Loading ToolBench
pkgxray — pre-install security for npm packages, MCP servers, and AI agents. Zero-dependency local static analysis with cited SAFE, REVIEW, or BLOCK verdicts.
Four tools with complete input schemas and detailed descriptions. Tool names follow verb_noun pattern (audit_*, guard_*, triage_*) and clearly convey intent. Descriptions are comprehensive (150-300 chars), explaining WHAT, WHEN, and consequences. All parameters have types and descriptions. Output formats documented (markdown/json). However, output schemas themselves are not formally documented in the code, only format options are visible. Error handling guidance is minimal; no recovery hints or actionable error messages shown. Tool composition is sound: each has one responsibility, and outputs should chain (e.g., guard returns SAFE/REVIEW/BLOCK decisions). Security-conscious design: filesystem roots are operator-gated, no secrets in parameters, destructive operations flagged.
Statically analyze caller-supplied package source and metadata. Returns a structured SAFE, REVIEW, or BLOCK report with cited findings; it does not read local files, install packages, or execute code. A SAFE result is defense in depth, not proof of harmlessness. For a live npm package, use guard_agent_extension_install.
Read a dependency manifest under an operator-approved root and query OSV for each resolved dependency. Returns structured SAFE, REVIEW, or BLOCK decisions and honors a sibling .pkgxray.lock; it does not install dependencies or execute package code. deep/deepAll add npm and GitHub network scans.
Fetch and stage one package reference (pin an exact version for reproducibility), then return a structured SAFE, REVIEW, or BLOCK report without running lifecycle scripts or package code. It performs network requests to npm, OSV, and optionally GitHub. promoteTo writes files only after policy allows; force may replace an existing destination. Local references and caller-supplied paths are confined to operator-approved roots.
Re-evaluate a dependency manifest against fresh OSV intelligence without re-fetching npm or GitHub metadata. Faster than audit_lockfile_supply_chain when you have a recent .pkgxray.lock sidecar; use it to recheck after a vulnerability disclosure.
Output schemas not formally documented. Code shows outputFormat enum (markdown/json) but does not specify the structure of SAFE/REVIEW/BLOCK reports, field names, or nested object shapes. LLMs cannot plan downstream parsing without knowing response structure.
Error handling lacks recovery guidance. No tool description explains what to do if a call fails (e.g., 'If OSV lookup times out, retry with vulnerabilityCheck=false'). Agents cannot self-correct without explicit error classification and next-step hints.
Parameter 'sourceFiles' in audit_agent_extension_supply_chain accepts two different shapes (object or array of objects) via anyOf. This overloading is ambiguous, LLMs may pass the wrong shape. Recommend separate parameters or a clear discriminator.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
guard_agent_extension_install accepts 'local file:path or directory references' but does not document the exact syntax or validation rules. LLMs may pass invalid paths. Recommend explicit format description: 'file:/absolute/path or file:relative/path (resolved under PKGXRAY_MCP_ALLOWED_ROOTS)'.
No pagination or result-limiting guidance. audit_lockfile_supply_chain with deepAll=true could return thousands of transitive dependencies. No mention of max results, pagination, or truncation behavior. Large responses risk context window exhaustion.