MCP server for real-time package health, vulnerability scanning, and dependency graphs
Three tools with basic descriptions and input schemas, but significant gaps in parameter documentation and output schema clarity. All tools are READ_ONLY and well-intentioned, but descriptions lack actionable context for LLM selection. Parameter descriptions are minimal (e.g., 'The name of the package to query' is generic). No output schemas documented. Error handling is implicit (httpx.raise_for_status) with no recovery guidance. Tool names follow verb_noun convention (get_*, check_*) which is good, but descriptions don't explain WHEN to use each tool vs. alternatives or what downstream tools expect.
Query OSV.dev for known CVEs / vulnerabilities for a given package+version.
Return direct dependencies for a PyPI package.
Return health metrics for a package: latest version, release age, license.
Output schemas not documented. LLMs cannot plan downstream tool calls or extract required fields. E.g., get_package_health returns a dict with 'name', 'version', 'license', etc., but this is not declared in the tool definition.
Parameter descriptions are generic and lack actionable constraints. 'The name of the package to query' does not explain format, case sensitivity, or what happens if the package is not found. No guidance on valid values or error recovery.
Error handling is implicit (httpx.raise_for_status). No recovery guidance for LLMs. If a package is not found (404), the LLM receives a raw HTTP error with no suggestion to search for similar names or check spelling.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Tool descriptions lack context for selection. 'Return health metrics for a package' does not explain WHEN to call this vs. check_vulnerabilities, or what 'health' means (version age? maintenance status?). LLMs cannot disambiguate.
get_dependency_graph uses fragile string parsing (split on ';', '>=', '==', etc.) to extract package names from requires_dist. No validation or error handling if parsing fails. Malformed requirements could silently produce incorrect results.