Vigía
Server Details
What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.
- Status
- Healthy
- Uptime
- 99.8% over 22 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- Repository
- MatiasDelosSantos/vigia
- GitHub Stars
- 0
- Server Listing
- Vigia
TDQS
Scored across 12 tools
Each tool has a distinct primary purpose, and descriptions explicitly cross-reference alternatives (e.g., package_status vs version_status vs list_versions). The only mild overlap is changes_since_cutoff vs recent_changes, but their scopes differ (curated major-change summary vs raw change feed).
All names use lowercase snake_case, with a consistent entity_status pattern for status tools (package_status, version_status, model_status, eol_status) and verb_noun for actions (find_package, list_versions, check_dependencies). A few names like changes_since_cutoff break the verb/noun pattern but remain readable.
12 tools is well within the ideal 3–15 range, and each tool covers a distinct facet (package, version, runtime, model, dependency audit, upgrade analysis, symbol lookup) without redundancy.
The surface covers package/version/runtime/model lifecycles, dependency auditing, compatibility, and upgrade impact thoroughly. Minor gaps exist: symbol_status and upgrade_impact are npm-only, and there is no direct cross-ecosystem vulnerability search beyond version-level checks.
Available Tools
12 toolschanges_since_cutoffWhat changed since my knowledge cutoffARead-onlyInspect
Returns what happened in software after a given date, so an agent can patch the gap between its training data and today: packages among the most popular on npm, PyPI, crates.io and Packagist that shipped a NEW MAJOR VERSION after the date (with the version that existed at that date, the new majors and their first release dates, the latest version, and an upgrade-guide link when one exists), runtimes, frameworks and platforms released or ended since (Python, Node.js, PHP, Java, Django, Laravel, Ubuntu, PostgreSQL and about 35 more), runtimes ending within 180 days, and AI models released since by the main providers with their prices. Read-only and requires no authentication. Results are computed from registry publication dates and cached for an hour. Coverage is the most popular packages (not every package), 0.x-to-0.y changes and calendar-versioned packages are not reported as major versions, and deprecations that happened before Vigia started tracking are not listed. Use it once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot. To dig into one package use upgrade_impact (npm) or package_status; for one runtime use eol_status.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of packages in new_major_versions, most popular first, from 1 to 100 (default 30) | |
| cutoff | Yes | The month or date your training data ends, as YYYY-MM (the last day of that month is used) or YYYY-MM-DD, for example "2025-06". It must be a past date after 2015 | |
| ecosystems | No | Restrict the package list to these ecosystems; omit for all four |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, it discloses auth (none required), derivation (computed from registry publication dates), caching (one hour), and — crucially — coverage limits and exclusions (popular packages only, 0.x-to-0.y not reported as majors, calendar-versioned packages, pre-tracking deprecations). These constraints materially affect how an agent should interpret empty or partial results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and scope are front-loaded, and the dense parenthetical enumerations each carry distinct, load-bearing information rather than filler. It is a long block of prose, which costs a little readability, but nearly every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the full burden of describing the return shape, and it does so item by item (version at cutoff date, new majors with first release dates, latest version, upgrade-guide link, runtimes ending within 180 days, AI models with prices). Combined with the stated coverage caveats, an agent has everything needed to call and interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so cutoff format, limit bounds and the ecosystems enum are already fully documented in the schema. The description restates what is returned rather than adding parameter syntax or defaults beyond it, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns what happened in software after a given date') and then enumerates exactly what is returned: new major versions across npm/PyPI/crates/Packagist, runtimes/frameworks released or ended, EOL windows, and AI model releases with prices. It explicitly distinguishes itself from sibling tools (upgrade_impact, package_status, eol_status) so an agent can route correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot') and names three alternatives with the conditions that select them. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_dependenciesCheck dependenciesARead-onlyInspect
Audits a whole manifest in one call. For every dependency in a package.json (dependencies and devDependencies) or a requirements.txt it returns the latest version, whether the declared range includes it (up_to_date / outdated / outdated_major / unpinned / unsupported_spec), how many major versions behind it is, whether the package is deprecated, and the OSV vulnerability IDs of the lowest version the range allows; a summary with counts comes first. Read-only and requires no authentication. Nothing is stored. Up to 300 dependencies are handled per call; packages Vigia does not track yet are resolved live (up to 40 per call), and the rest come back as not_resolved_yet with retry_after_s. Only npm and PyPI manifests are supported. Use it when opening a project or before upgrading its dependencies. For a single package use package_status; for one exact version use version_status.
