Skip to main content
Glama
Sign In
fairquery-agent-trust-mcp

fairquery-agent-trust-mcp

Official
by fairquery
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

Check package versions for known vulnerabilities (free, OSV.dev)

osv_query_packages
Read-onlyIdempotent

Check up to 200 exact package versions against OSV.dev to identify vulnerabilities and return advisory IDs.

Instructions

WHAT: Query the public OSV.dev database (api.osv.dev querybatch) directly from your machine for exact package versions; returns which are vulnerable and the advisory IDs. WHEN: Quick "is lodash 4.17.20 vulnerable?" checks for up to 200 packages; then osv_get_vulnerability for details of specific IDs. WHEN NOT: Parsing manifests/lockfiles, severity filtering, fixed/recommended versions in one shot -> osv_audit_dependencies (paid). COST: Free; no token, nothing sent to Fairquery or Apify. RETURNS: Paged "package" rows (vulnerable, vuln_ids) or per-entry INVALID_ECOSYSTEM "error" rows. Tool errors: OSV_FETCH_FAILED (retryable). BEHAVIOR: One HTTPS request to api.osv.dev (Google-run public API) for all packages; typically <2 s, 20 s timeout. Results change only when OSV publishes advisories. PARAMETERS: packages: each entry is checked independently and returns exactly one row, in input order. ecosystem is case-insensitive and accepts aliases (pip -> PyPI, cargo -> crates.io, gem -> RubyGems, golang -> Go); an unknown ecosystem yields a per-entry INVALID_ECOSYSTEM error row while the other entries still run. version must be one exact released version: a range such as "^4.17.0" or ">=2" is not resolved and normally returns no vulnerabilities (a false "safe"), so pin versions from your lockfile first. Duplicate entries are queried and returned twice. limit/offset page the rows (all packages are sent to OSV in a single request); meta.vulnerable_count counts all packages, not only the page. EXAMPLE: {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}]} -> vulnerable true, vuln_ids ["GHSA-35jh-r3h4-6jhm",...].

Input Schema

NameRequiredDescriptionDefault
limitNoOptional page size: items to return, integer 1-200 (default 100). Example: 50
offsetNoOptional zero-based number of items to skip, integer 0-1000000 (default 0); pass nextOffset from the previous response, e.g. 100
packagesYesRequired. 1-200 {ecosystem, name, version} objects, one exact version each. Example: [{"ecosystem":"npm","name":"lodash","version":"4.17.20"},{"ecosystem":"PyPI","name":"django","version":"3.2.0"}]

Output Schema

NameRequiredDescriptionDefault
metaNoTool-specific context (summary counts, cost notes, ...)
countYesNumber of items in this page
itemsYesResult rows for this page
totalYesTotal items before paging
offsetYesOffset of the first item in this page
hasMoreYesTrue if more items exist after this page
nextOffsetYesOffset to pass for the next page, or null

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • changedInput schema / properties / limit / description
      Previous value: -"Page size: items to return, integer 1-200 (default 100)"New value: +"Optional page size: items to return, integer 1-200 (default 100). Example: 50"
    • changedInput schema / properties / offset / description
      Previous value: -"Items to skip for paging, integer >= 0 (default 0); pass nextOffset from the previous response"New value: +"Optional zero-based number of items to skip, integer 0-1000000 (default 0); pass nextOffset from the previous response, e.g. 100"
    • changedInput schema / properties / packages / description
      Previous value: -"Required. 1-200 exact package versions. Example: [{\"ecosystem\":\"npm\",\"name\":\"lodash\",\"version\":\"4.17.20\"}]"New value: +"Required. 1-200 {ecosystem, name, version} objects, one exact version each. Example: [{\"ecosystem\":\"npm\",\"name\":\"lodash\",\"version\":\"4.17.20\"},{\"ecosystem\":\"PyPI\",\"name\":\"django\",\"version\":\"3.2.0\"}]"
    • changedInput schema / properties / packages / items / properties / ecosystem / description
      Previous value: -"npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex (aliases pip/cargo/gem accepted)"New value: +"Required, 1-40 chars, case-insensitive. One of npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex; aliases node, pip, python, golang, java, cargo, rust, gem, ruby, composer accepted. Example: \"npm\""
    • changedInput schema / properties / packages / items / properties / name / description
      Previous value: -"Package name, e.g. \"lodash\", \"django\", \"org.apache.logging.log4j:log4j-core\""New value: +"Required, 1-300 chars. Package name exactly as published: npm \"lodash\" or \"@scope/pkg\", PyPI \"django\", Go module path \"github.com/gin-gonic/gin\", Maven \"groupId:artifactId\" e.g. \"org.apache.logging.log4j:log4j-core\""
    • changedInput schema / properties / packages / items / properties / version / description
      Previous value: -"Exact version, e.g. \"4.17.20\" (no ranges)"New value: +"Required, 1-100 chars. One exact version without range operators or \"v\" prefix, e.g. \"4.17.20\" (not \"^4.17.0\"); Go uses \"v1.9.0\""
  2. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover safety (readOnly, idempotent, openWorld, non-destructive), and the description adds substantial context beyond them: one HTTPS request to api.osv.dev, free/no token, typical latency and 20s timeout, retryable OSV_FETCH_FAILED, per-entry INVALID_ECOSYSTEM rows, and that results only change when OSV publishes advisories. This is a rich disclosure of cost, network behavior, and failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Labeled sections (WHAT/WHEN/WHEN NOT/COST/RETURNS/BEHAVIOR/PARAMETERS/EXAMPLE) make it easy to scan and the most important routing information is front-loaded. It is longer than necessary, with the PARAMETERS section partly restating schema descriptions, but every section still carries useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a 3-parameter tool with 100% schema coverage, rich annotations, and an output schema, the description covers the remaining gaps an agent needs: cost, endpoint behavior, error semantics, paging quirks, and a concrete example. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: duplicate entries are queried twice, each entry produces exactly one row in input order, limit/offset page rows while all packages still go to OSV in one request, and meta.vulnerable_count counts all packages. Some content (ecosystem aliases, exact-version requirement) duplicates the schema, keeping it from a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The WHAT line names a specific verb (query), resource (OSV.dev package versions), and output (vulnerable flags and advisory IDs). It explicitly distinguishes itself from osv_get_vulnerability (detail lookup) and osv_audit_dependencies (manifest parsing/severity), so an agent can select it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

WHEN and WHEN NOT are both stated with named alternatives and the exact conditions that select them: quick version checks up to 200 packages here, manifest/lockfile auditing or severity filtering in osv_audit_dependencies. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools