fairquery-agent-trust-mcp

Official

by fairquery

Overview Schema Source Related Servers Discussions Admin

TypeScript

Hybrid

Get vulnerability advisory details (free, OSV.dev)

osv_get_vulnerability

Read-onlyIdempotent

Fetch full OSV vulnerability records for advisory IDs from api.osv.dev to get details, severity, affected ranges, and fixed versions. Use when you have IDs and need remediation specifics.

Instructions

WHAT: Fetch full OSV records (summary, details, aliases, severity vectors, affected ranges, fixed versions, references) for advisory IDs directly from api.osv.dev. WHEN: You have IDs (from osv_query_packages or a report) and need details or the fixed version. WHEN NOT: To find which vulns affect a package version (osv_query_packages, free) or a whole manifest (osv_audit_dependencies, paid). COST: Free. Direct HTTPS to api.osv.dev only; no token. Max 25 IDs per call, 20 s timeout each. RETURNS: Paged items {type:"vulnerability",id,summary,details,aliases,severity,affected,references,published,modified,osv_url} or {type:"error",code:VULN_NOT_FOUND|OSV_FETCH_FAILED,id,retryable}. EXAMPLE: {"ids":["GHSA-35jh-r3h4-6jhm"]} -> lodash command injection, fixed in 4.17.21.

Input Schema

TableJSON Schema

Name	Required	Description
`ids`	Yes	Required. 1-25 IDs (3-100 chars, letters/digits/.-_:), e.g. ["GHSA-35jh-r3h4-6jhm","PYSEC-2021-9","GO-2022-0969"]
`limit`	No	Page size: items to return, integer 1-25 (default 25)
`offset`	No	Items to skip for paging, integer >= 0 (default 0); pass nextOffset from the previous response

Output Schema

TableJSON Schema

Name	Required	Description
`meta`	No	Tool-specific context (summary counts, cost notes, ...)
`count`	Yes	Number of items in this page
`items`	Yes	Result rows for this page
`total`	Yes	Total items before paging
`offset`	Yes	Offset of the first item in this page
`hasMore`	Yes	True if more items exist after this page
`nextOffset`	Yes	Offset to pass for the next page, or null

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Oct 17, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly/idempotent/openWorld), the description discloses cost (free, no token), the endpoint (api.osv.dev over HTTPS), a rate/shape limit (max 25 IDs, 20s timeout each), and the structured error codes with retryable flag. This is meaningful operational context that annotations alone do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Labeled sections (WHAT/WHEN/WHEN NOT/COST/RETURNS/EXAMPLE) make it scannable and front-loaded, with the scope and alternative-routing stated before operational detail. Every sentence carries distinct information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and 100% param coverage, the description fills the remaining gaps: cost, transport, limits, error codes, and a concrete worked example. An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already fully documents ids/limit/offset. The description only restates the 25-ID cap, which duplicates maxItems, and gives no added semantics for paging or ID formatting. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The WHAT clause gives a specific verb (Fetch) and resource (full OSV records for advisory IDs), enumerating exactly which fields are returned. It distinguishes itself from siblings osv_query_packages and osv_audit_dependencies by scope (lookup by ID vs. discovery by package/manifest).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit WHEN ('You have IDs ... and need details or the fixed version') and WHEN NOT clauses name the two alternatives with their cost tiers, so the agent can route without opening other schemas. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server