MCPFax Dev Package Intelligence
Server Details
Is this dependency current, licensed, deprecated, or already carrying a CVE?
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Available Tools
5 toolsdemand_reportWhat agents are asking for most (free)AInspect
FREE, no payment. The aggregate of what agents have told us they are looking for, most-requested first, with the categories nothing available yet serves.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Window in days, default 30, max 90. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden. It usefully discloses that the tool is free, returns an aggregate rather than individual requests, sorts by demand, and includes categories with nothing available yet. It does not explicitly state read-only behavior, but for a report tool this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but not fully polished: 'FREE, no payment' partly repeats the title's '(free)', and the phrase 'categories nothing available yet serves' is awkward. It is still compact, but the wording could be clearer.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-optional-parameter report with no output schema, the description provides enough context: it explains the free aggregate output, the ordering, and the inclusion of unserved categories. The remaining detail about the days parameter is covered by the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the only parameter: days window, default 30, max 90. The description itself adds no parameter-level meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource as an aggregate of what agents are looking for, states the ordering ('most-requested first'), and mentions unserved categories. This distinguishes it from the package_* siblings, though it does not explicitly differentiate from request_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies when the tool is useful: get a free aggregate view of agent demand. However, it gives no explicit when-to-use/when-not-to-use guidance and names no alternatives, leaving routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_auditShould I add this dependency?AInspect
One call that answers whether a dependency is safe to add: latest version, licence, deprecation, advisories affecting the current version, how long since the last release, and a verdict with the specific concerns found. Prefer this over calling package_info and package_vulnerabilities separately — it is one payment instead of two and applies the judgement. A clean verdict means nothing was found in these sources, not that the package is guaranteed safe. Costs $0.01 USDC per call via x402 on Base.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name. | |
| ecosystem | Yes | One of 'npm', 'pypi', 'crates'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden and does substantial work: it discloses the pay-per-call cost ($0.01 USDC via x402 on Base), states the specific data sources checked, and includes a crucial caveat that a clean verdict 'means nothing was found in these sources, not that the package is guaranteed safe.' It stops short of describing failure modes or data freshness, but the most important behavioral traits are visible.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three dense sentences with no filler. The core purpose comes first, the sibling-tool guidance is second, and the limitation/cost detail is last. Every sentence contributes actionable information, and the whole thing is still short enough to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with no output schema, the description fully covers what an agent needs: what the tool returns, how it should be used relative to alternatives, what a clean verdict means, and the cost. The combination of the parameter schema and this description leaves no obvious gap for successful invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both name and ecosystem with examples and allowed values. The description adds no parameter-level detail beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete promise: 'answers whether a dependency is safe to add' and enumerates the exact output dimensions (latest version, licence, deprecation, advisories, release recency, verdict). It also clearly frames the tool as the combined alternative to package_info and package_vulnerabilities, so it is easy to distinguish from siblings without inspecting schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly directs agents: 'Prefer this over calling package_info and package_vulnerabilities separately' and gives a concrete reason (one payment instead of two plus applied judgement). This is clear when-to-use guidance relative to the named alternatives, even though it does not enumerate every edge case where the siblings would be preferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_infoLatest version and metadata for a packageAInspect
Look up a package in npm, PyPI or crates.io: latest version, licence, whether it is deprecated or yanked, when it was last published, dependency count and repository. Use before writing a dependency line, or to check whether a pinned version is behind. Registries answer with hundreds of kilobytes; this returns only the facts that decide the question. Costs $0.005 USDC per call via x402 on Base.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name, e.g. 'express', '@scope/pkg', 'requests', 'serde'. | |
| ecosystem | Yes | One of 'npm', 'pypi', 'crates' (aliases: node, python, rust). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the burden, and it delivers: it discloses the $0.005 USDC cost via x402 on Base (a critical operational trait for an agent deciding whether to invoke a paid tool) and explains that it returns only the deciding facts rather than the registries' hundreds of kilobytes. It does not cover not-found or error behavior, which keeps it below 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: purpose and output facts, usage timing, behavioral filtering note, and cost. Purpose is front-loaded and there is zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-parameter lookup with no output schema and no annotations, the description covers what is returned, when to call it, and its cost — the essential operational facts. The main gap is behavior for nonexistent packages or registry errors, but the tool is otherwise fully navigable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — both 'name' and 'ecosystem' are already documented with examples and aliases in the schema. The description adds no parameter-level detail beyond mapping the registries to the ecosystem field, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Look up a package in npm, PyPI or crates.io') and enumerates the exact output facts (latest version, licence, deprecated/yanked status, last published, dependency count, repository). This fact list clearly differentiates it from the sibling package_audit and package_vulnerabilities tools by content, even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides two concrete use cases: 'Use before writing a dependency line, or to check whether a pinned version is behind.' This gives clear contextual guidance but stops short of naming sibling alternatives or stating when-not-to-use, so it misses the top bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_vulnerabilitiesKnown vulnerabilities for a packageAInspect
Known security advisories for a package from OSV, the open advisory database. Returns advisory ids, severity, summary and the versions that fix each one. Pass 'version' to ask only about the version you are about to install; omit it to see advisories affecting any version. Use before pinning a dependency or when auditing a lockfile. Costs $0.008 USDC per call via x402 on Base.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name. | |
| version | No | Optional exact version, e.g. '4.17.20'. Narrows advisories to that version. | |
| ecosystem | Yes | One of 'npm', 'pypi', 'crates'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the data source, return fields, version-filtering behavior, and even cost per call via x402 on Base. This is strong transparency, though it does not cover error cases, authentication, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. It leads with the core purpose and output, then gives parameter guidance, use context, and cost. Every sentence adds distinct information that an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with no output schema and no annotations, the description is admirably complete: it explains what is returned, how to narrow results, when to use it, and what it costs. An agent can correctly select and invoke this tool based on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful value by explaining the version parameter's behavior with 'Pass "version" to ask only about the version you are about to install; omit it to see advisories affecting any version.' This goes beyond the schema's basic field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns known security advisories for a package from OSV, including advisory IDs, severity, summary, and fixing versions. It names the resource (package vulnerabilities) and the specific data source, making it distinct from general package info or audit tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases: 'Use before pinning a dependency or when auditing a lockfile.' It also explains when to pass version vs omit it. It does not explicitly name alternatives among siblings or state when not to use it, so it falls just short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_dataTell us what data you are looking for (free)AInspect
FREE, no payment. Describe in your own words the data you are trying to buy — anything, not just packages — and get back whether we operate a service that supplies it, with the MCP endpoint if so. Every request is catalogued so repeatedly-requested data gets built. Nothing identifying is stored, only the words of the request.
| Name | Required | Description | Default |
|---|---|---|---|
| need | Yes | What you are looking for. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It adds meaningful behavior beyond the name and schema: the request is free, every request is catalogued for future building, and no identifying information is stored. This is significant transparency for a tool that accepts free-form input.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the most important fact (FREE, no payment). Every sentence contributes distinct information: scope, response behavior, cataloguing, and privacy. There is no redundant phrasing or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema and no annotations, the description covers the core interaction well: what to provide, what response to expect, and privacy/storage implications. It does not specify fallback behavior when no service exists, but that is a minor gap given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents the 'need' parameter. The description adds context that the input should be a natural-language data request and can cover 'anything, not just packages', but it doesn't add syntax, formatting, or example details beyond the schema's own example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action: describe desired data and get back whether a matching service exists, with the MCP endpoint if so. It also explicitly contrasts with the package-focused siblings by saying 'anything, not just packages', making the tool's scope clear and distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for general data requests beyond the package-focused sibling tools, but it never explicitly tells the agent when to choose this tool over package_info, package_audit, or others. There is no 'use X instead when...' guidance, only an implicit contrast with 'not just packages'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
- Changed
demand_report1 field changed- added
Input schema / properties / days / examplesAdded value: +[ + "30" +]
- Changed
package_audit2 fields changed- added
Input schema / properties / ecosystem / examplesAdded value: +[ + "npm" +] - added
Input schema / properties / name / examplesAdded value: +[ + "lodash" +]
- Changed
package_info2 fields changed- added
Input schema / properties / ecosystem / examplesAdded value: +[ + "npm" +] - added
Input schema / properties / name / examplesAdded value: +[ + "express" +]
- Changed
package_vulnerabilities3 fields changed- added
Input schema / properties / ecosystem / examplesAdded value: +[ + "npm" +] - added
Input schema / properties / name / examplesAdded value: +[ + "lodash" +] - added
Input schema / properties / version / examplesAdded value: +[ + "4.17.20" +]
- Changed
request_data1 field changed- added
Input schema / properties / need / examplesAdded value: +[ + "live electricity spot prices by ZIP" +]
5 tool updates
- First observed
demand_report - First observed
package_audit - First observed
package_info - First observed
package_vulnerabilities - First observed
request_data
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Check if a dependency's license obligates you, based on how you ship. npm, PyPI, Go.
Measured readings on open-source dependencies: health, end-of-life, model prices, incidents.
Measured readings on open-source dependencies: health, end-of-life, model prices, incidents.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables checking whether software packages are deprecated, archived, stale, active, or unknown with supporting evidence, auditing dependency manifests, and looking up runtime support and end-of-life dates.MIT
- AlicenseAqualityAmaintenanceDependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.95172Apache 2.0
- AlicenseAqualityBmaintenanceChecks npm and PyPI packages for outdated versions, deprecation status, and breaking changes with cited sources, enabling AI agents to verify dependency freshness.117ISC
- AlicenseNot gradedqualityAmaintenanceEnables users to look up package versions, scan for vulnerabilities, and analyze dependencies across multiple registries (npm, Maven, PyPI, etc.) using exact version recommendations for security.4MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
package_audit overlaps with package_info and package_vulnerabilities because it bundles their data, but the descriptions clearly frame audit as the combined decision-oriented call and the others as individual fact or advisory lookups. demand_report and request_data are also distinct: one is aggregate market demand, the other is a single request submission.
Three tools share the package_ prefix with descriptive suffixes (audit, info, vulnerabilities), while demand_report and request_data cover the demand-side features without the prefix. All names are snake_case and readable, so the deviation is minor rather than chaotic.
Five tools is a well-scoped size for a package intelligence server. Each tool maps to a meaningful workflow: package facts, vulnerabilities, a composite audit, individual data requests, and an aggregate demand report.
The package workflow is covered end-to-end: check package info, check advisories, and get a combined audit verdict before adding or pinning a dependency. The demand side also feels complete with both individual request_data and the aggregated demand_report.