| Name | Required | Description | Default |
|---|---|---|---|
| manifest | Yes | Complete file content as text (at most 200,000 characters): the JSON of a package.json, or the lines of a requirements.txt (pins, ranges, comments and extras are accepted) | |
| ecosystem | Yes | Format of the manifest you are sending: "npm" for a package.json, "pypi" for a requirements.txt. Cargo.toml and composer.json are not supported |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint and openWorldHint, but the description adds substantial context beyond them: no authentication needed, nothing stored, a 300-dependency cap, a 40-live-resolution cap with not_resolved_yet/retry_after_s behavior, and the supported ecosystems. That is genuinely useful operational detail, though it does not quantify per-dependency latency or caching.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose, then the return payload, then constraints and routing — a sensible order. It is somewhat dense and the 'Only npm and PyPI manifests are supported' line partially duplicates the ecosystem enum, but nearly every sentence carries weight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so thoroughly: each status enum (up_to_date/outdated/outdated_major/unpinned/unsupported_spec), the summary-first ordering, deprecation, OSV IDs, and the unresolved-path behavior are all disclosed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the schema already documents the manifest content and ecosystem enum. The description only restates supported formats (package.json/requirements.txt), adding little syntactic or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Audits a whole manifest in one call') and immediately distinguishes itself from siblings by naming package_status and version_status as the single-package/single-version alternatives. The scope (whole manifest, npm/PyPI only) is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names when to use it ('when opening a project or before upgrading its dependencies') and routes to the correct alternatives ('For a single package use package_status; for one exact version use version_status'). No inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eol_statusSoftware end-of-life statusARead-onlyInspect
Tells whether a language, runtime, framework, database or operating-system version is still supported and when it reaches end of life. Covers about 480 products (Python, Node.js, PHP, Java, Ruby, Go, Rust, Django, Laravel, Rails, React, Angular, PostgreSQL, MySQL, Ubuntu, Debian, Kubernetes and more). With product and version it returns that version's status (supported / security_only / end_of_life / upcoming), its release, active-support and end-of-life dates, days remaining or elapsed, and the cycles that are still supported; with only product it returns every release cycle; with neither it lists the product identifiers. Read-only and requires no authentication. Status is computed on every call from today's date; the dates come from endoflife.date and are refreshed every 12 hours. Use it before choosing a runtime or base image, when writing a Dockerfile or CI matrix, or when auditing an old version. It concerns the language, runtime or platform itself; for a library's own versions use package_status.
| Name | Required | Description | Default |
|---|---|---|---|
| product | No | Product identifier or alias, case-insensitive, e.g. "python", "nodejs" (alias "node"), "php", "ubuntu", "django". Call the tool without arguments to list every identifier | |
| version | No | Version or release cycle, e.g. "3.9", "18" or "22.04"; a patch version such as "3.9.7" is matched to its cycle "3.9". Requires product |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true, but the description adds substantial context the agent could not infer: no authentication required, status is recomputed on every call from today's date, upstream data from endoflife.date refreshes every 12 hours, and the result shape changes with the argument combination. The freshness/staleness caveat is exactly the kind of behavioral disclosure annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then coverage breadth, behavioral semantics, freshness, and usage — a logical order with no filler sentences. It is on the long side for a two-parameter tool, and the product enumeration list of ~18 example names could be trimmed, since the schema already gives aliases and the no-arg call lists identifiers.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description carries the full burden of explaining return values — and it does, enumerating the four status values, release/active-support/EOL dates, days remaining or elapsed, and supported cycles. Combined with the authentication, freshness, and routing details, nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so per-parameter formats and aliases are already documented, but the description adds combinatorial semantics the schema does not express: product+version returns that cycle's status, product alone returns every release cycle, and neither argument lists all product identifiers. That mapping is genuinely useful, though it restates some schema content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a precise verb+resource ('Tells whether a language, runtime, framework, database or operating-system version is still supported') and scopes the domain to ~480 named products. It explicitly carves out its boundary against the sibling package_status ('for a library's own versions use package_status'), so an agent can route correctly without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete triggering scenarios — before choosing a runtime or base image, writing a Dockerfile or CI matrix, auditing an old version — and names the alternative tool (package_status) for the adjacent library-version use case. Both when-to-use and when-to-use-something-else are stated, not inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_compatible_versionNewest compatible versionARead-onlyInspect
Finds the newest stable, non-withdrawn version of a package whose own declared requirements admit the runtimes you give it: npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version (minimum Rust), PHP require.php and required packages. Returns the best version with the per-constraint checks, the newest release that is incompatible together with the reason it fails, and a list of unverified constraints (a version that declares nothing for a constraint is not counted against it but is flagged). Read-only and requires no authentication. If per-version requirement data for a package is still being loaded, the result has status "requirements_not_synced_yet" and retry_after_s. Use it when a project is pinned to an older Node, React, Python, Rust or PHP and the latest release may not support it. For the plain latest version use package_status; to check whether the runtime itself is still supported use eol_status.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact package name, e.g. "vite", "django", "tokio" or "laravel/framework" | |
