                type: 'boolean',
                description: 'Include version conflict analysis',
                default: true,
              },
              check_outdated: {
                type: 'boolean',
                description: 'Check for outdated packages',
                default: true,
              },
            },
          },
        },
        required: ['url'],
      },
    },
  • src/index.ts:236-240 (registration)
    Registers the list of available tools, including analyze_dependencies, for MCP ListTools requests.
    server.setRequestHandler(ListToolsRequestSchema, async () => {
      return {
        tools: consolidatedTools,
      };
    });
  • Core helper method in GitHubService that fetches and parses dependency files (package.json, requirements.txt) to extract dependency information.
    async analyzeDependencies(url: string): Promise<DependencyInfo[]> {
      const dependencies: DependencyInfo[] = [];
      
      try {
        // Check for package.json
        try {
          const packageJson = await this.getFileContent(url, 'package.json');
          const pkg = JSON.parse(packageJson);
          
          // Add regular dependencies
          if (pkg.dependencies) {
            for (const [name, version] of Object.entries(pkg.dependencies)) {
              dependencies.push({
                name,
                version: version as string,
                type: 'dependency',
                source: 'package.json',
              });
            }
          }
          
          // Add dev dependencies
          if (pkg.devDependencies) {
            for (const [name, version] of Object.entries(pkg.devDependencies)) {
              dependencies.push({
                name,
                version: version as string,
                type: 'devDependency',
                source: 'package.json',
              });
            }
          }
          
          // Add peer dependencies
          if (pkg.peerDependencies) {
            for (const [name, version] of Object.entries(pkg.peerDependencies)) {
              dependencies.push({
                name,
                version: version as string,
                type: 'peerDependency',
                source: 'package.json',
              });
            }
          }
        } catch (error) {
          // package.json not found, continue with other dependency files
        }
        
        // Check for requirements.txt
        try {
          const requirementsTxt = await this.getFileContent(url, 'requirements.txt');
          const lines = requirementsTxt.split('\n').filter(line => line.trim() && !line.startsWith('#'));
          
          for (const line of lines) {
            const match = line.match(/^([^=><]+)([=><]=?.*)?$/);
            if (match) {
              dependencies.push({
                name: match[1].trim(),
                version: match[2] || '*',
                type: 'dependency',
                source: 'requirements.txt',
              });
            }
          }
        } catch (error) {
          // requirements.txt not found
        }
        
        // Add more dependency file parsers as needed (Gemfile, Cargo.toml, etc.)
        
      } catch (error: any) {
        console.error('Error analyzing dependencies:', error.message);
      }
      
      return dependencies;
    }
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. While it lists analysis components (security, versions), it doesn't describe what the tool actually returns (e.g., report format, error handling), whether it makes network calls, has rate limits, or requires authentication. For a tool with no annotation coverage, this leaves significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('comprehensive dependency analysis') followed by scope details. There's no wasted text, though it could be slightly more structured (e.g., separating scope items with commas instead of 'and').

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (dependency analysis with security and version checks), no annotations, no output schema, and incomplete parameter documentation (50% schema coverage), the description is inadequate. It doesn't explain what the analysis returns, how results are structured, or address the undocumented 'options' parameter, leaving the agent with insufficient context for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only the 'url' parameter has a description in the schema). The description doesn't mention any parameters or their semantics, failing to compensate for the coverage gap. With 2 parameters (one required, one nested object with 4 sub-parameters), the description adds no value beyond what the schema provides, resulting in a baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs 'comprehensive dependency analysis' and specifies the scope: 'external packages, internal dependencies, security vulnerabilities, and version conflicts.' It uses a specific verb ('analyze') with a resource ('dependencies'), but doesn't explicitly differentiate from sibling tools like 'analyze_codebase' or 'review_code' that might also examine dependencies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. With siblings like 'analyze_codebase', 'review_code', and 'get_repository_info' that might overlap, there's no indication of when this specific dependency analysis is preferred or what prerequisites exist (e.g., requires a GitHub repository URL).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/TheAlchemist6/codecompass-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server