Supply chain security scanner for detecting compromised packages and malicious dependencies across multiple ecosystems (npm, PyPI, Go, Maven, NuGet, crates.io, Packagist, RubyGems)
Scoring was not performed
Output schemas are not documented for any tool. ScanResult, RuleInfo, RuleDetail, DiscoverResult structures exist in code but their field definitions, types, and expected values are not visible in tool descriptions or in a formal schema export.
The 'opts' parameter is used across 4 tools (Scan, ScanContent, ListRules, ExplainRule) with only a generic description. No enumeration of valid options, their types, or effects. For ListRules, the description mentions 'WithCategory' but does not document valid category enum values. For Scan/ScanContent, unclear what configuration options exist.
Error handling and recovery guidance is absent from tool descriptions. Code shows functions return (*ScanResult, error) or (*RuleDetail, error) but descriptions do not explain what errors can occur, how to recover, or what to do next. For example, Scan may fail due to file not found, permission denied, or invalid path, none of this is documented for LLM guidance.
No pagination or result limiting documented for ListRules or ScanContent. If a scan produces many findings or a system has many rules, no guidance on how to handle large result sets. ScanResult likely contains an array of Finding objects but no limit, pagination, or count is mentioned.
Parameter naming inconsistency: 'opts' is too generic and overloaded across multiple tools. Better to use specific names like 'category' (for ListRules), 'workers' (for Scan), 'minSeverity', etc., or document opts as a structured object with named fields.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 0 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 33 | - | v1 |