Skip to main content
Glama

vow_scan

Scan project dependencies to identify licenses and validate them against a policy file, flagging disallowed or unknown licenses for compliance checks before releases or when adding new packages.

Instructions

Scan all dependency licenses in a project and — if a policy file is present — validate each package against that policy, flagging disallowed licenses (e.g. GPL in a proprietary codebase) or packages with unknown licenses.

When to use: before shipping a release, when adding a new dependency, during compliance or legal review, or as a CI gate. Set production: true to skip devDependencies and audit only what actually ships.

Side effects: reads supported lockfiles (package-lock.json or npm-shrinkwrap.json for Node; Cargo.lock for Rust; requirements.txt with hashes, uv.lock, or poetry.lock for Python) plus local node_modules / vendor manifests to resolve license strings. Pnpm, yarn, and go are not yet supported — vow exits with a clear error when only those lockfiles are present. Read-only; no network requests.

Returns: plain-text, JSON, or markdown summary of package → license mapping grouped by license family (MIT/Apache/BSD/GPL/unknown), with per-package links. Exit 1 if any dependency violates the policy or has an unknown license, 0 otherwise.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pathNoAbsolute or relative path to the project root to scan. Defaults to the current working directory.
formatNoResponse format: "terminal" for human-readable ANSI-colored output, "json" for machine-parseable structured data, "markdown" for rendered tables (where supported). Defaults to "terminal".
productionNoWhen true, exclude devDependencies from the scan and audit only runtime dependencies that ship with the published package. Use this for release-gate checks; leave false for full audits.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure and does so comprehensively. It clearly states side effects ('reads supported lockfiles... plus local node_modules / vendor manifests'), declares it's 'Read-only; no network requests', specifies exit codes ('Exit 1 if any dependency violates the policy or has an unknown license, 0 otherwise'), and documents platform limitations ('Pnpm, yarn, and go are not yet supported — vow exits with a clear error').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and efficiently organized. It begins with the core purpose, follows with usage guidelines, then details behavioral aspects, and concludes with return values. Every sentence serves a distinct purpose without redundancy, making it easy to parse while providing comprehensive information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 3 parameters, no annotations, and no output schema, the description provides exceptional completeness. It covers purpose, usage scenarios, behavioral characteristics (including side effects, limitations, and exit codes), parameter semantics, and return format details. The description fully compensates for the lack of structured metadata, making the tool's functionality and constraints completely understandable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema description coverage is 100%, the description adds valuable semantic context beyond the schema. It explains the practical implications of the 'production' parameter ('skip devDependencies and audit only what actually ships') and provides usage guidance ('Use this for release-gate checks; leave false for full audits'). However, it doesn't add significant meaning for the 'path' and 'format' parameters beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('scan all dependency licenses', 'validate each package against policy', 'flagging disallowed licenses') and distinguishes it from siblings by focusing on license compliance scanning. It explicitly identifies the resource (dependency licenses in a project) and the action (scanning and policy validation).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool: 'before shipping a release, when adding a new dependency, during compliance or legal review, or as a CI gate.' It also offers specific parameter guidance ('Set `production: true` to skip devDependencies') and mentions limitations ('Pnpm, yarn, and go are not yet supported'), giving clear context for appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/WhenLabs-org/when'

If you have feedback or need assistance with the MCP directory API, please join our Discord server