Skip to main content
Glama

Vigia — what breaks when you upgrade, before your agent writes the code

Vigia is a free, open data service (REST API + MCP server) that gives AI coding agents and developers verified, dated facts about the state of npm, PyPI and Rust (crates.io) packages — the things language models get wrong because their training data is out of date.

🌐 https://vigia.coredls.cloud · MCP: https://vigia.coredls.cloud/mcp · Registry: cloud.coredls.vigia/vigia

claude mcp add --transport http vigia https://vigia.coredls.cloud/mcp

Or install it as a Claude Code plugin, which bundles the MCP server and a skill that tells the agent when to use it:

/plugin marketplace add MatiasDelosSantos/vigia
/plugin install vigia@vigia

Other agents can use the skill directly: skills/vigia/SKILL.md (also served at https://vigia.coredls.cloud/skill.md).

One-click install: Cursor · VS Code

Why

Models freeze at their training cutoff; ecosystems ship thousands of releases a day. Agents confidently write code against APIs that changed. Example — Next.js 14 → 15, detected automatically from the packages' TypeScript types:

GET /v1/packages/npm/next/upgrade?from=14&to=15

next/headers · cookies   (): ReadonlyRequestCookies   →   (): Promise<ReadonlyRequestCookies>
next/headers · headers   (): ReadonlyHeaders          →   (): Promise<ReadonlyHeaders>
+ new module: next/form
summary: 4 removed exports · 10 changed signatures · 16 changed/removed members · 5 new deprecations

Related MCP server: package-intel-mcp

What it answers (that nothing else does in one call)

Question

REST

MCP tool

What breaks if I upgrade X from A to B? Removed exports and import paths, changed signatures and class members, new @deprecated, engines/peerDependencies changes, changelog in between

GET /v1/packages/npm/{name}/upgrade?from=14&to=15

upgrade_impact

Does this API exist in this version? Exact signature, import path, deprecation message, "did you mean"

GET /v1/packages/npm/{name}/symbols/{symbol}?version=15

symbol_status

Newest version that works with Node 18 / React 18 / Python 3.8? Uses the requirements declared by each version

GET /v1/packages/{npm|pypi}/{name}/compatible?with=node@18,react@18

find_compatible_version

Is my exact version vulnerable? Nearest fixed version? (OSV)

GET /v1/packages/{eco}/{name}/versions/{version}

version_status

Latest version, deprecation, runtime requirements, peers, license

GET /v1/packages/{eco}/{name}

package_status

Check a whole package.json / requirements.txt

POST /v1/check

check_dependencies

Is this Python / Node / PHP / Java / Django / Ubuntu... version still supported? When does it reach end of life? (~480 products)

GET /v1/eol/{product}/{version}

eol_status

What changed since my training cutoff? New major versions, runtime releases and AI models after a date

GET /v1/since?cutoff=2025-06

changes_since_cutoff

AI model prices, context windows, retirement dates

GET /v1/models

model_status

Every response includes when it was verified and where the data came from. Full spec: /openapi.json · Docs in 18 languages: /docs.

Project context for agents (no MCP needed)

Agents read AGENTS.md / CLAUDE.md by themselves. Generate a block with the facts about your dependencies (end-of-life runtimes, vulnerabilities, deprecated packages, what breaks in the major versions you are behind on):

  • Web: https://vigia.coredls.cloud/context (paste your package.json or requirements.txt)

  • Script (zero dependencies, Node 18+; read it first): curl -fsSL https://vigia.coredls.cloud/context.mjs -o vigia-context.mjs && node vigia-context.mjs

  • API: POST /v1/context

Claude Code: automatic. The plugin includes hooks that give the agent these facts at session start and re-check whenever it edits package.json or requirements.txt (so it learns that Node 18 is end of life, or that lodash has known vulnerabilities, without calling any tool). The manifest is sent to Vigia and not stored; set VIGIA_DISABLE=1 to turn the hooks off. Without the plugin, copy examples/claude-code-settings.json into .claude/settings.json and point it at hooks/vigia-hook.mjs.

