Days between an advisory being published and a release appearing that postdates it, per package and as a distribution. Requires a key; see https://sighttrue.com/pricing.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name as the registry spells it. | |
| registry | Yes |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that a key is required, which is useful, but it does not state whether the tool performs a read-only lookup, how it handles missing keys, whether results are cached, or what the response shape is. The definition of the metric is behavioral but does not cover side effects, authentication behavior, or data-source specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that immediately states the core definition and then adds the key requirement. It is front-loaded and contains no redundant phrases. Every clause contributes to understanding the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, annotations, or additional context. The description explains the metric but does not clarify what 'as a distribution' means, what output format to expect, or how the per-package and distribution results are presented. Given the simplicity of the tool, the description is incomplete for an agent to confidently invoke it and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema describes the 'name' parameter but not 'registry', giving 50% coverage. The tool description adds no additional meaning for either parameter, such as expected formats, examples, or how they interact. It does not compensate for the undocumented 'registry' parameter, leaving ambiguity about what values are acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines the metric computed: days between an advisory's publication and a postdating release. It specifies the resource ('per package') and the output nature ('as a distribution'), which distinguishes it from sibling tools focused on severity, manifests, or registry health. However, it lacks an explicit verb like 'calculate' or 'return', making it slightly less direct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a prerequisite (requires a key) but gives no guidance on when to use this tool versus alternatives. It does not mention any exclusions, preferred scenarios, or contexts where other tools like advisory_severity or check_package would be more appropriate. The only usage hint is the pricing link, which is not an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Multiple tools overlap significantly: check_package, check_before_install, check_stack, and audit_manifest all inspect dependencies, while check_provider and provider_incidents both return incident data. Descriptions help somewhat, but the boundaries between these tools are unclear and could easily cause misselection.
Tool names follow no consistent pattern: some start with verbs (check_*, list_*, search_*), others are noun phrases (advisory_severity, domain_risk, provider_incidents), and one is a clause (who_can_publish). The mixed conventions reduce predictability and make it harder to infer tool behavior from the name.
With 31 tools, this is well above the 25-tool threshold for a single server, making the surface feel heavy and difficult to navigate. Even given the broad domain (packages, providers, models, registries), many tools could be consolidated or grouped more tightly.
The server provides extensive read coverage for packages, providers, models, and registries, but there are notable gaps such as no watchlist removal or model comparison, and some tools appear redundant rather than completing a lifecycle. Overall, it is broadly useful but not fully complete for its stated purpose.