package-truth
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PORT | No | The port to listen on when running in HTTP mode (default 3000). | 3000 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| check_manifestA | Checks every dependency in a manifest file's text (package.json, requirements*.txt, pyproject.toml, Cargo.toml, go.mod, Gemfile, *.csproj, pom.xml). Pinned versions are checked exactly; ranges at the version an install would pick today. Problems are listed first. |
| check_packagesA | Checks up to 100 packages in one registry: exists, latest version, deprecated, known advisories, licence, age. Verdict each: does_not_exist, risky, verify (new or tiny: possible squat) or ok. Omit version for the latest. |
| get_advisoriesA | Lists the known security advisories for one package version (latest if omitted): id, title, CVE aliases, CVSS 3 score and link, plus how many affect the latest version. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 3 tools
The three tools are clearly distinct: check_manifest validates dependency files, get_advisories provides detailed advisory info for a specific package version, and check_packages performs bulk registry checks. While both check_manifest and check_packages can surface advisories, their inputs and purposes differ (file text vs. registry list), so ambiguity is minimal.
All tools follow a consistent verb_noun pattern with snake_case: check_manifest, get_advisories, check_packages. The verbs (check, get) are descriptive and the nouns (manifest, advisories, packages) clearly indicate the target.
Three tools is ideal for the server's focused purpose of package verification and security. Each tool serves a distinct need (manifest scanning, bulk checking, advisory lookup) without unnecessary overlap or bloat.
The server covers the core domain comprehensively: manifest validation, bulk package checks (existence, latest, deprecated, advisories, license, age), and detailed advisory queries. For a read-only package truth service, there are no obvious missing operations or dead ends.