Per-month pages of what changed after a training cutoff: https://vigia.coredls.cloud/since

GitHub Action

Flags outdated, deprecated and vulnerable dependencies on every pull request:

name: dependencies
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  vigia:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: MatiasDelosSantos/vigia@v1
        with:
          fail-on: vulnerable                        # optional: vulnerable, deprecated, major, outdated
          github-token: ${{ secrets.GITHUB_TOKEN }}  # optional: comment on the PR

Badges

[![version](https://vigia.coredls.cloud/badge/npm/react/version.svg)](https://vigia.coredls.cloud/npm/react)
[![maintained](https://vigia.coredls.cloud/badge/npm/react/maintained.svg)](https://vigia.coredls.cloud/npm/react)

How it works

  • Registries are the source of truth. npm, PyPI and crates.io metadata with ETags, publish dates and per-version requirements (engines, Requires-Python, rust-version); deps.dev for npm history; OSV for vulnerabilities; OpenRouter for AI models.

  • API surface analysis never executes package code. Tarballs are downloaded, only .d.ts, package.json and changelogs are extracted, and the TypeScript compiler API reads the exported declarations in an isolated worker thread with memory and time limits. Packages without bundled types fall back to @types/*.

  • Facts are never overwritten. Each change closes the previous value (bitemporal history), so ?as_of= can answer "what did Vigia say on date X".

  • Self-updating. A worker tracks ~34,000 popular packages (npm every 15 min–2 h; PyPI via its update feed; the top 3,000 Rust crates from crates.io), resolves unknown packages on first request, and pre-computes upgrade reports for the 300 most popular npm packages.

Stack: TypeScript, Node 22, Hono, PostgreSQL 17, MCP SDK, Docker.

Run it yourself

cp .env.example .env          # set POSTGRES_PASSWORD and PUBLIC_URL
docker compose up -d          # vigia-db, vigia-api (:3005), vigia-worker
npm install && npm test       # 70 unit tests

Data license & privacy

Vigia's compiled data is CC-BY-4.0 (attribute "Vigia"); upstream data keeps each source's terms. Manifests sent to /v1/check are not stored; no cookies or trackers. See terms and privacy.

License

Code: AGPL-3.0. Operations notes (Spanish): docs/OPERACION.es.md.

Available Tools

12 tools
changes_since_cutoffWhat changed since my knowledge cutoffA
Read-only
Inspect

Returns what happened in software after a given date, so an agent can patch the gap between its training data and today: packages among the most popular on npm, PyPI, crates.io and Packagist that shipped a NEW MAJOR VERSION after the date (with the version that existed at that date, the new majors and their first release dates, the latest version, and an upgrade-guide link when one exists), runtimes, frameworks and platforms released or ended since (Python, Node.js, PHP, Java, Django, Laravel, Ubuntu, PostgreSQL and about 35 more), runtimes ending within 180 days, and AI models released since by the main providers with their prices. Read-only and requires no authentication. Results are computed from registry publication dates and cached for an hour. Coverage is the most popular packages (not every package), 0.x-to-0.y changes and calendar-versioned packages are not reported as major versions, and deprecations that happened before Vigia started tracking are not listed. Use it once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot. To dig into one package use upgrade_impact (npm) or package_status; for one runtime use eol_status.

NameRequiredDescriptionDefault
limitNoMaximum number of packages in new_major_versions, most popular first, from 1 to 100 (default 30)
cutoffYesThe month or date your training data ends, as YYYY-MM (the last day of that month is used) or YYYY-MM-DD, for example "2025-06". It must be a past date after 2015
ecosystemsNoRestrict the package list to these ecosystems; omit for all four

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses auth (none required), derivation (computed from registry publication dates), caching (one hour), and — crucially — coverage limits and exclusions (popular packages only, 0.x-to-0.y not reported as majors, calendar-versioned packages, pre-tracking deprecations). These constraints materially affect how an agent should interpret empty or partial results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and scope are front-loaded, and the dense parenthetical enumerations each carry distinct, load-bearing information rather than filler. It is a long block of prose, which costs a little readability, but nearly every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of describing the return shape, and it does so item by item (version at cutoff date, new majors with first release dates, latest version, upgrade-guide link, runtimes ending within 180 days, AI models with prices). Combined with the stated coverage caveats, an agent has everything needed to call and interpret this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so cutoff format, limit bounds and the ecosystems enum are already fully documented in the schema. The description restates what is returned rather than adding parameter syntax or defaults beyond it, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Returns what happened in software after a given date') and then enumerates exactly what is returned: new major versions across npm/PyPI/crates/Packagist, runtimes/frameworks released or ended, EOL windows, and AI model releases with prices. It explicitly distinguishes itself from sibling tools (upgrade_impact, package_status, eol_status) so an agent can route correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot') and names three alternatives with the conditions that select them. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_dependenciesCheck dependenciesA
Read-only
Inspect

Audits a whole manifest in one call. For every dependency in a package.json (dependencies and devDependencies) or a requirements.txt it returns the latest version, whether the declared range includes it (up_to_date / outdated / outdated_major / unpinned / unsupported_spec), how many major versions behind it is, whether the package is deprecated, and the OSV vulnerability IDs of the lowest version the range allows; a summary with counts comes first. Read-only and requires no authentication. Nothing is stored. Up to 300 dependencies are handled per call; packages Vigia does not track yet are resolved live (up to 40 per call), and the rest come back as not_resolved_yet with retry_after_s. Only npm and PyPI manifests are supported. Use it when opening a project or before upgrading its dependencies. For a single package use package_status; for one exact version use version_status.

NameRequiredDescriptionDefault
manifestYesComplete file content as text (at most 200,000 characters): the JSON of a package.json, or the lines of a requirements.txt (pins, ranges, comments and extras are accepted)
ecosystemYesFormat of the manifest you are sending: "npm" for a package.json, "pypi" for a requirements.txt. Cargo.toml and composer.json are not supported

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint and openWorldHint, but the description adds substantial context beyond them: no authentication needed, nothing stored, a 300-dependency cap, a 40-live-resolution cap with not_resolved_yet/retry_after_s behavior, and the supported ecosystems. That is genuinely useful operational detail, though it does not quantify per-dependency latency or caching.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then the return payload, then constraints and routing — a sensible order. It is somewhat dense and the 'Only npm and PyPI manifests are supported' line partially duplicates the ecosystem enum, but nearly every sentence carries weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so thoroughly: each status enum (up_to_date/outdated/outdated_major/unpinned/unsupported_spec), the summary-first ordering, deprecation, OSV IDs, and the unresolved-path behavior are all disclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, so the schema already documents the manifest content and ecosystem enum. The description only restates supported formats (package.json/requirements.txt), adding little syntactic or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Audits a whole manifest in one call') and immediately distinguishes itself from siblings by naming package_status and version_status as the single-package/single-version alternatives. The scope (whole manifest, npm/PyPI only) is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names when to use it ('when opening a project or before upgrading its dependencies') and routes to the correct alternatives ('For a single package use package_status; for one exact version use version_status'). No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

eol_statusSoftware end-of-life statusA
Read-only
Inspect

Tells whether a language, runtime, framework, database or operating-system version is still supported and when it reaches end of life. Covers about 480 products (Python, Node.js, PHP, Java, Ruby, Go, Rust, Django, Laravel, Rails, React, Angular, PostgreSQL, MySQL, Ubuntu, Debian, Kubernetes and more). With product and version it returns that version's status (supported / security_only / end_of_life / upcoming), its release, active-support and end-of-life dates, days remaining or elapsed, and the cycles that are still supported; with only product it returns every release cycle; with neither it lists the product identifiers. Read-only and requires no authentication. Status is computed on every call from today's date; the dates come from endoflife.date and are refreshed every 12 hours. Use it before choosing a runtime or base image, when writing a Dockerfile or CI matrix, or when auditing an old version. It concerns the language, runtime or platform itself; for a library's own versions use package_status.

NameRequiredDescriptionDefault
productNoProduct identifier or alias, case-insensitive, e.g. "python", "nodejs" (alias "node"), "php", "ubuntu", "django". Call the tool without arguments to list every identifier
versionNoVersion or release cycle, e.g. "3.9", "18" or "22.04"; a patch version such as "3.9.7" is matched to its cycle "3.9". Requires product

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true, but the description adds substantial context the agent could not infer: no authentication required, status is recomputed on every call from today's date, upstream data from endoflife.date refreshes every 12 hours, and the result shape changes with the argument combination. The freshness/staleness caveat is exactly the kind of behavioral disclosure annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then coverage breadth, behavioral semantics, freshness, and usage — a logical order with no filler sentences. It is on the long side for a two-parameter tool, and the product enumeration list of ~18 example names could be trimmed, since the schema already gives aliases and the no-arg call lists identifiers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries the full burden of explaining return values — and it does, enumerating the four status values, release/active-support/EOL dates, days remaining or elapsed, and supported cycles. Combined with the authentication, freshness, and routing details, nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so per-parameter formats and aliases are already documented, but the description adds combinatorial semantics the schema does not express: product+version returns that cycle's status, product alone returns every release cycle, and neither argument lists all product identifiers. That mapping is genuinely useful, though it restates some schema content.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a precise verb+resource ('Tells whether a language, runtime, framework, database or operating-system version is still supported') and scopes the domain to ~480 named products. It explicitly carves out its boundary against the sibling package_status ('for a library's own versions use package_status'), so an agent can route correctly without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete triggering scenarios — before choosing a runtime or base image, writing a Dockerfile or CI matrix, auditing an old version — and names the alternative tool (package_status) for the adjacent library-version use case. Both when-to-use and when-to-use-something-else are stated, not inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_compatible_versionNewest compatible versionA
Read-only
Inspect

