Skip to main content
Glama
Sign In
proof-of-commitment

proof-of-commitment

by piiiico
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

lookup_pypi_package

Vet PyPI packages by analyzing behavioral signals: package age, download trends, release consistency, publisher count, and linked GitHub activity. Identify supply chain risks and abandonware.

Instructions

Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity.

Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via stolen PyPI token in March 2026. Behavioral signals reveal what star counts hide.

Useful for: vetting Python dependencies, identifying abandonware, supply chain risk due diligence. Examples: "langchain", "litellm", "openai", "anthropic", "requests", "fastapi", "pydantic"

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "package": "<package>"
    },
    "name": "lookup_pypi_package"
  }
}

Input Schema

NameRequiredDescriptionDefault
packageYesPyPI package name. Examples: "langchain", "openai", "requests", "fastapi". Case-insensitive.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It does disclose the return content (signals) and implies a read-only lookup, but it does not mention rate limits, authentication, errors, or side effects. The supply-chain anecdote adds context but isn't a behavioral disclosure, so the transparency is adequate but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose, but the second paragraph about the LiteLLM incident is somewhat tangential to tool selection or invocation. It adds context but is not essential and could become stale. The structure is clear, but the length could be reduced without losing core guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter lookup tool, the description covers the essential context: what it does, what data it returns, and when to use it. The absence of an output schema is mitigated by the description listing the returned signals. It doesn't explain auth or pagination, but these are less critical for a straightforward package lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already describes the 'package' parameter with examples and case-insensitivity. The description reinforces this by listing example package names, but adds no new parameter-level semantics beyond what the schema provides. Baseline 3 applies because the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb+resource combination: 'Get a behavioral commitment profile for any PyPI (Python) package.' It lists exactly what signals are returned (age, downloads, release consistency, etc.), and the PyPI scope differentiates it from sibling tools like lookup_npm_package or lookup_go_module.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases: 'vetting Python dependencies, identifying abandonware, supply chain risk due diligence.' The package name examples further clarify when to use this tool. However, it doesn't explicitly mention when not to use it (e.g., if you need an audit or GitHub-specific analysis), so it lacks exclusion statements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools