apsa

Overview Schema Source Related Servers Discussions Admin

dependency_check

Query OSV for inventoried package versions, apply exclusions, and save a reassessed vulnerability report for Android/iOS security audits.

Instructions

Query OSV for inventoried package versions and save a reassessed report. query_mode is auto, legacy or batch; auto batches above 100 packages. Exclusion lists are case-sensitive globs for ecosystems, package names or ecosystem:name coordinates. Excluded packages are never transmitted or marked checked from cache. Batched queries preserve per-package pagination and partial failures.

Input Schema

Name	Required	Default
`report_id`	No	latest
`query_mode`	No	auto
`exclude_names`	No
`exclude_ecosystems`	No
`exclude_coordinates`	No

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedv1.6.0Oct 18, 2026

addedInput schema / properties / exclude_coordinates

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Exclude Coordinates"
+}

addedInput schema / properties / exclude_ecosystems

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Exclude Ecosystems"
+}

addedInput schema / properties / exclude_names

Added value: +{
+  "anyOf": [
+    {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "default": null,
+  "title": "Exclude Names"
+}

addedInput schema / properties / query_mode

Added value: +{
+  "default": "auto",
+  "title": "Query Mode",
+  "type": "string"
+}

First observedv1.0.3Oct 6, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and openWorldHint=true, so the external-write profile is partly covered. The description adds genuinely non-inferable behavior: excluded packages are never transmitted or marked checked from cache, and batched queries preserve per-package pagination and partial failures. It still omits what happens to the existing report being overwritten and any auth or rate-limit constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, no filler, purpose front-loaded before the parameter and behavior details. Each sentence conveys a distinct actionable fact (mode semantics, exclusion glob syntax, exclusion side effects, batching behavior).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. Still, for a five-parameter tool with zero schema documentation the description leaves gaps: report_id is unexplained, the relationship to audit_reassess/reports_checklist is unstated, and whether the saved report overwrites or appends is unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden and largely succeeds: it enumerates the query_mode values (auto/legacy/batch), the auto threshold, and the case-sensitive glob semantics for the three exclude_* lists. The report_id parameter is never mentioned at all despite having a 'latest' default, leaving one of five params undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource pair ('Query OSV for inventoried package versions') plus a second effect ('save a reassessed report'), which is more than a restatement of the name. However it never distinguishes itself from closely related siblings such as audit_reassess or reports_checklist, so the agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives conditional guidance for the query_mode parameter ('auto batches above 100 packages'), which implicitly tells the agent which mode to pick. It never states when to call dependency_check instead of a sibling like audit_reassess, and no prerequisites (e.g. an existing report or inventory) are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.