Finds the newest stable, non-withdrawn version of a package whose own declared requirements admit the runtimes you give it: npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version (minimum Rust), PHP require.php and required packages. Returns the best version with the per-constraint checks, the newest release that is incompatible together with the reason it fails, and a list of unverified constraints (a version that declares nothing for a constraint is not counted against it but is flagged). Read-only and requires no authentication. If per-version requirement data for a package is still being loaded, the result has status "requirements_not_synced_yet" and retry_after_s. Use it when a project is pinned to an older Node, React, Python, Rust or PHP and the latest release may not support it. For the plain latest version use package_status; to check whether the runtime itself is still supported use eol_status.

NameRequiredDescriptionDefault
nameYesExact package name, e.g. "vite", "django", "tokio" or "laravel/framework"
withYesComma-separated name@version constraints. npm: "node@18,react@18"; pypi: "python@3.8"; crates: "rust@1.70"; packagist: "php@8.1" or other packages such as "illuminate/support@10". A bare major such as "18" means any 18.x
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, but the description adds real behavioral context: no authentication required, the full shape of the result (best version, incompatible newest release with reason, unverified constraints, per-constraint checks), and the transient requirements_not_synced_yet status with retry_after_s. This meaningfully exceeds the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core definition and scoping before the return-value detail and the alternatives. It is dense and long, but nearly every clause adds distinct information (constraint semantics, retry status, when-to-use, alternatives); a small amount of compression is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so fully – best version, per-constraint checks, incompatible release plus reason, unverified constraints, and the transient status field. Combined with the when-to-use guidance and named alternatives, an agent has everything needed to select and call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the schema already documents all three parameters including the with-constraint format. The description adds semantic value by enumerating which runtime constraints are actually evaluated per ecosystem (npm engines/peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), which goes beyond the schema's examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource (finds the newest stable, non-withdrawn version of a package) with the key qualifier that the package's declared requirements must admit the given runtimes. It distinguishes itself clearly from siblings by naming package_status and eol_status and the conditions under which each is preferred.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly gives the triggering scenario (a project pinned to an older Node, React, Python, Rust or PHP where the latest release may not support it) and names two alternatives with their own selection conditions (package_status for plain latest, eol_status for runtime support). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_packageFind packageA
Read-only
Inspect

Searches the catalog of tracked packages and AI models by case-insensitive name prefix and returns up to 15 matches ordered by popularity, each with its ecosystem, name and popularity rank. Read-only and requires no authentication. It matches only the beginning of the name (not descriptions or keywords) and covers tracked packages only, about 34,000 across npm, PyPI, crates.io and Packagist. Use it when you do not know the exact package or model name before calling package_status, list_versions or model_status; it is not a way to discover packages by what they do.

NameRequiredDescriptionDefault
queryYesName prefix of 1 to 100 characters, case-insensitive, e.g. "react-q", "serde_" or "anthropic/claude"
ecosystemNoOptional filter: "npm", "pypi", "crates", "packagist" or "ai" (AI models); omit to search all ecosystems

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description reinforces it with "Read-only and requires no authentication." It adds real behavioral context beyond annotations: a 15-result cap, popularity ordering, prefix-only matching against names, and catalog scope (~34,000 packages across npm, PyPI, crates.io, Packagist). Largely complete, though no note on pagination or how truncation past 15 matches is signalled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the verb, matching rule and result shape before routing guidance. Every sentence carries distinct information — matching semantics, coverage scope, and routing — with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the work of describing returns (up to 15 matches with ecosystem, name and popularity rank). Combined with the catalog scope and the prefix-only limitation, an agent can call this correctly; only the behavior when more than 15 packages match is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, including the enum of ecosystems and the 1-100 character prefix constraint. The description restates prefix matching and ecosystem coverage without adding syntax, defaults, or edge cases the schema lacks. Baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (searches), resource (catalog of tracked packages and AI models), matching mode (case-insensitive name prefix), result shape and ordering. It is immediately distinguishable from package_status, list_versions and model_status, which it names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ("when you do not know the exact package or model name before calling package_status, list_versions or model_status") plus an explicit when-not ("not a way to discover packages by what they do"). Routing to alternatives is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_versionsList package versionsA
Read-only
Inspect

