@4da/mcp-server
OfficialSummary: 4DA MCP server gives AI coding agents upgrade intelligence and vulnerability scanning by reading your project's local lockfiles (npm, Cargo, Python, Go, Ruby, PHP) — no account, no code leaving your machine.
Vulnerability scanning — matches every installed copy in every lockfile against OSV.dev, with fix versions, severities, pin locations, and partial-coverage reporting.
Upgrade impact — changelog entries between your version and a target, flagged breaking/deprecation/security, plus the local files that import the dependency.
Pre-install dependency check — a proceed/wait/review/avoid/unknown verdict with evidence (advisories, release age, yanks, install scripts, publisher trust) before you write any version into a manifest.
Dependency health — freshness, deprecation, and CVE counts per dependency across registries.
Upgrade planning — a prioritized work order of the smallest versions that clear each vulnerability, flagging majors and transitive blockers.
Pre-task briefing — what's known about the packages a task names, their vulnerabilities, releases since, and related decisions.
Ecosystem pulse — recent Hacker News discussions mentioning your dependencies.
Project context — your tech stack, resolved versions, interests, and detected topics.
Decision memory & alignment check — record, list, update, or supersede architectural decisions and verify whether a proposed change aligns with them.
Agent memory — cross-session, cross-agent persistent memory for discoveries, decisions, and warnings.
Deployment options — runs over stdio or Streamable HTTP (with token auth for non-loopback binds), and works standalone or with the 4DA desktop app for extra signals, feeds, and Developer DNA.
Integrates with the Hacker News Algolia API to fetch headlines that mention your dependencies and languages for the ecosystem_pulse tool.
Integrates with the npm registry to retrieve package versions, deprecations, yanks, publish times, publishers, install scripts, and per-version dependencies for npm-based projects, powering vulnerability scans, upgrade impact analysis, and dependency checks.
Can use a local Ollama embedding provider for semantic recall in decision and agent memory, keeping all data on the machine.
Optionally integrates with OpenAI's embedding API for semantic recall in decision and agent memory when explicitly configured.
Integrates with PyPI to fetch package versions, deprecations, and yanks for Python dependencies, supporting vulnerability scanning and upgrade planning.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@4da/mcp-serverwhat changes if I upgrade axum to 0.8.4?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@4da/mcp-server
Upgrade intelligence for AI coding agents. Before your agent bumps a dependency it learns what changes between the version you run and the one you want, which of your files that touches, and which vulnerabilities the move fixes, from your own lockfiles, on your machine. Plus vulnerability scanning at osv-scanner parity, ranked upgrade plans and decision memory. Zero config, no account.
You: "Upgrade axum to 0.8"
Agent → upgrade_impact { package: "axum", to_version: "0.8.4" }
axum 0.7.9 -> 0.8.4: 5 releases (0.8.2 yanked), changelog from the 0.8.4 crate.
12 breaking entries, 8 touch your code (Path, Query, Router, extract, serve):
breaking Remove OptionalFromRequestParts impl for `Query` (you use Query)
breaking Require `Sync` for all handlers added to `Router` (you use Router)
...
Your code: 10 files import axum.(Real output, abridged, run on this repository, 2026-10-02.)
One command to install. No API keys. No accounts. Your code never leaves your machine.
Install
Requires Node.js 22 or later.
The server uses Node's built-in node:sqlite (Node 22.13 and later), so it needs no install script and works with npm 12's default of blocking them. On Node 22.0-22.12 it uses the optional better-sqlite3, whose native module npm 10 and 11 build on install. npx @4da/mcp-server --doctor shows which one is in use.
claude mcp add 4da -- npx @4da/mcp-serverAs a Claude Code plugin (the MCP server plus a hook):
claude plugin marketplace add 4DA-Systems/4da-mcp-server
claude plugin install 4da@4daThe hook: when your agent edits a dependency's version in package.json, Cargo.toml, pyproject.toml, requirements.txt or go.mod, it is told which packages moved and given the exact dependency_check and upgrade_impact calls to make before it installs and builds. The hook is plain Node, contacts nothing, and stays silent for every other edit.
Add to ~/.cursor/mcp.json (Cursor), ~/.codeium/windsurf/mcp_config.json (Windsurf), or ~/.config/devin/mcp_config.json (Devin Desktop and Devin CLI; %APPDATA%devinmcp_config.json on Windows):
{
"mcpServers": {
"4da": {
"command": "npx",
"args": ["@4da/mcp-server"]
}
}
}Run MCP: Open User Configuration and add the entry, or edit the file directly: %APPDATA%CodeUsermcp.json (Windows), ~/Library/Application Support/Code/User/mcp.json (macOS), ~/.config/Code/User/mcp.json (Linux). VS Code uses servers, not mcpServers:
{
"servers": {
"4da": {
"type": "stdio",
"command": "npx",
"args": ["@4da/mcp-server"]
}
}
}Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"4da": {
"command": "npx",
"args": ["@4da/mcp-server"]
}
}
}npx @4da/mcp-server --setup --dry-run # show each file and entry, write nothing
npx @4da/mcp-server --setupWrites Cursor, VS Code (and Insiders), Windsurf, Devin Desktop and Claude Desktop configs it finds, merging into what is there: other servers, settings and comments are kept, a backup (.bak) is written first, and a file it cannot parse is left untouched with the entry to add by hand. For Claude Code it prints the claude mcp add command instead of editing ~/.claude.json.
Then ask your AI: "What changes if I upgrade X to Y?", "Scan for vulnerabilities" or "What should I upgrade first?"
