Query package, dependency, project, and advisory data from deps.dev.
Strong foundation with 10 well-named, read-only tools backed by clear descriptions and structured input schemas. All tools follow verb_noun naming (depsdev_get_*, depsdev_find_*). Descriptions are concise (50-200 chars) and explain WHAT and WHEN. Input parameters have types and descriptions. However, output schemas are inferred from Go struct tags rather than explicitly documented in the MCP schema registration, limiting LLM visibility into response structure. No pagination support despite tools that could return large result sets. Error handling is basic, no recovery guidance or actionable error messages visible in the code.
Find whether an exact npm, Cargo, Maven, or PyPI package version pulls in a target, returning each resolved target version and one compact chain back to the root. Resolved requirements may differ from declarations because of environment markers; use depsdev_get_requirements to inspect declarations.
Generate a Graphviz DOT dependency graph for an exact npm, Cargo, Maven, or PyPI package version.
Get details for an OSV security advisory.
Get the resolved dependency graph for an exact npm, Cargo, Maven, or PyPI package version.
Get package metadata and all known versions, including the default version.
Get metadata for a known GitHub, GitLab, or Bitbucket project.
Output schemas not explicitly documented in MCP tool registration. Go struct tags define response shape (Output[T], Cached bool), but LLMs cannot inspect these at runtime. Responses are structured but opaque to the agent.
No pagination support. Tools like depsdev_get_package and depsdev_get_project_package_versions may return large result sets (all known versions, all package mappings) without limit/offset/page parameters. Large responses risk context window exhaustion.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Get known mappings between a GitHub, GitLab, or Bitbucket project and package versions.
Get ecosystem-specific declared dependency requirements for an exact package version.
Get metadata for an exact package version, including licenses, advisories, links, and attestations.
Query package versions by a version key, artifact content hash, or both, using deps.dev v3 query parameters.
Error handling is implicit. Code validates inputs (validatePackage, validateVersion, require) but error messages are not visible in the source. No recovery guidance (e.g., 'Try search_packages() with a partial name') or error classification (retryable vs fatal).
depsdev_query parameter description is vague. 'deps.dev v3 query string' with example 'versionKey.system=NPM&...' does not explain what queries are valid, what fields are queryable, or what constraints apply. LLMs will hallucinate invalid query strings.
Parameter 'system' is repeated across 7 tools with identical description but no enum constraint. Valid values (go, rubygems, npm, cargo, maven, pypi, nuget) are documented in text but not enforced as an enum. LLMs may pass invalid ecosystems.