Lists the published versions of one package, newest first, each with its publish date, a prerelease flag and whether it is withdrawn (npm: deprecated; PyPI and crates.io: yanked; Packagist: abandoned), plus a maintenance summary: last release date, releases in the last 12 months and an activity label (active / slowing / dormant). Read-only and requires no authentication. A package Vigia does not track yet is fetched live on the first call. Use it to judge release cadence, to see which version was current at a given date, or to check whether a version was ever withdrawn. For only the latest version use package_status; for the vulnerabilities of one version use version_status.

NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
limitNoMaximum number of versions to return, from 1 to 200 (default 30)
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")
stable_onlyNoWhen true, prereleases (alpha, beta, rc) are excluded; default false

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint, it discloses that no authentication is required and that untracked packages are fetched live on the first call — non-obvious side-effect behavior an agent should anticipate. It also maps withdrawal semantics per ecosystem (npm deprecated, PyPI/crates yanked, Packagist abandoned), which is behavioral context the annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The output content, behavior disclosures and sibling routing are all front-loaded and each sentence earns its place. The first sentence is dense with field enumerations, but it is information the agent needs rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description compensates by enumerating the returned fields and the maintenance summary, plus the ecosystem-specific withdrawal vocabulary. Combined with the auth and live-fetch disclosures, an agent has everything needed to call and interpret the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so ecosystem, name, limit and stable_only are already fully documented in the schema; the description adds no format or syntax details for them. Baseline 3 applies because the schema carries the parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Lists the published versions of one package, newest first') and immediately enumerates the returned fields. It explicitly differentiates itself from siblings package_status and version_status, so an agent can route correctly without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives three concrete use cases (judge release cadence, see which version was current at a date, check withdrawal status) and names both alternatives with the condition that selects each. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

model_statusAI model status and pricingA
Read-only
Inspect

Looks up AI models in the OpenRouter catalog: price per million input and output tokens in USD, context window, maximum output tokens, knowledge cutoff, supported modalities and announced retirement date, with a status of available / retiring / removed_from_catalog. With model_id it returns that one model (if the id is unknown, a list of similar ids); with provider and/or query it returns up to 40 matching models. Read-only and requires no authentication. Prices are OpenRouter reference prices and may differ from a provider's direct pricing; the catalog is refreshed every 15 minutes. Use it before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired. It does not call, run or benchmark models.

NameRequiredDescriptionDefault
queryNoCase-insensitive substring matched against the model id and display name, e.g. "flash" or "haiku"
model_idNoExact catalog id in provider/model form, e.g. "anthropic/claude-sonnet-4.5" or "openai/gpt-4o"; when given it takes precedence over the other parameters
providerNoProvider slug that lists all of its models, matched exactly, e.g. "anthropic", "openai", "google" or "meta-llama"

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint it discloses that no authentication is required, that prices are OpenRouter reference prices that may differ from a provider's direct pricing, that the catalog refreshes every 15 minutes, and how unknown ids are handled (similar-id fallback). These are exactly the operational caveats an agent needs and none are repeatable from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the resource and returned fields before modes and usage triggers, and every sentence carries distinct information. It is a dense single paragraph that runs long, but no sentence is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating every returned field (prices, context window, max output tokens, knowledge cutoff, modalities, retirement date, status enum values). Nothing needed to call or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so parameter syntax is covered; the description still adds semantic detail the schema lacks, namely that provider/query return up to 40 matches and that an unknown model_id yields a list of similar ids. The model_id precedence rule is stated in both places, so it is only mildly additive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('Looks up AI models in the OpenRouter catalog') and enumerates exactly which fields are returned. It is clearly distinguishable from sibling tools like package_status or eol_status, which cover packages and end-of-life data rather than model catalog entries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names four concrete triggers ('before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired') and an explicit exclusion ('It does not call, run or benchmark models'). The two invocation modes (single model_id vs. provider/query search) are also stated as conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_statusPackage statusA
Read-only
Inspect

