Skip to main content
Glama

Deps Dev

by io.github.pipeworx-io

Version

version
Read-onlyIdempotent

Security advisories, license and dependency metadata for ONE specific published release of a package. Requires an exact version that this package actually shipped — if you do not already have one, call package first to list them; a version guessed or carried over from a different package will not resolve.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesPackage name as the registry spells it — scoped npm names keep the "@scope/" prefix, Go modules are the full import path, Maven is "groupId:artifactId".
system_YesNPM | PYPI | GO | MAVEN | NUGET | CARGO | RUBYGEMS
versionYesAn exact version string THIS package published. Get it from the `package` tool rather than assuming; version numbers are not transferable between packages.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed3 schema fields changed
    • addedInput schema / properties / name / description
      Added value: +"Package name as the registry spells it — scoped npm names keep the \"@scope/\" prefix, Go modules are the full import path, Maven is \"groupId:artifactId\"."
    • addedInput schema / properties / system_ / description
      Added value: +"NPM | PYPI | GO | MAVEN | NUGET | CARGO | RUBYGEMS"
    • addedInput schema / properties / version / description
      Added value: +"An exact version string THIS package published. Get it from the `package` tool rather than assuming; version numbers are not transferable between packages."
  2. Changed2 schema fields changed
    • addedInput schema / examples
      Added value: +[
+  {
+    "name": "express",
+    "system_": "NPM",
+    "version": "4.18.2"
+  },
+  {
+    "name": "serde",
+    "system_": "CARGO",
+    "version": "1.0.163"
+  }
+]
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
+  "description": "Package version metadata including dependencies, advisories, and license",
+  "properties": {},
+  "type": "object"
+}
  3. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and idempotent, so no mutation danger is claimed. Beyond annotations, the description reveals a key behavioral constraint: a guessed or cross-package version 'will not resolve', which directly affects whether the agent can expect valid results and helps establish preconditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both purposeful: the first announces scope, the second gives the essential precondition and alternative. No filler, and the most important constraint is placed up front.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema is present and all parameters are fully documented in the input schema, the description covers the key user-facing information: what is returned, the exact-version requirement, and the fallback sibling tool. Nothing critical is missing for an agent to invoke this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the input schema already thoroughly documents `name`, `system_`, and `version`. The description's version guidance largely mirrors the schema text ('call `package` first', 'version numbers are not transferable'), so it adds no meaningful parameter semantics beyond what is available.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states the tool provides 'Security advisories, license and dependency metadata' for 'ONE specific published release of a package', which is specific and distinguishes it from broader package-level tools. It emphasizes the exact-version scoping immediately, making it clear this is a version-scoped lookup rather than a general scan.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Includes explicit guidance: 'Requires an exact version that this package actually shipped' and tells the agent to 'call `package` first to list them' if a version isn't known. It also warns against guessing or reusing versions from other packages, preventing an obvious misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Deps Dev toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.6/5.0
Disambiguation2/5

Multiple tools overlap heavily: ask_pipeworx, ask_pipeworx_beta, and ask_pipeworx_grounded are nearly identical routers, the six polymarket tools cover similar prediction-market territory with fuzzy boundaries, and the deps.dev tools (package/version/dependencies/query/scan_dependency) all deliver dependency metadata. An agent would frequently need the lengthy descriptions to pick the right one.

Naming Consistency2/5

Tool names mix several conventions: noun-only names (package, version, query, project, dependencies), verb_noun names (scan_dependency, validate_claim, resolve_entity), and family-prefixed names (ask_pipeworx_*, polymarket_*, pipeworx_*). There is no single consistent pattern across the set.

Tool Count2/5

With 36 tools, the server is well past the 'heavy' threshold. The scope is also sprawling: general data querying, dependency lookup, memory management, subscriptions, prediction markets, claim verification, and AI-visibility scanning. Many tools could be consolidated or moved to separate servers.

Completeness3/5

The tool set is individually broad and covers many workflows, but the server's stated identity ('Deps Dev') does not match the dominant Pipeworx data surface, creating an unclear core purpose. Within the dependency sub-domain it is fairly complete, and the data-research workflows have decent coverage, but gaps like subscription updates and true deps.dev ecosystem coverage suggest the surface is improvised.

Resources