Related MCP server: upgrade-pilot-mcp
How It Works
The server reads every lockfile of the project it is started in, including independently-locked projects below the root (a repo with src-tauri/Cargo.lock beside a root pnpm-lock.yaml is scanned whole) and skipping what .gitignore excludes: package-lock.json / npm-shrinkwrap.json, pnpm-lock.yaml (v5–v9), yarn.lock (v1 and berry), bun.lock, Cargo.lock (Cargo workspaces included), poetry.lock, uv.lock, pdm.lock, Pipfile.lock, requirements pins (*requirements*.txt, requirements/*.txt, with -r and -c), go.mod / go.sum (Go's build list), Gemfile.lock (RubyGems; git and path gems are local code, not releases) and composer.lock (Packagist). Every Python source in a folder is read, not only the first. Every installed copy is scanned, not one version per name, with the lockfile's own dev flags. It re-reads them whenever a lockfile changes, and for npm it also checks what node_modules actually holds. The walk goes 4 levels down and up to 256 projects; whatever it leaves out, and every manifest with no lockfile (its declared ranges are not installs and are not scanned), is listed in the answer's coverage block, never dropped silently. So are manifests of ecosystems it does not read (Maven pom.xml, Gradle, .NET *.csproj / packages.lock.json, Pub, Hex, SwiftPM, CocoaPods: coverage.not_covered), lockfiles that exist but cannot be read (merge-conflict markers, invalid JSON: coverage.unreadable_lockfiles), and lockfiles under test-fixture directories (tests/, test/, fixtures/, testdata/, __fixtures__/, conformance/ ...), which are not scanned as the project's own unless you pass include_test_fixtures: true (coverage.not_scanned).
An incomplete answer is never a clean one. When OSV.dev cannot answer for some dependencies (outage, HTTP error, timeout, the query budget), vulnerability_scan starts with summary: "NOT CHECKED: ... N of M dependencies have no vulnerability answer", counts them in coverage.unchecked_dependencies, and sets total_vulnerable_packages and by_severity to null (what the checked part found is under found_in_checked_dependencies); dependency_health withholds its score and vulnerable count, and upgrade_planner sets vulnerabilityDataAvailable: false. Large trees are queried in batches of 1,000 as OSV's budget allows, so a tree past 10,000 dependencies is answered in full.
Measured against osv-scanner on 19 public repositories (npm, pnpm v5-v9, yarn v1 and berry, bun, Cargo, Poetry, uv, Pipfile, requirements, Go; 2026-10-10), every difference settled by OSV's own API: precision 1.00 over 19,115 findings, recall 19,115 of 19,116 on the lockfiles it reads (Maven/Gradle are not read). Newly read requirement files were also checked against pip-audit.
OSV.dev for known vulnerabilities, matched to exact installed versions
npm registry, crates.io, PyPI, Go module proxy (registry.npmjs.org, crates.io and index.crates.io, pypi.org, proxy.golang.org) for versions, deprecations and yanks
npm download counts (api.npmjs.org), for
dependency_health's weekly-downloads figureThe package's own registry archive (registry.npmjs.org, static.crates.io, files.pythonhosted.org, proxy.golang.org) for the changelog
upgrade_impactreads; GitHub only if you opt in withFOURDA_GITHUB_CHANGELOG=true(below)npm full packument, the crates.io versions API, the PyPI JSON API and the Go proxy's version list for
dependency_check(publish times, yanks and retractions; on npm and crates.io also publishers, install scripts, per-version dependencies). These requests carry the package name only; the version you have installed is never sent to a registry, except that the Go proxy's list has no dates, so it is asked for the.infoof the versions being judged (the same requestgo getmakes). OSV.dev's advisory list for the package letsdependency_checkname the safe releases in a constraint. Packuments are cached on disk and revalidated withIf-None-Match; crates.io API reads are spaced one per second.Hacker News Algolia API (hn.algolia.com), only when you call
ecosystem_pulseGitHub (api.github.com, raw.githubusercontent.com), only with
FOURDA_GITHUB_CHANGELOG=trueYour embedding provider, only if you configure one for semantic recall (a local Ollama URL, or api.openai.com; see below)
Those are all the hosts the server contacts.
Results are cached (24h for registry data, 1h for vulnerabilities, 30min for news) and rate-limited per source.
What's sent over the network: package names and versions (the same data visible in your lockfile), and, only for ecosystem_pulse, the names of a few of your dependencies as search terms. No source code, no file paths, no personal data. The call-site scan of upgrade_impact runs locally. Set FOURDA_OFFLINE=true to disable all network calls.
GitHub release notes (opt-in, off by default). Many packages ship no changelog in their registry archive (vite, zod, cobra, most Go modules). With FOURDA_GITHUB_CHANGELOG=true in the server's environment, upgrade_impact reads the repository's GitHub releases when the archive has no changelog for the range (for PyPI, first a changelog file the project links on GitHub from its project_urls). GitHub then receives the repository name and the versions, nothing else. It uses the unauthenticated REST API (60 requests an hour) or GITHUB_TOKEN when set (5,000); a rate limit is reported with its reset time, never retried in a loop, and results are cached. With it off, an answer without a changelog says so and names the setting; nothing is guessed.
What's written to disk, and where: only files the server owns, in its folder in your user data directory (%LOCALAPPDATA%\4da-mcp, ~/Library/Application Support/4da-mcp or ~/.local/share/4da-mcp; FOURDA_MCP_HOME moves it): cache.db (registry, OSV and changelog responses; safe to delete) and standalone.db (without the desktop app: your project scan and the decisions, agent memory and feedback you record). Nothing is written inside your repository.
When the 4DA desktop app is installed, the server reads the app's database (4da.db) through a read-only connection and never creates or alters anything in it: no tables, no columns, no cache. The only writes are rows in the four app-owned tables the tools exist to fill, so the app sees them: decisions (decision_memory -> developer_decisions), agent memory (agent_memory), and feedback (record_feedback -> interactions and feedback, which the app's calibration reads). Those go through a separate write connection that waits briefly for the app's lock. If your app version lacks the table or a column a record needs, the record goes to standalone.db instead and the response says so in _meta. (Before 6.1 the server also created a live_cache table inside the app's database; it now keeps that cache in cache.db.)
Where configuration and the database come from: FOURDA_DB_PATH if set (a relative path resolves against the server's working directory and must name an existing file; an absolute path that names no file is created as a new standalone database when its directory exists, and the first tool answer says so in _meta.database_note; otherwise it is refused with an error), else the desktop app's database in its data directory, else the server's own standalone.db. Embedding settings come from FOURDA_SETTINGS_PATH, else the settings.json beside FOURDA_DB_PATH, else the desktop app's data directory. Nothing is picked up from the directory the server is started in: until 6.2.5 a data/settings.json or data/4da.db inside (or beside) the working directory was adopted, so a cloned repository could redirect semantic recall to a host of its choosing or plant "decisions".