Returns the current state of one package: latest stable version and its publish date, status (active / deprecated / yanked / not_found_in_registry), the deprecation message if any, runtime requirements (npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), license, known security advisories on the latest version, a release-activity summary (active / slowing / dormant) and the sources with their last verification time. Read-only and requires no authentication. A package Vigia does not track yet is fetched live from its registry on the first call (a few seconds); if the name does not exist the result has status not_found_in_registry plus similar-name suggestions. Use it to decide whether to add or recommend a package, or to learn its newest version. For a specific version you already have use version_status; for what breaks when moving between two versions use upgrade_impact; to find a release that fits an older runtime use find_compatible_version; to find a package whose exact name you do not know use find_package.

NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint, the description discloses no-auth operation, a first-call live-registry fetch with a few-seconds latency cost, caching-implied 'not tracked yet' behavior, and the not_found_in_registry outcome plus similar-name suggestions. Latency and error semantics like these are exactly the context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the routing alternatives come last, which is the right order. The middle return-field enumeration is dense and slightly run-on, but every item is substantive information that no output schema supplies, so little is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and only two parameters, the description must carry the return contract itself, and it does: every field of the result is named, including the error/status variants and the advisory and activity summaries. Nothing needed to call or interpret this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents both parameters with examples, enum values, scope syntax and the 'partial names are not accepted' constraint. The prose adds nothing further about name or ecosystem, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (returns the current state of one package) and enumerates exactly what that state includes: version, publish date, status, deprecation message, runtime requirements, license, advisories, activity. It is clearly distinguishable from version_status, upgrade_impact and find_package, which are named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases ('decide whether to add or recommend a package, or to learn its newest version') and then routes the agent away with four named alternatives tied to their triggering conditions (specific version → version_status; migration breakage → upgrade_impact; older runtime → find_compatible_version; unknown name → find_package). This is textbook when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_changesRecent changesA
Read-only
Inspect

Lists the changes Vigia detected recently, newest first: new package releases (with old and new version), deprecations, yanks and removals, runtime-requirement changes, AI model price changes and model retirement announcements. Each item has the entity, the kind of change, the old and new values and the detection time. Without a name it returns the global feed; with ecosystem and name it returns the change history of that one package or model. Read-only and requires no authentication. History only goes back to when Vigia started tracking the entity, so it is not a package's full release history (use list_versions for that). Use it to find out what happened after your training data ends, or whether a dependency or model has just changed.

NameRequiredDescriptionDefault
nameNoExact package name or, for ecosystem "ai", a model id such as "anthropic/claude-sonnet-4.5"; returns that entity's own change history. Requires ecosystem
limitNoMaximum number of items to return, from 1 to 50 (default 20)
ecosystemNoRestrict to one ecosystem: "npm", "pypi", "crates", "packagist" or "ai" (AI models). Required when name is given

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only carry readOnlyHint, so the description adds real behavioral context: no authentication required, newest-first ordering, the per-item shape, and the crucial limitation that history starts at Vigia's tracking start rather than being full release history. Auth and ordering are genuinely useful disclosures, though return format/pagination detail is absent and the read-only claim largely restates the hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the change taxonomy, then scope rules, then the alternative and use case. The opening enumeration of change kinds is dense but each item earns its place as disambiguation; overall it is slightly long but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by describing item fields (entity, kind, old/new values, detection time). Combined with scope rules, the auth statement, the history limitation and the sibling reference, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: how omitting name produces the global feed versus supplying ecosystem + name producing one entity's history. The enum values and limit bounds are left to the schema, which is fine.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (lists) and resource (changes Vigia detected) and enumerates the change kinds covered. It also distinguishes the tool's feed scope from list_versions, so an agent can tell it apart from siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames when to reach for it ('find out what happened after your training data ends, or whether a dependency or model has just changed') and names the sibling to use instead for full release history (list_versions). The scoping rule (no name = global feed; ecosystem + name = single-entity history) further pins down usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

symbol_statusDoes this API exist in this version?A
Read-only
Inspect

Checks whether an exported function, class, type or constant (or a Class.member) exists in a specific version of an npm package, using the package's TypeScript declarations. Returns whether it was found, its kind, its exact signature, the module path to import it from, whether it is deprecated (with the deprecation message) and, when it is not found, close-name suggestions. Read-only and requires no authentication. The first lookup for a package version can take up to about 25 seconds while its types are analyzed; a result with status "pending" and retry_after_s means call again after that delay. Limits: npm packages with TypeScript types only; exports that exist at runtime but have no type declaration are not visible. Use it before writing code that calls a library API you are not sure exists, or has the same signature, in the installed version, especially after a major upgrade. For a complete list of what changed between two versions use upgrade_impact.

NameRequiredDescriptionDefault
nameYesnpm package name, e.g. "next", "zod" or "@tanstack/react-query"
moduleNoRestrict the lookup to one import path (a subpath export), e.g. "next/headers"; omit to search every exported module of the package
symbolYesExported name or Class.member, letters, digits, "$" and "_" only, case-sensitive, e.g. "cookies", "z" or "ZodError.flatten"
versionNoExact version such as "15.0.0", or a major such as "15" (resolved to its latest stable release); omit for the latest stable release

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover readOnlyHint and openWorldHint, and the description adds substantially more: no authentication required, a first-lookup latency of ~25 seconds, a 'pending' status with retry_after_s to poll, and the visibility limit that runtime-only exports without type declarations are not found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is dense but front-loaded: what it checks, then what it returns, then latency/retry behavior, then limits and usage. Every sentence carries information, though the single long first sentence is heavy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so fully (found flag, kind, signature, import module path, deprecation plus message, close-name suggestions), and it also covers latency, async retry, and applicability limits for a 4-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (name, module, symbol, version) already documented including examples and version-resolution rules. The description adds no parameter-level syntax or constraint beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Checks whether an exported function, class, type or constant ... exists in a specific version of an npm package') and names the mechanism (TypeScript declarations). It is clearly distinguishable from siblings like find_compatible_version or version_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use it before writing code that calls a library API you are not sure exists ... especially after a major upgrade') and routes to the alternative for a different need ('For a complete list of what changed between two versions use upgrade_impact'). Scope limits are also stated, so the agent knows when this tool will not help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_impactUpgrade impact (what breaks)A
Read-only
Inspect

Reports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed exports and import paths, changed function signatures and class or interface members, newly deprecated APIs, changed engines and peerDependencies, and the changelog sections published in between. Returns a summary with counts and a likely_breaking flag, followed by the before/after detail of each change. Read-only and requires no authentication. The first request for a version pair can take up to about 25 seconds while the analysis runs; if it is still running the result has status "pending" and retry_after_s, and you should call again after that delay. Limits: only npm packages that ship TypeScript types (or have @types) can be analyzed, and behavior changes that do not alter types (for example new caching defaults) are invisible, so also read the returned changelog. Use it BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one. For one API in one version use symbol_status; for vulnerabilities use version_status; to choose a version that fits an older runtime use find_compatible_version.

NameRequiredDescriptionDefault
toNoThe version to move to, in the same formats; omit for the latest stable release. It must be newer than "from"
fromYesThe version you are on: an exact version such as "14.2.3", or a major such as "14", which resolves to the latest stable release of that major
nameYesnpm package name, e.g. "next" or "@tanstack/react-query" (scoped names allowed). PyPI, crates.io and Packagist packages are not supported by this tool

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Although annotations already declare readOnlyHint and openWorldHint, the description adds substantial context beyond them: no authentication required, ~25s first-request latency, a 'pending' status with retry_after_s and retry guidance, the types-only analysis method, and the blind spot for non-type behavior changes. It also describes the return shape (summary with counts and likely_breaking flag plus before/after detail).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and method, then output shape, operational traits, limits, and finally alternatives. Every sentence carries distinct, load-bearing information with no filler despite the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description explains the return contents (summary counts, likely_breaking flag, per-change before/after), the pending/retry flow, scope limits, and unsupported registries. An agent has everything needed to call and interpret it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so 'from' and 'to' formats and the newer-than constraint are fully documented in the schema. The description adds the version-pair pairing concept but no syntax the schema lacks, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource ('Reports what changes between two versions of an npm package by diffing the public TypeScript API') and enumerates exactly what is diffed (exports, import paths, signatures, members, deprecations, engines/peerDependencies, changelog). This is immediately distinguishable from sibling tools like symbol_status or version_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit use cases ('BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one') and routes three alternative scenarios to named siblings: symbol_status for one API in one version, version_status for vulnerabilities, find_compatible_version for runtime fit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

