Loading ToolBench
Production-ready MCP server for intelligent JavaScript package management. Works with Claude, Windsurf, Cursor, VS Code, and any MCP-compatible AI editor.
The server provides 12 tools with reasonable structure and coverage of package manager operations. However, there are significant gaps in descriptions, parameter documentation, and schema completeness. Tool names are clear and action-oriented (search_, check_, analyze_, list_, etc.), which is positive. Input schemas are visible and properly typed using Zod validation, but several tools lack comprehensive parameter descriptions. Most descriptions are adequate but brief (averaging ~60-80 chars), below the baseline of 194 chars for production tools. Error handling exists but lacks recovery guidance. No tool annotations (readOnlyHint, destructiveHint) are visible, and output schemas are not documented in the source.
Analyze project dependencies for issues like circular dependencies
Audit project dependencies for vulnerabilities
Check the bundle size of a package before installing
Check the license of a specific package
Check for outdated packages
Check a specific package for known vulnerabilities
Clean the package manager cache
Get debug information about the running MCP server version
Output schemas not documented. Tools return responses but no structured schema definitions visible for downstream tool chaining. LLMs cannot plan multi-step sequences without knowing what fields to expect.
Descriptions are too brief (averaging 60-80 chars vs. baseline 194 chars). They lack context for when to use each tool or what distinguishes it from similar tools. For example, 'Check the bundle size of a package before installing' does not explain that bundlephobia API is used or what makes this better than npm info.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 12 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 44 | - | v1 |
Display the dependency tree of a project
Get download statistics for a package
Install npm packages in a project
List licenses of all dependencies in a project
Get detailed information about a package
Remove packages from a project
Search for packages in the npm registry
Update packages to their latest versions
Tool annotations missing. No readOnlyHint or destructiveHint visible on any tool registration. clean_cache and audit_dependencies are destructive/reversible but not marked as such. LLMs cannot distinguish safe vs. unsafe operations.
Error recovery guidance absent. Source shows createErrorResponse() calls but responses do not guide LLMs on next steps. For example, if audit_dependencies fails on vulnerability fix, no suggestion to call check_vulnerability or review_dependencies.
Parameter descriptions could be more explicit about constraints and formats. For example, 'cwd' parameters have 'default: process.cwd()' in descriptions but no explanation of path format requirements or what happens if path is invalid. Version parameters lack guidance on format (semver, 'latest', exact tag).
clean_cache tool has risky defaults. With 'global: false' as default, LLMs may not realize they are only cleaning local cache, potentially leading to confusion about what was cleared. Destructive operations should require explicit confirmation.
audit_dependencies has 'fix: false' and 'force: false' defaults, but the description does not clarify what 'force' means or warn about breaking changes. LLMs may pass force=true without understanding consequences.