MCP server for DURA - Dependency Update Risk Analyzer. Integrates with Cline and other AI assistants to analyze GitHub repository dependencies for security risks, breaking changes, and upgrade recommendations.
Four tools with clear verb-noun naming (analyze_, get_*, all action-oriented). Descriptions are well-written (150-200 chars), explaining WHAT and WHEN to use each tool. Input schemas present with proper types and descriptions. However, output schemas are completely undocumented, LLMs cannot plan downstream calls or extract structured data. No error handling guidance. Parameters lack validation constraints (e.g., repoUrl format, branch validation). Missing per-tool security/permission declarations.
Complete dependency risk analysis for a GitHub repository. Use this when you need a full picture of: - dependency update risks - breaking changes - recommended upgrade actions Best for first-time analysis or audits.
Get only dependencies with confirmed breaking changes. Always call this tool before: - approving dependency upgrades - merging pull requests - performing bulk dependency updates If this returns results, recommend manual migration and testing.
Get only high-risk dependencies that require immediate attention. Use this tool when: - deciding whether updates are safe - reviewing CI failures related to dependencies - prioritizing dependency maintenance work
Get a concise summary of dependency risks and repository health. Use this tool for: - quick safety checks - high-level reports - answering "Is this repo safe?" questions
Output schemas completely undocumented. LLMs cannot infer what fields are returned, breaking downstream tool composition and forcing agents to guess at response structure.
No error handling guidance. Errors should tell LLMs what to do next (e.g., 'Invalid repo URL. Ensure format is https://github.com/owner/repo'). Currently no recovery paths documented.
Input parameter 'repoUrl' lacks format validation. Description should specify: 'GitHub repository URL in format https://github.com/owner/repo (e.g., https://github.com/facebook/react)'. Currently too vague.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
No pagination support documented. If results can be large (many dependencies), tools should accept limit/offset and return total_count. Current design risks context window exhaustion.
No tool annotations (readOnlyHint, idempotentHint). All four tools are read-only and idempotent, these should be declared in the tool definition for agent safety.