Skip to main content
Glama
danduh

MCP Security Server

by danduh

MCP Security Server

This is a Model Context Protocol (MCP) server that provides file operations, npm package management, and configuration checking capabilities.

Available Tools

File Operations

  1. count_lines_in_file - Count lines in a text file and return metadata

  2. write_to_file - Write content to a file with append/overwrite modes

  3. read_file_content - Read file content with encoding options

NPM Package Management

  1. check_outdated_packages - Check for outdated npm packages

  2. analyze_package_security - Run npm security audit

  3. check_npm_version - Check npm installation and version

Configuration Management

  1. check_npmrc_config - Check local and global .npmrc files

  2. check_npm_global_config - Check global npm configuration

  3. verify_registry_config - Verify npm registry configuration

  4. check_npm_cache - Check npm cache information

Related MCP server: Local File Management MCP Server

Installation

  1. Clone or create the project

  2. Install dependencies: npm install

  3. Build the project: npm run build

  4. Run the server: npm start or npm run dev

Usage

The server communicates via the Model Context Protocol (MCP) over stdio. It can be integrated with MCP-compatible clients.

Example Tool Usage

Count lines in a file

{
  "name": "count_lines_in_file",
  "arguments": {
    "file_path": "/path/to/file.txt"
  }
}

Check outdated packages

{
  "name": "check_outdated_packages",
  "arguments": {
    "include_dev": true
  }
}

Write to file

{
  "name": "write_to_file",
  "arguments": {
    "file_path": "/path/to/output.txt",
    "content": "Hello, World!",
    "mode": "overwrite"
  }
}

Security Features

  • Path traversal protection

  • File size limits

  • Input validation

  • Error handling

  • Safe npm command execution

Development

  • npm run dev - Run in development mode with tsx

  • npm run build - Build TypeScript to JavaScript

  • npm start - Run the built server

License

ISC

Available Tools

10 tools
analyze_package_securityB

Run npm security audit to find vulnerabilities in dependencies

ParametersJSON Schema
NameRequiredDescriptionDefault
audit_levelNoMinimum severity level to reportlow
package_pathNoPath to package.json or directory containing it (optional, defaults to current directory)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It states it runs an audit but does not reveal whether it is read-only, whether it requires network access, or what side effects might occur. The agent cannot infer if this operation modifies anything or if it might fail under certain conditions. This is a significant gap for a security scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that directly states the action and purpose. There is no redundancy or filler; every word contributes to understanding. It is optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and the absence of an output schema and annotations, the description is incomplete. It does not explain what the agent will receive (e.g., a list of vulnerabilities, summary counts), nor does it mention potential failure modes (e.g., missing package.json). This leaves the agent uncertain about the tool's outcome and prerequisites.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for both parameters, with clear explanations for audit_level and package_path. The description does not add any additional parameter context, but since the schema already documents them fully, the baseline of 3 is appropriate. No extra semantics are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs an npm security audit to find vulnerabilities in dependencies. It uses a specific verb and resource, and it is easily distinguished from sibling tools like check_npmrc_config or check_outdated_packages, which deal with configuration or version checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for security auditing but does not explicitly mention when to prefer it over alternatives. There is no guidance on exclusions or conditions, such as 'use this instead of check_outdated_packages for vulnerability scanning'. It only provides the basic purpose, so usage guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_npm_cacheA

Check npm cache location and verify cache integrity

ParametersJSON Schema
NameRequiredDescriptionDefault
verify_cacheNoRun cache verification (can be slow)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It states the core action and the optional verification behavior, and the schema parameter notes that verification can be slow. However, it does not disclose whether verification might modify the cache, purge entries, or what exactly 'verify cache integrity' entails beyond being slow.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the main purpose and includes the secondary verification behavior. There is no filler, repetition, or unnecessary detail. It earns its place and communicates the tool's scope efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and no output schema, the description covers the main behaviors reasonably well. It could be more complete by indicating what kind of result is returned, but given the simplicity of the operation and the schema's parameter documentation, the overall context is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter-level meaning beyond the input schema, which has 100% coverage. The schema already documents verify_cache as 'Run cache verification (can be slow)' and provides a default. The description's phrase 'verify cache integrity' aligns with the parameter but does not add new semantic detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('check') and resource ('npm cache') and includes a second concrete action ('verify cache integrity'). It clearly distinguishes itself from sibling tools like check_npmrc_config and check_npm_version by focusing on the cache rather than configuration or version.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is provided, and no alternative tool is named. The usage context is implied by the tool name and description: use this when you need the npm cache location or want to verify cache integrity. However, the description does not help an agent choose among the many npm-related sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_npm_global_configC

Check global npm configuration settings

ParametersJSON Schema
NameRequiredDescriptionDefault
config_keyNoSpecific config key to check (optional, returns all if not specified)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It implies a read-only check but does not explicitly state that no modifications occur, nor does it mention authentication needs, output format, or error behavior. The optional parameter's 'returns all' detail is in the schema, not the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundancy. It is appropriately short for a simple tool, though it lacks any structural emphasis or front-loaded key details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description is too minimal. It does not explain what output to expect, how to interpret results, or any side effects. The single line leaves significant gaps for an agent deciding how to invoke and process the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter is fully documented in the schema. The description adds no extra meaning beyond what the schema provides, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb ('Check') and resource ('global npm configuration settings'), making the tool's purpose understandable. However, it does not distinguish it from sibling tools like check_npmrc_config or verify_registry_config, so it lacks explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. No mention of prerequisites, typical scenarios, or exclusions. The description provides no context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_npmrc_configC

Check local and global .npmrc configuration files

ParametersJSON Schema
NameRequiredDescriptionDefault
config_pathNoPath to specific .npmrc file (optional, will check standard locations)
include_globalNoInclude global .npmrc file in the check

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only says 'Check', which implies read-only behavior, but it does not explicitly state that it is non-destructive, what output format to expect, whether it accesses the network, or what happens with missing files. This is minimal disclosure for a tool that an agent must invoke safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler or redundancy. It is front-loaded with the core action and resource. However, it is so terse that it omits valuable information, but that is a completeness issue rather than a conciseness flaw. For what it does include, it is efficiently written.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description must explain what the agent will receive and what side effects may occur. It does neither. It also fails to clarify how the optional parameters interact (e.g., if config_path is provided, does include_global still apply?) or how this differs from 'check_npm_global_config'. For a tool with only two optional parameters, the description is too sparse to be considered complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage: both 'config_path' and 'include_global' have clear descriptions in the schema. The tool description itself adds no additional parameter context, so the baseline of 3 applies because the schema already explains the parameters. No extra meaning is contributed beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the verb 'Check' and the resource '.npmrc configuration files', making the core purpose clear. It also mentions 'local and global' which hints at scope, but does not explicitly differentiate from the sibling tool 'check_npm_global_config'. The word 'check' is somewhat vague—could mean display, validate, or list—but it is specific enough to indicate a read operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the closely related sibling 'check_npm_global_config'. The description implies it covers both local and global files, but does not state exclusions (e.g., when to use the global-only variant) or conditions that would make this tool the preferred choice. No alternative tools are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_npm_versionB

Check npm version and basic installation info

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only says 'Check', implying a read-only operation, but does not disclose what output to expect, whether network access is needed, or what 'basic installation info' entails. This is minimal behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant wording. It is front-loaded with the main action and resource, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description is the only source of context. It vaguely states 'check npm version and basic installation info' but does not specify the return format, the nature of the installation info, or any expected behavior. This is incomplete for an agent to know what it will receive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema is empty, so the description need not explain any parameters. According to the baseline for 0 params, a score of 4 is appropriate since there is nothing to add beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Check' and the resource 'npm version', adding 'basic installation info' to indicate scope. However, it does not differentiate from sibling tools like check_npmrc_config or check_npm_global_config, which are also npm-related checks, so it's clear but not uniquely distinguishing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. It does not mention exclusions, prerequisites, or when a different tool would be more appropriate. The agent is left without context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_outdated_packagesA

