Skip to main content
Glama
darthzen

fossa-mcp

by darthzen

fossa_update_project

Idempotent

Update FOSSA project settings for metadata, branches, policies, scanning, CI checks, labels, and dependency ignores. Only fields you specify are changed.

Instructions

Update one project's settings: metadata, branches, policy assignments, scanning, CI status checks, labels, and ignored dependencies.

WRITES TO FOSSA. Requires FOSSA_ALLOW_WRITES=true.

Every field defaults to None, meaning "leave unchanged" — only the fields named in the call are sent. Two of them replace rather than merge: label_ids replaces the project's whole label set, and transitive_excludes replaces the whole ignore list, so read the current value with fossa_get_project first if you mean to add to either. tracking_branches and hidden_branches are mutually exclusive.

Changing a policy or a scanning setting makes FOSSA rescan the project.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
notesNo
titleNo
publicNo
label_idsNo
policy_idNo
descriptionNo
project_urlNo
default_branchNo
sbom_policy_idNo
hidden_branchesNo
project_locatorYes
quality_policy_idNo
tracking_branchesNo
report_custom_textNo
security_policy_idNo
transitive_excludesNo
sbom_analysis_enabledNo
quality_status_check_enabledNo
policies_approve_multilicenseNo
security_status_check_enabledNo
licensing_status_check_enabledNo
quality_issue_scanning_enabledNo
security_issue_scanning_enabledNo
licensing_issue_scanning_enabledNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and idempotentHint=true, but the description adds much more: write requirement, default-to-None semantics, replace vs. merge behavior for two fields, mutual exclusivity of tracking/hidden branches, and that policy/scanning changes trigger a rescan. These are meaningful behavioral disclosures beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized, front-loaded with the core purpose, and every sentence adds value. It is well-structured with clear paragraphs and no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 24 parameters and no schema coverage, the description covers all major caveats: write permission, default semantics, replace-vs-merge fields, mutual exclusivity, and side effects (rescan). An output schema exists, so return-value details are not needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the critical default-to-None behavior for all fields and details the replace semantics for label_ids and transitive_excludes, plus mutual exclusivity for branch parameters. It does not describe every individual parameter, but the schema titles are fairly self-explanatory and the most important semantic warnings are covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Update') and identifies the resource ('one project's settings') with enumerated categories (metadata, branches, policy assignments, etc.). This clearly distinguishes it from sibling tools like fossa_get_project, fossa_delete_project, and fossa_update_revision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool (updating project settings) and provides a prerequisite (FOSSA_ALLOW_WRITES=true). It also advises reading current values with fossa_get_project before using label_ids or transitive_excludes. It does not explicitly exclude alternatives but gives clear operational context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/darthzen/fossa-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server