The one exception: if you explicitly configure an OpenAI embedding provider (
FOURDA_EMBED_PROVIDER=openai) for semantic recall, the decision/memory text you store is sent to OpenAI to be embedded. The default — no embedding provider, or a local Ollama one — keeps everything on your machine, andFOURDA_OFFLINE=trueoverrides it regardless.
Ecosystems supported: npm, crates.io (Rust), PyPI (Python), Go; vulnerability_scan also reads RubyGems (Gemfile.lock) and Packagist (composer.lock). Maven, Gradle and .NET are not read, and are listed as not covered. upgrade_impact reads npm, crates.io, PyPI and Go. PyPI: versions and dates from the PyPI JSON API, the changelog from the release's sdist, and import sites matched on the module the distribution installs: read from your virtualenv's metadata (.venv, venv, env: top_level.txt or RECORD), else a table of well-known differences (PyYAML -> yaml, Pillow -> PIL), else the distribution name, which the answer then labels an assumption. Go: versions and dates from proxy.golang.org, the changelog from the module zip, and a major version 2+ reported as the module path change it is (github.com/jackc/pgx/v4 -> /v5), with the files that import the old path. dependency_check reads all four too; on PyPI and Go, where the registry exposes no publisher identity or install hooks, those signals say "not applicable".
Known limits, stated plainly: a requirements.txt without a lockfile names only your direct pins, so their transitive dependencies are not scanned (use uv lock, poetry lock or pip-compile). Many packages ship no changelog in their registry archive (fastembed, vite, zod among them); upgrade_impact then says so and gives the release-notes URL instead of guessing. Breaking entries are flagged from the changelog's headings and wording, and every entry carries the heading it sits under (under). Measured on a panel of 40 real upgrades across npm, crates.io, PyPI and Go (1,618 entries, gold from three blind raters with verbatim evidence; the panel and the measurement are in the test suite): on the 20 upgrades held out from rule-making, 95% of entries flagged breaking were breaking (95% CI 89-98%) and about 72% of breaking entries were flagged; Go release notes written as prose are the weakest (about 54% recall). Treat the flags as a pre-sort: read every entry of a major upgrade. Each answer says this in _meta.classification.
What You Can Ask
"What changes if I upgrade axum to 0.8?" -> upgrade_impact
"Check my dependency health" -> dependency_health
"Scan for vulnerabilities" -> vulnerability_scan
"Which deps should I upgrade first?" -> upgrade_planner
"Is it safe to bump axios to 1.14.1?" -> dependency_check
"Pin ws to a 7.x version" -> dependency_check (to: "7.x")
"I'm about to bump fastembed 5 -> 7" -> what_should_i_know
"What's happening in the ecosystem?" -> ecosystem_pulse
"What's my tech stack?" -> get_context
"Record a decision: we chose Postgres" -> decision_memory
"Does switching to MySQL align?" -> check_decision_alignment
"Remember: never use ORM for batch inserts" -> agent_memoryAll 16 Tools
Dependency Security
Tool | What it does |
| What changes between the installed and a target version of one dependency (npm, crates.io, PyPI, Go): releases in between, changelog entries classified breaking / deprecation / security, the breaking ones that touch your code (symbols you import, and route or pattern syntax in your string literals, e.g. axum 0.8's |
| Every installed copy in every lockfile matched against OSV.dev. Scope-adjusted severity, an upgrade target checked against every advisory of the package (the highest per-advisory fix can itself be affected by another), where each version is pinned, and a |
| Version freshness, deprecation (of the version you run) and vulnerability counts per dependency. |
| The smallest version no advisory affects for each vulnerable package, majors flagged (a 0.x minor counts as a major). Transitive fixes: |
| Call before writing any dependency version into a manifest: adding, pinning, upgrading, bumping, downgrading. |
Intelligence
Tool | What it does |
| Pre-task briefing built from the task: the dependencies it names (and the families it names: "all tauri plugins" adds the project's tauri-, tauri-plugin- and @tauri-apps/* packages; for "latest", whether each is already on the newest major), their versions and confirmed vulnerabilities, majors crossed, your recorded decisions, and a delegation verdict only confirmed evidence can raise. |
| Hacker News headlines that name your dependencies, then your languages (labelled as such). Fetched only when called. |
| Your tech stack, resolved dependency versions, interests, detected topics. |
| Scored content feed that passed the desktop app's relevance judge. |
| Judge-accepted feed items the app classified (advisories, breaking changes), plus your live vulnerabilities. |
| Dependencies with judge-accepted advisories or releases you have not looked at. |
| Save or dismiss items; recorded in the app's own feedback tables, which its calibration reads. |
Decisions & Memory
Tool | What it does |
| Record, query, and manage architectural decisions across sessions. |
| Verify if a proposed technology change aligns with recorded decisions. |
| Persistent memory that survives across sessions, agents, and editors. |
Identity
Tool | What it does |
| Your tech identity: primary stack, top dependencies, blind spots. |
* Requires the 4DA desktop app for full data.
Prompt: deps
A user-invoked workflow (shown as a slash command by hosts that surface MCP prompts). It tells the agent to run upgrade_planner, check every proposed bump with dependency_check, apply only proceed items in small batches with the project's own tests after each batch, stop and report every review / avoid / wait / unknown item with its evidence, and re-run vulnerability_scan at the end. Optional argument scope (e.g. security only).
