deps.dev — Google's package metadata + dependency graph API
This server exposes 5 tools for querying Google's deps.dev API. While all tools have basic schemas and descriptions, the implementation has significant gaps: (1) Parameter descriptions lack detail, most are single-word or generic (e.g., 'system_' has no format guidance, 'query' just says 'Query body'); (2) No enum constraints on system_ or project_type despite known valid values; (3) Output schemas are completely undocumented, LLMs cannot plan downstream calls; (4) Error messages are minimal and non-actionable; (5) Tool names lack action verbs (e.g., 'project', 'package', 'version' are nouns, not verb_noun patterns like 'get_project', 'get_package'); (6) No pagination support documented despite deps.dev API likely returning large result sets. The code shows basic input validation but no guidance for LLM recovery.
Resolved dependency graph for a (system, name, version).
Package metadata.
Project metadata (github | gitlab | bitbucket).
Query packages/versions (by hash, repo URL, etc).
Single version of a package (deps, advisories, license).
Tool names are nouns, not action verbs. 'project', 'package', 'version', 'dependencies', 'query' lack the verb_noun pattern (get_project, get_package, etc.). LLMs infer intent from names, bare nouns are ambiguous.
Parameter descriptions are minimal or missing. 'system_' has no format guidance (should specify 'One of: NPM, PYPI, GO, MAVEN, NUGET, CARGO, RUBYGEMS'). 'query' just says 'Query body, see docs' without explaining structure. LLMs cannot infer valid inputs from bare names.
No enum constraints in schemas. 'system_' and 'project_type' accept free-form strings despite known valid values. Enums are self-documenting and prevent hallucinated values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Output schemas are completely undocumented. No description of what fields each tool returns, their types, or structure. LLMs cannot plan multi-step calls or extract required IDs for chaining.
Error messages are generic and non-actionable. 'deps.dev: not found' or 'deps.dev: 500' give LLMs no recovery path. Should include 'Try search_packages() with a partial name' or similar guidance.