Loading ToolBench
MCP server that lets a coding agent see how stale, deprecated, or risky a project's npm dependencies are — feed it a package.json and get a per-dependency freshness, deprecation, and license report.
Two well-named, verb-led tools with strong descriptions (194 - 250 chars each, well above the 34-char p10 baseline). Input schemas are complete with Zod validation and parameter descriptions. Output is structured text with clear formatting. However, output schemas are not formally documented, LLMs cannot predict response structure. Error handling is present but minimal (fail() returns isError flag without recovery guidance). No tool annotations (readOnlyHint, idempotentHint). Both tools are READ_ONLY and idempotent, but this is not declared in metadata.
Given the contents of a package.json, report every dependency's freshness against the npm registry: how far behind latest it is (patch/minor/major), how many versions behind, whether it's DEPRECATED, and its license. Reach for this when asked to 'update dependencies', 'check what's outdated', 'is anything deprecated', or before a dependency bump — it gives the agent real registry facts instead of guessing from stale training data. Read the repo's package.json and pass its full text as `packageJson`.
Look up one npm package: its latest version, how far a given range/version is behind, deprecation status, and license. Use for a quick one-off check ('is X deprecated?', 'what's the latest Y?', 'how far behind is my Z?') without needing a whole package.json.
Output schemas not documented. LLMs cannot predict response structure (markdown text with tables, callouts, etc.). Responses should be formally typed (e.g. {summary: string, dependencies: [{name, gap, behind, license, deprecated}], majorCount, minorCount, etc.}).
Error handling lacks recovery guidance. fail() returns isError=true with a message, but does not tell the LLM what to do next (e.g. 'Invalid JSON in package.json. Check syntax and retry.' or 'Package not found. Try a different name or check npm registry.').
Tool annotations missing. Both tools are READ_ONLY and idempotent, but inputSchema does not include readOnlyHint or idempotentHint metadata. This prevents clients from optimizing caching and retry logic.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
audit_dependencies accepts packageJson as a string and parses it internally. No validation of JSON structure before parsing, malformed JSON returns a generic error. Should validate and return 'Invalid JSON: expected {dependencies: {...}}' with the specific parse error.
check_package 'range' parameter defaults to 'latest' but description says 'Defaults to latest (reports latest only)', unclear whether passing a range like '^4.17.0' is supported or ignored. Should clarify: 'If omitted, reports latest version only. Pass a semver range (e.g. ^4.17.0) to compare your current version against latest.'