Standalone vs. Full Mode
The MCP server works without the desktop app. It keeps a small local database in your user data folder (%LOCALAPPDATA%\4da-mcp, ~/Library/Application Support/4da-mcp or ~/.local/share/4da-mcp, never inside your repository) and scans your project on every start:
Capability | Standalone | With 4DA Desktop |
Upgrade impact (changelog, breaking changes, your call sites) | Yes | Yes |
Vulnerability scanning (OSV.dev) | Yes | Yes |
Dependency health (4 registries) | Yes | Yes |
Upgrade planner | Yes | Yes |
Pre-install dependency check | Yes | Yes |
Ecosystem news (Hacker News, on request) | Yes | Yes |
Pre-task intelligence briefing | Yes | Yes |
Tech stack detection + resolved versions | Yes | Yes |
Decision memory + alignment checking | Yes | Yes |
Agent memory (cross-session) | Yes | Yes |
Developer news judged against your stack (the app's feed) | -- | Yes |
Actionable signals + knowledge gaps | -- | Yes |
The analysis layer (Signal Chains, Knowledge Gaps, temporal analysis) | -- | Yes |
Download 4DA for the full experience.
Transports
stdio (default) -- works with all MCP hosts:
npx @4da/mcp-serverStreamable HTTP -- for remote or multi-client setups:
npx @4da/mcp-server --http --port 4840The HTTP transport binds to 127.0.0.1 by default and applies a Host-header
DNS rebinding guard to every request. Exposing it beyond this machine requires
a shared secret:
MCP_AUTH_SECRET=<same value as the relay's JWT_SECRET> \
MCP_ALLOWED_HOSTS=mcp.internal \
npx @4da/mcp-server --http --host 0.0.0.0Without MCP_AUTH_SECRET a non-loopback bind is refused at startup. With it,
every request must carry a Bearer token whose HMAC-SHA256 signature verifies
against that secret, and the token's role is enforced per tool (viewer is
read-only; member and admin may write). Put TLS in front of it.
HTTP mode is single-tenant. A token's team_id is verified but not used to
separate data: every authenticated client shares one database, one agent memory
and one set of decisions, and project_path lets any authenticated client scan
any directory on the host the server can read. Run one server per team (or per
trust boundary), and only behind clients you would give that access.
CLI Reference
npx @4da/mcp-server # Start server (stdio)
npx @4da/mcp-server --http # Start server (Streamable HTTP)
npx @4da/mcp-server --setup # Auto-configure your editors
npx @4da/mcp-server --doctor # Verify installation health
npx @4da/mcp-server --version # Print versionEnvironment Variables
Variable | Description | Default |
| Path to 4DA's SQLite database. An existing file is used. A relative path (resolved against the working directory) that names no file is refused. An absolute path that names no file is created as a standalone database if its directory exists (one stderr line and | The desktop app's database, else the server's own |
|
| Beside |
| Disable all network calls |
|
|
| Off |
| Used only with | Unset |
| Folder for the files the server writes ( | Your user data folder + |
| Shared secret for verifying Bearer tokens on | Unset |
| Require auth on a loopback |
|
| Extra comma-separated hostnames accepted in | localhost only |
FAQ
Does this send my code anywhere?
No. The server sends package names and versions to public APIs (OSV.dev, npm registry, crates.io, PyPI, Go proxy), downloads the target version's archive from the package's own registry for upgrade_impact (and reads GitHub release notes only if you set FOURDA_GITHUB_CHANGELOG=true), and, only when you call ecosystem_pulse, sends a few dependency names as search terms to HN Algolia. No source code, no file paths, no personal data: the call-site scan runs locally. Set FOURDA_OFFLINE=true to disable all network calls. (The sole exception is opt-in OpenAI embeddings — see the network note above.)
Do I need the 4DA desktop app? No. 11 tools work standalone: upgrade impact, pre-install dependency checks, vulnerability scanning, dependency health, upgrade planning, ecosystem news, pre-task briefings, project context, decision memory, alignment checking, and agent memory. The desktop app is where the same engine runs day to day: one worklist across every project on the machine, a morning Brief of what changed in your stack, and an Upgrade Plan. With it installed, your agent also gets 5 more tools: signals, knowledge gaps, developer news judged against your stack, Developer DNA and feedback.
Which AI tools does this work with? Any tool that supports MCP: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code (Copilot), and any custom MCP client.
Build from Source
git clone https://github.com/4DA-Systems/4da-mcp-server.git
cd 4da-mcp-server
pnpm install
pnpm build
pnpm test # offlineLicense
Apache License 2.0 (Apache-2.0). See LICENSE.
Built by 4DA
Available Tools
11 toolsagent_memoryAgent memoryA
Cross-agent persistent memory: what one agent learns, any agent can recall. Call to store a discovery, decision, or warning, or to recall prior context before starting work.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags to search for (for recall_by_tags) | |
| limit | No | Max results to return (default 20) | |
| query | No | Search term to match against subject and tags (for recall) | |
| since | No | ISO datetime to get memories after (for get_recent) | |
| action | Yes | Action to perform | |
| content | No | Full memory content (for store) | |
| subject | No | Short subject line for the memory (for store) | |
| agent_type | No | Agent identifier, e.g. claude_code, cursor, windsurf (for store) | |
| expires_at | No | ISO datetime when this memory expires (for store, optional) | |
| session_id | No | Session identifier (for store) | |
| memory_type | No | Type of memory (for store). Default: context | |
| context_tags | No | Tags for categorization (for store) | |
| filter_agent | No | Filter results to a specific agent type (for recall, get_recent) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnlyHint=false, destructiveHint=false, non-idempotent), and the description adds the genuinely useful behavioral trait that memories are persistent and shared across agents. It says nothing about expiry semantics, result volume, or what 'recall' returns, which the annotations do not cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, front-loaded with the defining capability followed by the usage instruction. The 'what one agent learns, any agent can recall' clause earns its place by conveying the cross-agent scope that is the tool's whole point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 13 parameters fully documented in the schema, no output schema, and annotations carrying safety hints, the description covers the essential read/write duality adequately. It is slightly thin on how the four actions differ in results and on the persistence/expiry model, but nothing critical to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and every parameter is already documented in the schema with per-action hints, so the baseline is 3. The description adds no parameter-level detail (e.g., interplay of query/tags/limit or action-specific parameter usage) beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (cross-agent persistent memory) and the two core verbs (store, recall), so an agent immediately knows this tool reads and writes shared memory. It does not, however, distinguish itself from closely related siblings such as decision_memory, get_context, or what_should_i_know, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete usage context on both sides: 'store a discovery, decision, or warning' and 'recall prior context before starting work.' That is clear when-to-use guidance, but it offers no exclusions or explicit routing to the sibling memory tools, so it does not reach 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_decision_alignmentDecision alignment checkARead-only
Check whether a technology or pattern aligns with the developer's recorded decisions. Call BEFORE suggesting a major tech change, new library, or architecture shift.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No | Architecture pattern to check (e.g., 'microservices', 'event-driven') | |
| technology | Yes | Technology name to check (e.g., 'postgresql', 'redis', 'graphql') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, so the safety profile is known. The description adds the behavioral guidance to call before changes, but doesn't disclose return format, rate limits, or what happens if no decisions are recorded. Adds some value beyond annotations but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences: first states what it does, second states when to use it. No wasted words, front-loaded purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only check with fully documented parameters and no output schema, the description covers purpose and timing. It could mention what the check returns (e.g., aligned/misaligned) or how to interpret results, but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with each parameter having a clear description and examples. The description itself adds no parameter details, so it meets the baseline 3 when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check) and resource (alignment with recorded decisions), and distinguishes itself from siblings like dependency_check and decision_memory by naming what it validates. It doesn't explicitly differentiate from decision_memory, which likely stores decisions, but the purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when to call: 'BEFORE suggesting a major tech change, new library, or architecture shift.' This is a clear pre-action trigger that no sibling provides.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decision_memoryDecision memoryA
Record, list, update, or supersede the developer's architectural and tech decisions. Call when the user makes, changes, or asks about a settled decision or convention.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Decision ID (for update) | |
| limit | No | Max results to return (for list) | |
| action | Yes | Action to perform | |
| new_id | No | ID of new decision that replaces old (for supersede) | |
| old_id | No | ID of decision to supersede (for supersede) | |
| pattern | No | Architecture pattern to check alongside the technology (check_alignment) | |
| subject | No | Subject of the decision (for record, check_alignment) | |
| decision | No | The decision text (for record) | |
| rationale | No | Why this decision was made (for record) | |
| confidence | No | Confidence level 0-1 (for record) | |
| new_status | No | Updated status (for update) | |
| technology | No | Technology to check alignment for (check_alignment) | |
| filter_type | No | Filter by decision type (for list) | |
| context_tags | No | Tags for categorization (for record) | |
| new_decision | No | Updated decision text (for update) | |
| decision_type | No | Type of decision (for record) | |
| filter_status | No | Filter by status: active, superseded, reconsidering (for list) | |
| new_rationale | No | Updated rationale (for update) | |
| new_confidence | No | Updated confidence (for update) | |
| alternatives_rejected | No | Alternatives that were considered and rejected (for record) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false and idempotentHint=false, so the mutation/idempotency profile is covered structurally. The description adds only the notion of 'supersede' (implying the prior decision is retained rather than deleted), but says nothing about persistence scope, permissions, or what happens to state on update/supersede beyond that inference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundancy: the first front-loads the action set and resource, the second front-loads the trigger condition. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 20-parameter, five-action tool this is thin. The description lists only four actions and omits check_alignment entirely, which is exactly where it collides with the sibling check_decision_alignment tool, and it gives no indication of what list/record returns (no output schema exists to compensate).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every one of the 20 parameters carries its own inline '(for <action>)' hint, so the schema does the heavy lifting. The description adds no per-parameter meaning beyond what the enum documentation already supplies, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names specific verbs (record, list, update, supersede) tied to a concrete resource (the developer's architectural and tech decisions), so the tool's function is unambiguous. It does not explicitly differentiate itself from the overlapping siblings check_decision_alignment or agent_memory, which keeps it out of 5 territory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
A clear triggering condition is given: 'Call when the user makes, changes, or asks about a settled decision or convention.' That covers the main invocation contexts, but there is no when-not guidance and no routing advice against the sibling check_decision_alignment tool even though this tool also exposes a check_alignment action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dependency_checkDependency checkARead-onlyIdempotent
Is a dependency version safe to write? Verdict on an exact version, or safe releases in a constraint ("7.x", "~=3.1"); npm, crates.io, PyPI, Go. Call BEFORE writing any version to a manifest: add, pin, upgrade, bump, downgrade.
