Skip to main content
Glama
Sign In
guardvibe

guardvibe

by goklab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

scan_dependencies

Parse a lockfile or manifest to check all dependencies for known CVEs via the OSV database, helping audit projects and CI pipelines for vulnerable packages.

Instructions

Parse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly. Use this after installing dependencies, during CI, or when auditing existing projects for vulnerable packages.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "manifest_path": "<manifest_path>"
    },
    "name": "scan_dependencies"
  }
}

Input Schema

NameRequiredDescriptionDefault
formatNoOutput format: markdown (human) or json (machine-readable for agents)markdown
manifest_pathYesPath to manifest file (e.g. 'package.json', 'requirements.txt', 'go.mod')

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv3.66.0
    • removedInput schema / additionalProperties
      Removed value: -false
  2. Addedv3.35.1
  3. Removedv3.30.0
  4. First observedv0.1.0

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it does disclose that the file is read directly and that lookups go to the OSV database, which implies an outbound network call and a read-only posture. It says nothing about permissions, rate limits, size limits, or whether results are cached, and never clarifies that nothing is modified on disk.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: what it does, what it reads, and when to use it. No filler and the core action is front-loaded in the first clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description should say more about what comes back (CVE ids, severity, affected packages) or about network/auth requirements. The format parameter hints at output shape but the content of a finding is never described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so manifest_path and the format enum are already documented; the description adds only a slightly broader format list (adding package-lock.json) and does not explain path resolution or how the markdown vs json choice affects downstream parsing. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb+resource chain: parse a lockfile/manifest and check dependencies for CVEs via OSV, with the supported file types enumerated. An agent immediately knows what it does, but the description never differentiates it from close siblings such as check_dependencies, check_package_health, or scan_directory, which sound near-identical.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit temporal triggers: after installing dependencies, during CI, or when auditing existing projects. However, it offers no when-not conditions and never names an alternative tool, so an agent facing both scan_dependencies and check_dependencies has no routing rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools