Skip to main content
Glama

Osv

by io.github.pipeworx-io

Query Batch

query_batch
Read-onlyIdempotent

Batch vulnerability query against OSV.dev (up to 1000 entries per call) — for SBOM-style "scan every dependency in this lockfile" workflows. Pass an array of {package:{name,ecosystem}, version?} or {commit} entries. Returns the vuln IDs matched per query (use get_vulnerability for full detail per ID). Keyless.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
queriesYesUp to 1000 query objects. Each: {package:{name,ecosystem}, version?} or {commit}.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultsNoBatch query results (one per input query)

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Changed1 schema field changed
    • changedInput schema / examples
      Previous value: -[
-  {
-    "queries": [
-      {
-        "package": {
-          "ecosystem": "PyPI",
-          "name": "django"
-        },
-        "version": "3.0.0"
-      },
-      {
-        "package": {
-          "ecosystem": "Maven",
-          "name": "log4j-core"
-        },
-        "version": "2.14.1"
-      },
-      {
-        "commit": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
-      }
-    ]
-  }
-]New value: +[
+  {
+    "queries": [
+      {
+        "package": {
+          "ecosystem": "PyPI",
+          "name": "django"
+        },
+        "version": "3.0.0"
+      },
+      {
+        "package": {
+          "ecosystem": "Maven",
+          "name": "log4j-core"
+        },
+        "version": "2.14.1"
+      },
+      {
+        "package": {
+          "ecosystem": "npm",
+          "name": "lodash"
+        },
+        "version": "4.17.20"
+      }
+    ]
+  }
+]
  2. Added

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds behavioral context beyond annotations: up to 1000 entries per call, input format (array of specific shapes), return type (vuln IDs), and keyless operation. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence is necessary and informative. The description is front-loaded with the core purpose, then details. No redundant or weak wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with full schema coverage and an output schema, the description covers input format, usage context, limitations, and how to get full details. No gaps given the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the parameter structure in plain language, including the two allowed shapes ({package:{name,ecosystem}, version?} or {commit}), which adds meaning beyond the schema description. With 100% schema coverage, this is solid value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('batch query'), resource ('vulnerabilities against OSV.dev'), and distinguishes from siblings like 'get_vulnerability' and 'scan_dependency' by specifying 'SBOM-style' workflows and the limit of 1000 entries per call.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says it's for 'SBOM-style scan every dependency in this lockfile' workflows, advises using 'get_vulnerability' for full details per ID, and notes it's keyless. Could mention when not to use (e.g., single query) but provides sufficient guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Osv toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0
Disambiguation3/5

Several tools have overlapping purposes: ask_pipeworx, ask_pipeworx_beta, and ask_pipeworx_grounded are very similar, as are the suite of polymarket_* tools. While descriptions help differentiate, an agent may struggle to choose the correct one without careful reading.

Naming Consistency3/5

All tool names use snake_case, but they mix verb-first patterns (ask_pipeworx, compare_entities, validate_claim) with noun-first patterns (bet_research, entity_profile, pipeworx_feedback). This inconsistency makes it harder to guess tool names by convention.

Tool Count3/5

35 tools is on the high side but not unreasonable for a platform covering vulnerability queries, data retrieval, prediction markets, and utilities. However, the server name 'Osv' suggests a narrow focus, making the large count feel bloated.

Completeness4/5

The tool set covers a wide range of operations: querying data, comparing entities, managing user data, monitoring subscriptions, and even onboarding. Minor gaps exist (e.g., no direct API for updating user profiles), but overall it is well-rounded for its domain.

Resources