version_statusVersion status and vulnerabilitiesA
Read-only
Inspect

Reports on one exact version of an npm, PyPI, crates.io or Packagist package: whether that version exists, when it was published, whether it is withdrawn (npm deprecated, PyPI and crates.io yanked, Packagist abandoned), how many stable releases and major versions it is behind the latest, and its known vulnerabilities from OSV with severity, summary, the version that fixes each one, and the single nearest version that fixes all of them (null if any has no fix). Read-only and requires no authentication. Vulnerability data is cached for up to 6 hours, and the response states when OSV could not be reached. Use it before keeping, pinning or recommending a specific version, or when auditing one lockfile entry. For the latest version and general package health use package_status; to audit a whole manifest at once use check_dependencies.

NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
versionYesExact version string as published, e.g. "4.17.1", "2.25.0" or "1.0.100". Ranges and tags such as "^4" or "latest" are not accepted
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and open-world, but the description adds materially: no authentication required, vulnerability data cached up to 6 hours, and explicit disclosure that the response signals when OSV could not be reached. This degradation/caching behavior is not derivable from the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Highly information-dense with no filler: the long opening sentence packs the full report surface, followed by auth/caching caveats and then routing guidance. The first sentence is a run-on with many comma-linked clauses, which slightly hurts front-loading, but every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the full burden of return-value disclosure, and it does so thoroughly: existence, publish date, withdrawal semantics per registry, version-behind counts, and vulnerability fields including severity, summary, fixing version and nearest universal fix. Complete for a read-only query tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents name, version and ecosystem, including the enum values and format constraints. The description restates the ecosystem list but adds no syntax or format guidance beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource: reports on one exact version of a package across four named ecosystems, enumerating exactly what is reported (existence, publish date, withdrawn status, versions behind, vulnerabilities with fixes). It explicitly names sibling tools (package_status, check_dependencies) so an agent can distinguish scope without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use triggers (before keeping, pinning or recommending a version; auditing one lockfile entry) and names the alternatives for adjacent jobs — package_status for latest/overall health, check_dependencies for whole-manifest audits. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.1.0
    • First observedchanges_since_cutoff
    • First observedcheck_dependencies
    • First observedeol_status
    • First observedfind_compatible_version
    • First observedfind_package
    • First observedlist_versions
    • First observedmodel_status
    • First observedpackage_status
    • First observedrecent_changes
    • First observedsymbol_status
    • First observedupgrade_impact
    • First observedversion_status

TDQS

A4.5/5.0

Scored across 12 tools

Disambiguation4/5

Most tools target clearly distinct resource+action combinations: package status, version status, upgrade impact, symbol existence, compatibility selection, manifest audit, runtime EOL, model status, and package search. The main overlap is between changes_since_cutoff and recent_changes, which both answer 'what changed since my training data,' but their descriptions differentiate a curated cutoff snapshot from a raw detection feed. Minor confusion risk remains.

Naming Consistency4/5

All names use lower snake_case and are descriptive. However, conventions are mixed: verb_noun (find_package, list_versions, upgrade_impact, check_dependencies) alongside noun_status (package_status, version_status, symbol_status) and ad hoc phrases (changes_since_cutoff, recent_changes). Readable but not a single predictable pattern.

Tool Count5/5

12 tools is well within the 3-15 sweet spot for a dependency/runtime intelligence server. Each tool covers a distinct analysis mode, so the count feels well scoped rather than bloated or thin.

Completeness5/5

Coverage is comprehensive for read-only software supply-chain intelligence: package search/status/versions/vulnerabilities, version compatibility, upgrade impact, symbol checking, manifest audit, runtime EOL, AI model status, and change feeds. Cross-references handle edge cases, and stated ecosystem limits are explicit rather than silent gaps.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Provides software supply-chain intelligence for AI agents, enabling them to query package metadata, versions, downloads, dependencies, and health signals for npm, PyPI, and crates.io packages without API keys.
    6
    49 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI coding agents to identify exactly what broke between two dependency versions, with citations for every claim, and to verify package existence to catch typosquatting, all without requiring an API key.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI coding agents to fetch the real latest versions of packages from npm, PyPI, crates.io and the Go module proxy, then check manifests or whole projects for outdated dependencies and rewrite them in place. It also reports the current releases and underlying dependency stacks of AI coding tools like Claude Code, Codex and Gemini CLI.
    1
    MIT