Check for outdated npm packages and show current vs latest versions

ParametersJSON Schema
NameRequiredDescriptionDefault
include_devNoInclude development dependencies in the check
package_pathNoPath to package.json or directory containing it (optional, defaults to current directory)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden of behavioral disclosure. It states the tool 'shows current vs latest versions', implying a read-only operation, but does not explicitly confirm it does not modify files, does not mention network access requirements, or potential failure modes. It discloses the output nature but leaves out safety and side-effect details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no filler or redundant information. It front-loads the primary action ('check for outdated npm packages') and the output ('show current vs latest versions'), making it easy for an agent to quickly parse the tool's purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with two optional parameters and no output schema, the description provides sufficient context. It implies the output format (current vs latest) and default behavior via the schema. It lacks explicit handling of edge cases (e.g., missing package.json) or detailed return structure, but given the tool's simplicity, these are minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers both parameters (include_dev and package_path) with descriptions, achieving 100% coverage. The description itself does not add any parameter-specific meaning beyond what the schema already provides, so the baseline of 3 applies. It does not explain the impact of include_dev or how package_path is resolved beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb (check) and resource (outdated npm packages), and indicates the output (show current vs latest versions). It distinguishes itself from siblings like check_npm_version (which checks npm version) and analyze_package_security (security analysis), leaving no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking outdated packages but does not explicitly state when to use this tool over siblings, nor does it mention exclusions or prerequisites. For example, it does not say 'use this when you want to update dependencies' or 'use check_npm_version for npm CLI version'. The purpose is clear, but there is no explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

count_lines_in_fileB

Count the number of lines in a text file and return file metadata

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYesPath to the file to count lines in

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. The verb 'Count' and 'return' imply a read-only operation, which is a useful behavioral signal, but it does not explicitly state that the file is not modified or describe what 'file metadata' includes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, directly worded sentence with no fluff or repetition. The action is front-loaded, making it immediately clear what the tool does.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should explain what the tool returns, but it only vaguely mentions 'file metadata'. There is no indication of line-count handling details, error behavior, or whether the metadata includes fields like file size or modification time.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the single file_path parameter. The description adds no additional semantic detail beyond what the schema provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Count') and resource ('number of lines in a text file'), and adds that it returns file metadata. This clearly identifies what the tool does, and it is distinguishable from siblings like write_to_file, though it does not explicitly contrast itself with read_file_content.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as read_file_content. There is no mention of scenarios like 'when you only need a line count' or exclusions for binary files or large files.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_file_contentC

Read the content of a file with optional encoding

ParametersJSON Schema
NameRequiredDescriptionDefault
encodingNoFile encodingutf8
max_sizeNoMaximum file size to read in bytes (default: 1MB)
file_pathYesPath to the file to read

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only says 'Read the content' – implying a safe read, but it does not state that reading is limited by max_size, how large files are handled, what happens on missing files, or the return format. For a tool with no annotations, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, short sentence with no filler words. It is front-loaded and easy to scan. However, it is so brief that it omits valuable behavioral details, so it earns a 4 rather than a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple file-reading tool, the schema documents parameters and the description states the core purpose. Yet, given there is no output schema and no annotations, the description should at least hint at return semantics or limitations (e.g., 'returns file contents as a string'). The current description is minimally adequate but leaves room for ambiguity about edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage; all three parameters (file_path, encoding, max_size) are described in the schema. The description adds 'optional encoding' but that is redundant with the schema's default. Since the schema already explains parameters, the description's contribution is minimal, meeting the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb ('Read') and resource ('content of a file'), and mentions optional encoding. It is unambiguous, but it does not distinguish from sibling tools like count_lines_in_file, which also reads a file (to count lines). Without naming the sibling, an agent could confuse the two.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of exclusions (e.g., 'use count_lines_in_file when you only need line counts') or prerequisites (e.g., file existence, permissions). The description leaves all selection reasoning to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_registry_configC

Verify npm registry configuration and accessibility

ParametersJSON Schema
NameRequiredDescriptionDefault
check_authNoCheck authentication status with the registry
registry_urlNoSpecific registry URL to check (optional, uses configured registry)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. 'Verify' implies a read-only check, but it doesn't explain whether network calls are made, whether auth status is checked (despite the check_auth parameter), what the return format is, or what 'accessibility' means operationally. This leaves significant ambiguity for the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no filler. The core function is front-loaded, and every word earns its place. It is appropriately sized for a simple verification tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is too sparse to fully equip an agent. It doesn't explain what 'verify' entails (e.g., does it return a boolean, a report, or throw errors?), what happens when registry_url is provided, or how check_auth affects behavior. Since there is no output schema and no annotations, the description must cover these details but does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters with descriptions for both check_auth and registry_url, so the baseline is 3. The tool description adds no additional semantic context about these parameters, but the schema already explains their purpose adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb 'verify' with the resource 'npm registry configuration and accessibility' clearly states the tool's function. It distinguishes itself from siblings like check_npmrc_config and check_npm_global_config by focusing on registry-level verification rather than specific config files, though it doesn't explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus siblings such as check_npmrc_config or check_npm_global_config. It states only what it does, not when it is appropriate, leaving the agent to infer the context from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_to_fileB

Write content to a file with optional append mode

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoWrite mode: append to existing file or overwriteoverwrite
contentYesContent to write to the file
encodingNoFile encodingutf8
file_pathYesPath to the file to write to

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only mentions append vs. overwrite mode, but does not disclose whether the tool creates missing files, how it handles existing files, error behavior, or what the return value indicates. For a mutating filesystem operation, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every word contributes to the core purpose, and the append mode detail is placed prominently. This is an exemplar of concise specification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema and no annotations, the description should explain behavior such as whether the file is created if absent, whether overwrite is the default, and what the tool returns on success or failure. None of this is present, leaving an agent with critical missing context for a file-mutation operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters, including mode and encoding enums with defaults. The description only reinforces the mode parameter by mentioning append mode, adding no new meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (write) and resource (file), and mentions the optional append mode, which conveys that the default is overwrite. It is specific enough to distinguish from read/analysis siblings, though it does not explicitly name an alternative write tool (there is none in the sibling list).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for writing to files but provides no explicit guidance on when to use this tool versus alternatives, nor any exclusions. Since all siblings are read/analysis tools, the use case is obvious, but the description leaves that inference entirely to the agent without stating it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv1.0.0
    • First observedanalyze_package_security
    • First observedcheck_npm_cache
    • First observedcheck_npm_global_config
    • First observedcheck_npm_version
    • First observedcheck_npmrc_config
    • First observedcheck_outdated_packages
    • First observedcount_lines_in_file
    • First observedread_file_content
    • First observedverify_registry_config
    • First observedwrite_to_file

TDQS

B3.3/5.0

Scored across 10 tools

Disambiguation3/5

Most npm tools are distinguishable by target (audit, cache, registry, outdated, version), but check_npmrc_config and check_npm_global_config clearly overlap, and the three generic file tools don't fit the security theme. An agent could easily pick the wrong config-checking tool.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (check_*, verify_*, analyze_*, read_*, write_*, count_*). Minor semantic overlap aside, the naming convention is predictable and readable.

Tool Count4/5

Ten tools is a reasonable count and not padded to excess. However, count_lines_in_file, write_to_file, and read_file_content appear unrelated to the security purpose, so not every tool clearly earns its place.

Completeness3/5

The core npm security surface is decently covered: audit, outdated packages, config, registry, cache, and version. But there are no remediation or deeper analysis actions such as npm audit fix, vulnerability details, or dependency graph inspection, and the file tools don't fill that gap.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables execution of shell commands through a terminal tool with working directory support and timeout protection. Also provides access to MCP documentation as a resource.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables file system operations such as listing, reading, and creating files within a scoped local project directory. It provides a secure way to manage local files through standardized MCP tools built with FastMCP.
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables file system operations such as listing directories, reading, writing, creating, and deleting files or directories through MCP.
    10 npm
    MIT