Loading ToolBench

Reading the current corpus…

vetpkg MCP server · C · ToolBench

← Browse

vetpkg

github.com/kiansaeidnia/vetpkg

Catch hallucinated and squatted packages before an AI agent installs them. MCP server + CLI, zero dependencies.

2026-07-28+STDIO2 tools

69/100

Definition Quality77

Protocol Readiness50

SupportabilityNot measured-

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

vetpkg provides two well-named, focused tools with clear descriptions and proper input schemas. Tool names (check_package, check_packages) follow verb_noun convention and clearly convey intent. Descriptions are concise (80-120 chars) and explain the security purpose. Input schemas are properly typed with required fields. However, output schemas are not documented in the MCP registration, the code shows rich return objects (verdict, risk, reasons, meta, similar) but these are not formally declared in the tool definitions. Parameter descriptions are minimal (single short phrases). Error handling is present in the implementation but not surfaced in tool documentation. The tools are read-only and well-scoped, but lack the output schema documentation and parameter detail expected of production-grade tools.

Tools (2)

check_packageread onlysource verified77/100

Verify that an npm package is real and safe before installing it. Detects hallucinated package names that do not exist, and slopsquats — attacker-registered packages whose names imitate popular ones. Call this before running any install command.

check_packagesread onlysource verified77/100

Verify several npm packages at once before installing them. Use when adding multiple dependencies in one step.

Issues (4)

HIGHtool ↗

Output schemas not documented. Tools return complex objects (verdict, risk, reasons, meta, similar) but MCP tool definitions do not declare the response structure. LLMs cannot plan downstream operations or extract fields without seeing the schema.

check_packagecheck_packages

MEDIUMtool-description ↗

Parameter descriptions are minimal. 'npm package names to check' for check_packages.names lacks detail on format (scoped vs unscoped), length limits, or invalid characters. LLMs cannot validate input without explicit constraints.

check_packagecheck_packages

MEDIUMrecovery-guide ↗

No error recovery guidance in tool descriptions. Implementation catches errors and returns {verdict: 'error', error: message}, but the tool description does not explain this behavior or guide the LLM on retry logic.

check_packagecheck_packages

LOWtool ↗

Recommendations

Add formal output schema documentation to both tools. Document the verdict enum (trusted|caution|suspicious|blocked|not_found|error), risk score range (0-100), reasons array structure, and meta object fields (description, created, modified, versionCount, latestVersion, weeklyDownloads, repository, license, deprecated).
Expand parameter descriptions with format constraints. For check_package.name: 'npm package name (e.g. "express" or "@scope/pkg"). Scoped packages use @org/name format. Max 214 characters per npm spec.' For check_packages.names: 'Array of npm package names. Each name follows the same format as check_package. Recommended max 50 names per call for performance.'
Document error handling in tool descriptions. Add: 'Returns verdict="error" if the package registry is unreachable or the name is invalid. The error field contains a human-readable message. Retry with exponential backoff for transient failures.'
Add readOnlyHint annotation to both tools in the MCP server definition to signal they do not modify state and are safe to call repeatedly.
Include a 'When to use' section in descriptions. E.g., 'Call before running npm install to detect hallucinated or typosquatted packages. Use check_packages for bulk dependency validation in CI/CD pipelines.'

Score history

Overall score trend

First recorded score · v2 rubric

69/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	C	69	2026-07-28+	v2