Give it npm or PyPI package names. For each it reads the registry metadata and latest version (and npm download counts) and queries OSV.dev for known security advisories, then composes a risk brief: known vulnerabilities, deprecation, staleness and a signal. Keyless, agent-callable. One search per call (result caps in the input schema); failed lookups are not charged.