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | The proposed changes to check, 1 to 25. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so safety is covered. The description adds genuinely new behavioral context: the tool returns either a single verdict (exact version) or a set of safe releases (constraint), which is important since there is no output schema. It does not clarify what "safe" means (security vs. compatibility vs. licensing) despite sibling vulnerability_scan implying overlap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The core purpose is front-loaded as a question, and the call-before-writing instruction is tight and actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly supplies the two return modes (verdict vs. safe releases in a constraint), which is the key missing structured information. The residual gap is the undefined meaning of "safe" and no failure/unknown-package behavior, but for a read-only advisory tool this is close to complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the one parameter and its nested fields (ecosystem, package, to, from) are fully documented in the schema. The description's constraint examples ("7.x", "~=3.1") and ecosystem list repeat the schema rather than extending it, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a concrete question that names the resource and the decision it supports ("Is a dependency version safe to write?"), and scopes it to an exact version or a constraint across npm/crates.io/PyPI/Go. The verb+resource are unambiguous, but it never distinguishes itself from close siblings like vulnerability_scan or dependency_health, so the agent cannot tell from the description alone which of the safety-oriented tools applies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger and timing: "Call BEFORE writing any version to a manifest: add, pin, upgrade, bump, downgrade." That is strong condition-setting, but it offers no when-not guidance and never names an alternative tool, so the sibling routing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dependency_healthDependency healthARead-only
Dependency version freshness, deprecation and CVE counts across npm/Rust/Python/Go. Call when the user asks whether their dependencies are outdated, stale or need updating.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max dependencies to return. Default: 50 | |
| sort_by | No | Sort order. 'risk' prioritizes vulnerable+deprecated+outdated. Default: risk | |
| include_dev | No | Include devDependencies. Default: false | |
| ecosystem_filter | No | Only show deps from this ecosystem. Default: all detected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and network-access profile is covered. The description adds that results span four ecosystems and include CVE/deprecation counts, but says nothing about pagination, cost, or freshness of the data source.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both earning their place: the first states scope and data covered, the second states the invocation trigger. Front-loaded and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of signalling the return content, which it does by naming freshness, deprecation and CVE counts. The only gap is return shape/pagination, minor for a read-only listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and all four parameters (limit, sort_by, include_dev, ecosystem_filter) are documented with defaults and enum meanings in the schema itself. The description adds no parameter-level detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete verb-less but specific resource: version freshness, deprecation and CVE counts across npm/Rust/Python/Go. An agent can tell it produces a dependency-health report. However, it does not distinguish itself from close siblings such as vulnerability_scan or dependency_check, leaving overlap ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear trigger: 'Call when the user asks whether their dependencies are outdated, stale or need updating.' This is explicit when-to-use guidance. It stops short of naming alternatives or when-not-to-use, so the agent must infer that vulnerability_scan handles deeper security work.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ecosystem_pulseEcosystem pulseARead-only
Recent Hacker News discussions that name a dependency or framework this project actually uses. Call when the user asks what is new or being discussed in their ecosystem.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum headlines to return. Default: 15 | |
| min_points | No | Minimum HN points to include. Default: 0 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the agent knows this is a safe, externally-sourced read. The description adds the meaningful constraint that results are limited to named dependencies the project uses, which is real behavioral context. It says nothing about recency window, ranking, or how the ecosystem is resolved, so a 3 is appropriate with annotations carrying the safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, and the scoping constraint is front-loaded before the usage trigger. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-param, no-required-argument read tool with annotations covering safety and no output schema, the description is essentially complete. The only unaddressed item is how 'the project's ecosystem' is determined, which is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: limit and min_points are both documented with defaults in the schema. The description adds no parameter detail beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb+resource: it surfaces recent Hacker News discussions, filtered to dependencies or frameworks the project actually uses. That scoping constraint ('actually uses') is the distinguishing feature and is stated plainly. It stops short of naming which sibling to prefer for adjacent questions (e.g. what_should_i_know), so it is clear but not fully sibling-differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger: 'Call when the user asks what is new or being discussed in their ecosystem.' That is a clear use context. There is no when-not guidance or named alternative for overlapping questions like general project news, which keeps it below a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_contextUser contextARead-only
What 4DA knows about the user: role, tech stack, interests, exclusions, and detected project context. Call FIRST when you need to know what the user works on before answering or recommending.
| Name | Required | Description | Default |
|---|---|---|---|
| include_ace | No | Include ACE-detected context (detected tech, active topics). Default: true | |
| include_learned | No | Include the retained learned-preferences compatibility field. Default: true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety and scope are covered. The description adds the useful detail of what the payload contains (role, stack, interests, exclusions, project context), which matters because there is no output schema, but it says nothing about freshness, caching, or empty-result behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no waste. The content listing comes first and the invocation guidance second, which is the right front-loading for a tool meant to be called early.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with two optional boolean flags, the description covers purpose, contents, and invocation timing, and the absence of an output schema is offset by the enumeration of returned context categories. Minor gaps remain around what happens when context is missing for a new user.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (include_ace, include_learned) are documented with defaults in the schema. The description never mentions either toggle, so it adds no meaning beyond the structured fields; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (the user context that 4DA holds) and enumerates its contents: role, tech stack, interests, exclusions, detected project context. It is clear what the tool returns, but it does not distinguish itself from siblings such as what_should_i_know or agent_memory, which also surface user-relevant knowledge.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger and priority: 'Call FIRST when you need to know what the user works on before answering or recommending.' That tells the agent both when to reach for it and that it should precede other calls. It stops short of naming an alternative or a when-not-to-use condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upgrade_impactUpgrade impactARead-only
What changes between the installed version of ONE dependency and a target: changelog per release, breaking changes, deprecations, security fixes, and this project's files that import it. Call before upgrading or bumping a dependency.
| Name | Required | Description | Default |
|---|---|---|---|
| package | Yes | Package name exactly as published (npm: `zod`, `@scope/pkg`; crates.io: `fastembed`; PyPI: the distribution, `PyYAML`; Go: the module path, `github.com/jackc/pgx/v5`). | |
| ecosystem | No | Registry. Default: inferred from the project's dependencies (required when the name exists in more than one). | |
| to_version | No | Target version. Default: the highest stable version on the registry. | |
| from_version | No | Current version. Default: the version this project's lockfile resolves. | |
| response_format | No | concise (default): every breaking/deprecation/security entry plus up to 3 others per version. detailed: all entries, capped at 400. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and external-registry profile is covered. The description adds the multi-source nature of the result (changelog plus project-local import scan), which is useful. It does not, however, disclose cost, latency, or rate-limit behavior despite hitting a registry and indexing the codebase.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the scope and the exact output contents, then the call trigger. No filler and nothing redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, open-world tool with a fully described five-parameter schema and no output schema, this covers what the tool returns and when to invoke it. A small gap remains around cost/latency and how the from_version/to_version defaults interact when the lockfile is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: every parameter including the package-name format conventions, the ecosystem enum, the version defaults, and the concise/detailed response format is documented in the schema. The description adds no semantics beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (report what changes) on a specific resource (one dependency between installed and target version) and enumerates the exact payload: changelog per release, breaking changes, deprecations, security fixes, and the project's own importing files. That enumeration distinguishes it from siblings like dependency_check and upgrade_planner.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger: 'Call before upgrading or bumping a dependency.' That is clear context, but it names no alternative, so an agent cannot tell from this text whether upgrade_planner or vulnerability_scan is the better fit for a given situation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upgrade_plannerUpgrade plannerARead-only
Prioritized upgrade plan for one project (project_path): the 4DA app's work order when computed (per-line targets, manifest vs lockfile fix), else the smallest version that fixes each vulnerability. Call when the user asks what to upgrade.
