Skip to main content
Glama

MCPFax Dev Package Intelligence

Server Details

Is this dependency current, licensed, deprecated, or already carrying a CVE?

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Last Tested
Transport
Streamable HTTP
URL

Available Tools

5 tools
demand_reportWhat agents are asking for most (free)AInspect

FREE, no payment. The aggregate of what agents have told us they are looking for, most-requested first, with the categories nothing available yet serves.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoWindow in days, default 30, max 90.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the disclosure burden. It usefully discloses that the tool is free, returns an aggregate rather than individual requests, sorts by demand, and includes categories with nothing available yet. It does not explicitly state read-only behavior, but for a report tool this is a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short but not fully polished: 'FREE, no payment' partly repeats the title's '(free)', and the phrase 'categories nothing available yet serves' is awkward. It is still compact, but the wording could be clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-optional-parameter report with no output schema, the description provides enough context: it explains the free aggregate output, the ordering, and the inclusion of unserved categories. The remaining detail about the days parameter is covered by the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents the only parameter: days window, default 30, max 90. The description itself adds no parameter-level meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource as an aggregate of what agents are looking for, states the ordering ('most-requested first'), and mentions unserved categories. This distinguishes it from the package_* siblings, though it does not explicitly differentiate from request_data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies when the tool is useful: get a free aggregate view of agent demand. However, it gives no explicit when-to-use/when-not-to-use guidance and names no alternatives, leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_auditShould I add this dependency?AInspect

One call that answers whether a dependency is safe to add: latest version, licence, deprecation, advisories affecting the current version, how long since the last release, and a verdict with the specific concerns found. Prefer this over calling package_info and package_vulnerabilities separately — it is one payment instead of two and applies the judgement. A clean verdict means nothing was found in these sources, not that the package is guaranteed safe. Costs $0.01 USDC per call via x402 on Base.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name.
ecosystemYesOne of 'npm', 'pypi', 'crates'.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the transparency burden and does substantial work: it discloses the pay-per-call cost ($0.01 USDC via x402 on Base), states the specific data sources checked, and includes a crucial caveat that a clean verdict 'means nothing was found in these sources, not that the package is guaranteed safe.' It stops short of describing failure modes or data freshness, but the most important behavioral traits are visible.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three dense sentences with no filler. The core purpose comes first, the sibling-tool guidance is second, and the limitation/cost detail is last. Every sentence contributes actionable information, and the whole thing is still short enough to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description fully covers what an agent needs: what the tool returns, how it should be used relative to alternatives, what a clean verdict means, and the cost. The combination of the parameter schema and this description leaves no obvious gap for successful invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both name and ecosystem with examples and allowed values. The description adds no parameter-level detail beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a concrete promise: 'answers whether a dependency is safe to add' and enumerates the exact output dimensions (latest version, licence, deprecation, advisories, release recency, verdict). It also clearly frames the tool as the combined alternative to package_info and package_vulnerabilities, so it is easy to distinguish from siblings without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly directs agents: 'Prefer this over calling package_info and package_vulnerabilities separately' and gives a concrete reason (one payment instead of two plus applied judgement). This is clear when-to-use guidance relative to the named alternatives, even though it does not enumerate every edge case where the siblings would be preferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_infoLatest version and metadata for a packageAInspect

Look up a package in npm, PyPI or crates.io: latest version, licence, whether it is deprecated or yanked, when it was last published, dependency count and repository. Use before writing a dependency line, or to check whether a pinned version is behind. Registries answer with hundreds of kilobytes; this returns only the facts that decide the question. Costs $0.005 USDC per call via x402 on Base.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name, e.g. 'express', '@scope/pkg', 'requests', 'serde'.
ecosystemYesOne of 'npm', 'pypi', 'crates' (aliases: node, python, rust).

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the burden, and it delivers: it discloses the $0.005 USDC cost via x402 on Base (a critical operational trait for an agent deciding whether to invoke a paid tool) and explains that it returns only the deciding facts rather than the registries' hundreds of kilobytes. It does not cover not-found or error behavior, which keeps it below 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each earning its place: purpose and output facts, usage timing, behavioral filtering note, and cost. Purpose is front-loaded and there is zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 2-parameter lookup with no output schema and no annotations, the description covers what is returned, when to call it, and its cost — the essential operational facts. The main gap is behavior for nonexistent packages or registry errors, but the tool is otherwise fully navigable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — both 'name' and 'ecosystem' are already documented with examples and aliases in the schema. The description adds no parameter-level detail beyond mapping the registries to the ecosystem field, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Look up a package in npm, PyPI or crates.io') and enumerates the exact output facts (latest version, licence, deprecated/yanked status, last published, dependency count, repository). This fact list clearly differentiates it from the sibling package_audit and package_vulnerabilities tools by content, even without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides two concrete use cases: 'Use before writing a dependency line, or to check whether a pinned version is behind.' This gives clear contextual guidance but stops short of naming sibling alternatives or stating when-not-to-use, so it misses the top bar.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_vulnerabilitiesKnown vulnerabilities for a packageAInspect

Known security advisories for a package from OSV, the open advisory database. Returns advisory ids, severity, summary and the versions that fix each one. Pass 'version' to ask only about the version you are about to install; omit it to see advisories affecting any version. Use before pinning a dependency or when auditing a lockfile. Costs $0.008 USDC per call via x402 on Base.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name.
versionNoOptional exact version, e.g. '4.17.20'. Narrows advisories to that version.
ecosystemYesOne of 'npm', 'pypi', 'crates'.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the data source, return fields, version-filtering behavior, and even cost per call via x402 on Base. This is strong transparency, though it does not cover error cases, authentication, or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no filler. It leads with the core purpose and output, then gives parameter guidance, use context, and cost. Every sentence adds distinct information that an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema and no annotations, the description is admirably complete: it explains what is returned, how to narrow results, when to use it, and what it costs. An agent can correctly select and invoke this tool based on the description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds meaningful value by explaining the version parameter's behavior with 'Pass "version" to ask only about the version you are about to install; omit it to see advisories affecting any version.' This goes beyond the schema's basic field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns known security advisories for a package from OSV, including advisory IDs, severity, summary, and fixing versions. It names the resource (package vulnerabilities) and the specific data source, making it distinct from general package info or audit tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases: 'Use before pinning a dependency or when auditing a lockfile.' It also explains when to pass version vs omit it. It does not explicitly name alternatives among siblings or state when not to use it, so it falls just short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_dataTell us what data you are looking for (free)AInspect

FREE, no payment. Describe in your own words the data you are trying to buy — anything, not just packages — and get back whether we operate a service that supplies it, with the MCP endpoint if so. Every request is catalogued so repeatedly-requested data gets built. Nothing identifying is stored, only the words of the request.

ParametersJSON Schema
NameRequiredDescriptionDefault
needYesWhat you are looking for.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It adds meaningful behavior beyond the name and schema: the request is free, every request is catalogued for future building, and no identifying information is stored. This is significant transparency for a tool that accepts free-form input.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the most important fact (FREE, no payment). Every sentence contributes distinct information: scope, response behavior, cataloguing, and privacy. There is no redundant phrasing or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema and no annotations, the description covers the core interaction well: what to provide, what response to expect, and privacy/storage implications. It does not specify fallback behavior when no service exists, but that is a minor gap given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents the 'need' parameter. The description adds context that the input should be a natural-language data request and can cover 'anything, not just packages', but it doesn't add syntax, formatting, or example details beyond the schema's own example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action: describe desired data and get back whether a matching service exists, with the MCP endpoint if so. It also explicitly contrasts with the package-focused siblings by saying 'anything, not just packages', making the tool's scope clear and distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for general data requests beyond the package-focused sibling tools, but it never explicitly tells the agent when to choose this tool over package_info, package_audit, or others. There is no 'use X instead when...' guidance, only an implicit contrast with 'not just packages'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updates
    • Changeddemand_report1 field changed
      • addedInput schema / properties / days / examples
        Added value: +[
        +  "30"
        +]
    • Changedpackage_audit2 fields changed
      • addedInput schema / properties / ecosystem / examples
        Added value: +[
        +  "npm"
        +]
      • addedInput schema / properties / name / examples
        Added value: +[
        +  "lodash"
        +]
    • Changedpackage_info2 fields changed
      • addedInput schema / properties / ecosystem / examples
        Added value: +[
        +  "npm"
        +]
      • addedInput schema / properties / name / examples
        Added value: +[
        +  "express"
        +]
    • Changedpackage_vulnerabilities3 fields changed
      • addedInput schema / properties / ecosystem / examples
        Added value: +[
        +  "npm"
        +]
      • addedInput schema / properties / name / examples
        Added value: +[
        +  "lodash"
        +]
      • addedInput schema / properties / version / examples
        Added value: +[
        +  "4.17.20"
        +]
    • Changedrequest_data1 field changed
      • addedInput schema / properties / need / examples
        Added value: +[
        +  "live electricity spot prices by ZIP"
        +]
  2. 5 tool updates
    • First observeddemand_report
    • First observedpackage_audit
    • First observedpackage_info
    • First observedpackage_vulnerabilities
    • First observedrequest_data

Frequently Asked Questions

Discussions

No comments yet. Be the first to start the discussion!

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables checking whether software packages are deprecated, archived, stale, active, or unknown with supporting evidence, auditing dependency manifests, and looking up runtime support and end-of-life dates.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables users to look up package versions, scan for vulnerabilities, and analyze dependencies across multiple registries (npm, Maven, PyPI, etc.) using exact version recommendations for security.
    4
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation4/5

package_audit overlaps with package_info and package_vulnerabilities because it bundles their data, but the descriptions clearly frame audit as the combined decision-oriented call and the others as individual fact or advisory lookups. demand_report and request_data are also distinct: one is aggregate market demand, the other is a single request submission.

Naming Consistency4/5

Three tools share the package_ prefix with descriptive suffixes (audit, info, vulnerabilities), while demand_report and request_data cover the demand-side features without the prefix. All names are snake_case and readable, so the deviation is minor rather than chaotic.

Tool Count5/5

Five tools is a well-scoped size for a package intelligence server. Each tool maps to a meaningful workflow: package facts, vulnerabilities, a composite audit, individual data requests, and an aggregate demand report.

Completeness5/5

The package workflow is covered end-to-end: check package info, check advisories, and get a combined audit verdict before adding or pinning a dependency. The demand side also feels complete with both individual request_data and the aggregated demand_report.

Resources