| Name | Required | Description | Default |
|---|---|---|---|
| package | No | Plan for this one package only (exact name, any ecosystem). Default: every dependency. | |
| include_dev | No | Include devDependencies. Default: false | |
| project_path | No | Project directory to plan for: the app's plan is narrowed to the steps (and installed lines) that touch it; the standalone plan resolves that project's lockfiles. "*" for every project the app tracks. Default: the project the server was started in, when that directory is a project. | |
| risk_threshold | No | Only show upgrades at or above this risk level. Default: all | |
| max_recommendations | No | Max recommendations to return. Default: 20 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=true, openWorldHint=true), so the bar is lower. The description adds meaningful behavior beyond them: it discloses two operating modes — the app-level 'work order' with per-line targets and manifest-vs-lockfile fixes when available, falling back to the smallest fixing version otherwise. It omits any note on cost, latency, or scope limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose, parameter anchor, and trigger are front-loaded in two compact sentences with little waste. The dense parenthetical ('per-line targets, manifest vs lockfile fix') is efficient though heavily jargon-laden for a reader without '4DA' context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining returns; it sketches the shape (per-line targets, minimal fixing versions) but through unexplained jargon, and never clarifies how this plan relates to upgrade_impact or vulnerability_scan. For a five-parameter planning tool it is adequate but leaves real gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with five parameters, so the baseline is 3. The description reinforces project_path's singular scope and the app-vs-standalone plan mode, but that mode distinction is already documented in the project_path schema text, so it largely repeats rather than extends the structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening clause states a specific verb+resource ('Prioritized upgrade plan for one project'), which is clear enough to separate it from siblings like upgrade_impact or vulnerability_scan. However, the elaboration ('the 4DA app's work order') leans on unexplained internal jargon rather than describing the tool's distinct role relative to those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Call when the user asks what to upgrade' is an explicit, actionable trigger that tells the agent exactly when to reach for this tool. It stops short of naming when-not conditions or pointing to upgrade_impact/vulnerability_scan as alternatives, so it is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vulnerability_scanVulnerability scanARead-only
Scan this project's lockfiles (npm/pnpm/yarn/bun, Cargo, Python, Go) for OSV.dev vulnerabilities in installed versions, transitives included, with fix versions and where each is pinned; package for one dep. Call when asked about security or CVEs. To vet a version first: dependency_check.
| Name | Required | Description | Default |
|---|---|---|---|
| package | No | Only this package (any ecosystem, every installed copy, transitives included), with a `package_note` saying what the lockfiles hold for it. Use it to ask about one dependency instead of reading the whole report. | |
| include_dev | No | Include direct devDependencies (labelled `is_dev`, graded one level down). Default: true, as the 4DA app does; pass false for runtime dependencies only. Transitive dev/runtime scope may be unknown. | |
| project_path | No | Project directory to scan. Default: current working directory. | |
| force_refresh | No | Ignore the OSV advisory cache and fetch fresh advisory data from OSV.dev (dependency versions are re-read on every lockfile change regardless). Default: false. | |
| response_format | No | concise (default): one row per vulnerable package version (worst severity, the version that fixes all its advisories, advisory count and first ids, where it is pinned), the 40 most severe and 25 recommendations, with counts of anything left out. detailed: one row per advisory with references, plus platform-inactive advisories, maintenance notices, install drift and resolution provenance. | |
| severity_filter | No | Only show vulnerabilities whose presented severity is at or above this level. | |
| include_test_fixtures | No | Also scan lockfiles under test-fixture directories (tests/, test/, fixtures/, testdata/, __fixtures__/, conformance/ ...). Default: false; they are counted under coverage.not_scanned instead. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety and network egress are covered. The description adds real context beyond them: it scans lockfiles rather than source, includes transitives, reports fix versions and pin locations, and queries OSV.dev for advisory data. It stops short of describing report size/limits, which is left to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the scan scope and ecosystems, then the trigger and the alternative in two short sentences. The opening clause is semicolon-dense but every clause (ecosystems, transitives, fix versions, pin locations) earns its place; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully summarizes what the report contains (fix versions, where each is pinned) and that transitives are included, complementing a fully documented 7-parameter schema. It omits mention of caching/refresh and report truncation behavior, but those are covered by the schema's own parameter docs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already carries the semantics of all seven parameters. The description only echoes the `package` scoping behavior and alludes to fix/pin output; it adds no syntax, format, or default information the schema does not already provide. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (scan), resource (this project's lockfiles), the ecosystems covered (npm/pnpm/yarn/bun, Cargo, Python, Go), and the data source (OSV.dev). It also carves out the single-package variant (`package`) and names the sibling it is not (dependency_check), so an agent can separate it from alternatives without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ("Call when asked about security or CVEs") and an explicit routing rule to an alternative with its condition ("To vet a version first: dependency_check"). It also directs single-dependency questions to the `package` parameter rather than a full report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
what_should_i_knowPre-task briefingARead-only
Pre-task briefing for a task in one project: the dependencies and package families it names, installed versions, confirmed vulnerabilities, releases since, your decisions, a delegation verdict. Call BEFORE a non-trivial task, especially one that changes dependencies.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | What you are about to do, naming packages and versions where you know them (e.g. "upgrade fastembed from 5 to 7"). | |
| files | No | File paths involved in the task (optional). Manifest and source paths help find the packages involved. | |
| project_path | No | Project directory the task is about; its lockfiles decide which packages exist. Default: the project the server was started in. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=true, openWorldHint=true), and the description adds what the agent actually receives — a bundled brief with installed versions, confirmed vulnerabilities, releases since, prior decisions, and a delegation verdict. Since there is no output schema, this enumeration of return contents is valuable behavioral disclosure beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The output contents are front-loaded in the first sentence and the usage call-to-action follows immediately. It is dense but every clause maps to a real behavior; only the long comma list slightly pressures readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only aggregator with no output schema, the description supplies what the agent needs: the bundled content, the ideal invocation timing, and the fact that lockfiles/project context determine scope. Nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented in the schema. The description adds only a light hint about the task content ('the dependencies and package families it names'), which is essentially restating what the schema already says. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete deliverable (a pre-task briefing) and enumerates its contents — dependencies, installed versions, vulnerabilities, releases since, decisions, a delegation verdict. This clearly separates it from single-purpose siblings like vulnerability_scan or dependency_health, though it never names a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear trigger: 'Call BEFORE a non-trivial task, especially one that changes dependencies.' That is actionable timing guidance. However, with 11 siblings there is no when-not guidance and no named alternatives (e.g., call vulnerability_scan instead when you only need CVEs).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v6.0.3- Changed
dependency_check3 fields changed- changed
Input schema / properties / items / items / properties / ecosystem / enumPrevious value: -[ - "npm", - "crates.io" -]New value: +[ + "npm", + "crates.io", + "PyPI", + "Go" +] - changed
Input schema / properties / items / items / properties / package / descriptionPrevious value: -"Package name exactly as published (e.g. \"axios\", \"@scope/pkg\", \"serde_json\")."New value: +"Package name exactly as published (\"axios\", \"@scope/pkg\", \"serde_json\", \"Jinja2\", \"golang.org/x/net\", \"github.com/labstack/echo/v4\")." - changed
Input schema / properties / items / items / properties / to / descriptionPrevious value: -"Exact version you intend to install (e.g. \"1.14.1\"), or \"latest\" for the newest stable release; not a range."New value: +"The version you intend to write (\"7.5.10\", \"3.1.4\", \"v0.23.0\"), \"latest\", or the constraint it must satisfy (\"7.x\", \"^1.20\", \"=0.17\", \"~=3.1\", \">=2,<3\", \"v1\") to get the safe releases in it."
- Changed
upgrade_impact3 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Registry. Default: inferred from the project's dependencies (required when the name exists in both)."New value: +"Registry. Default: inferred from the project's dependencies (required when the name exists in more than one)." - changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "crates.io" -]New value: +[ + "npm", + "crates.io", + "PyPI", + "Go" +] - changed
Input schema / properties / package / descriptionPrevious value: -"Package name exactly as published (npm: `zod`, `@scope/pkg`; crates.io: `fastembed`)."New value: +"Package name exactly as published (npm: `zod`, `@scope/pkg`; crates.io: `fastembed`; PyPI: the distribution, `PyYAML`; Go: the module path, `github.com/jackc/pgx/v5`)."
- Changed
vulnerability_scan2 fields changed- changed
Input schema / properties / include_dev / descriptionPrevious value: -"Include known direct devDependencies. Transitive dev/runtime scope may be unknown. Default: false."New value: +"Include direct devDependencies (labelled `is_dev`, graded one level down). Default: true, as the 4DA app does; pass false for runtime dependencies only. Transitive dev/runtime scope may be unknown." - added
Input schema / properties / include_test_fixturesAdded value: +{ + "description": "Also scan lockfiles under test-fixture directories (tests/, test/, fixtures/, testdata/, __fixtures__/, conformance/ ...). Default: false; they are counted under coverage.not_scanned instead.", + "type": "boolean" +}
2 tool updates
v6.0.2- Changed
upgrade_planner1 field changed- added
Input schema / properties / project_pathAdded value: +{ + "description": "Project directory to plan for: the app's plan is narrowed to the steps (and installed lines) that touch it; the standalone plan resolves that project's lockfiles. \"*\" for every project the app tracks. Default: the project the server was started in, when that directory is a project.", + "type": "string" +}
- Changed
what_should_i_know1 field changed- added
Input schema / properties / project_pathAdded value: +{ + "description": "Project directory the task is about; its lockfiles decide which packages exist. Default: the project the server was started in.", + "type": "string" +}
11 tool updates
v6.0.1- First observed
agent_memory - First observed
check_decision_alignment - First observed
decision_memory - First observed
dependency_check - First observed
dependency_health - First observed
ecosystem_pulse - First observed
get_context - First observed
upgrade_impact - First observed
upgrade_planner - First observed
vulnerability_scan - First observed
what_should_i_know
TDQS
Scored across 11 tools
Several tools overlap in purpose: vulnerability_scan, dependency_health, and dependency_check all report vulnerabilities/CVE status, upgrade_impact and upgrade_planner both concern upgrades, and get_context vs what_should_i_know vs check_decision_alignment all answer 'what do I know about this project/user.' The detailed 'call BEFORE' triggers in descriptions mitigate the confusion, but an agent still faces multiple plausible choices for a security or upgrade question.
All names use snake_case consistently. Verb styles vary (verb_noun like check_decision_alignment, bare verbs like vulnerability_scan, pure nouns like dependency_health, and a phrase like what_should_i_know), which is readable but not a single predictable pattern.
11 tools is a reasonable scope for a dependency/context advisor, and each maps to a distinct workflow stage. The set is slightly padded by overlapping advisory tools (what_should_i_know vs get_context) but nothing is gratuitous.
Coverage is broad: decisions (record/list/update/supersede), memory (store/recall), vulnerability scanning, version safety checks, upgrade impact and planning, and ecosystem news. Gaps are minor—no explicit tool to enumerate projects or export/clear memory—but core lifecycle workflows are covered.
Maintenance
Related MCP Connectors
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Related MCP Servers
- AlicenseAqualityAmaintenanceDependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.9394 npm2Apache 2.0
- AlicenseBqualityDmaintenanceEnables AI agents to safely upgrade JavaScript and TypeScript projects through dependency analysis, upgrade path detection, breaking change identification, codemod application, and PR summary generation.148 npmMIT
- AlicenseNot gradedqualityAmaintenanceProvides a dependency graph of any local repository with tools for change impact, transitive dependents, health audits, and more, enabling AI coding agents to see structure and refactor safely.4,912 npm4MIT
- AlicenseNot gradedqualityAmaintenanceEnables autonomous AI agents and CI/CD runners to discover repository modules, scan outdated dependencies, fetch version histories, and apply verified dependency updates with major-version safety guardrails across polyglot monorepos.25 npmMIT