| with | Yes | Comma-separated name@version constraints. npm: "node@18,react@18"; pypi: "python@3.8"; crates: "rust@1.70"; packagist: "php@8.1" or other packages such as "illuminate/support@10". A bare major such as "18" means any 18.x | |
| ecosystem | Yes | Registry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, but the description adds real behavioral context: no authentication required, the full shape of the result (best version, incompatible newest release with reason, unverified constraints, per-constraint checks), and the transient requirements_not_synced_yet status with retry_after_s. This meaningfully exceeds the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core definition and scoping before the return-value detail and the alternatives. It is dense and long, but nearly every clause adds distinct information (constraint semantics, retry status, when-to-use, alternatives); a small amount of compression is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so fully – best version, per-constraint checks, incompatible release plus reason, unverified constraints, and the transient status field. Combined with the when-to-use guidance and named alternatives, an agent has everything needed to select and call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the schema already documents all three parameters including the with-constraint format. The description adds semantic value by enumerating which runtime constraints are actually evaluated per ecosystem (npm engines/peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), which goes beyond the schema's examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource (finds the newest stable, non-withdrawn version of a package) with the key qualifier that the package's declared requirements must admit the given runtimes. It distinguishes itself clearly from siblings by naming package_status and eol_status and the conditions under which each is preferred.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the triggering scenario (a project pinned to an older Node, React, Python, Rust or PHP where the latest release may not support it) and names two alternatives with their own selection conditions (package_status for plain latest, eol_status for runtime support). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_packageFind packageARead-onlyInspect
Searches the catalog of tracked packages and AI models by case-insensitive name prefix and returns up to 15 matches ordered by popularity, each with its ecosystem, name and popularity rank. Read-only and requires no authentication. It matches only the beginning of the name (not descriptions or keywords) and covers tracked packages only, about 34,000 across npm, PyPI, crates.io and Packagist. Use it when you do not know the exact package or model name before calling package_status, list_versions or model_status; it is not a way to discover packages by what they do.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Name prefix of 1 to 100 characters, case-insensitive, e.g. "react-q", "serde_" or "anthropic/claude" | |
| ecosystem | No | Optional filter: "npm", "pypi", "crates", "packagist" or "ai" (AI models); omit to search all ecosystems |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description reinforces it with "Read-only and requires no authentication." It adds real behavioral context beyond annotations: a 15-result cap, popularity ordering, prefix-only matching against names, and catalog scope (~34,000 packages across npm, PyPI, crates.io, Packagist). Largely complete, though no note on pagination or how truncation past 15 matches is signalled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the verb, matching rule and result shape before routing guidance. Every sentence carries distinct information — matching semantics, coverage scope, and routing — with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the work of describing returns (up to 15 matches with ecosystem, name and popularity rank). Combined with the catalog scope and the prefix-only limitation, an agent can call this correctly; only the behavior when more than 15 packages match is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, including the enum of ecosystems and the 1-100 character prefix constraint. The description restates prefix matching and ecosystem coverage without adding syntax, defaults, or edge cases the schema lacks. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (searches), resource (catalog of tracked packages and AI models), matching mode (case-insensitive name prefix), result shape and ordering. It is immediately distinguishable from package_status, list_versions and model_status, which it names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ("when you do not know the exact package or model name before calling package_status, list_versions or model_status") plus an explicit when-not ("not a way to discover packages by what they do"). Routing to alternatives is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_versionsList package versionsARead-onlyInspect
Lists the published versions of one package, newest first, each with its publish date, a prerelease flag and whether it is withdrawn (npm: deprecated; PyPI and crates.io: yanked; Packagist: abandoned), plus a maintenance summary: last release date, releases in the last 12 months and an activity label (active / slowing / dormant). Read-only and requires no authentication. A package Vigia does not track yet is fetched live on the first call. Use it to judge release cadence, to see which version was current at a given date, or to check whether a version was ever withdrawn. For only the latest version use package_status; for the vulnerabilities of one version use version_status.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure | |
| limit | No | Maximum number of versions to return, from 1 to 200 (default 30) | |
| ecosystem | Yes | Registry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package") | |
| stable_only | No | When true, prereleases (alpha, beta, rc) are excluded; default false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond readOnlyHint/openWorldHint, it discloses that no authentication is required and that untracked packages are fetched live on the first call — non-obvious side-effect behavior an agent should anticipate. It also maps withdrawal semantics per ecosystem (npm deprecated, PyPI/crates yanked, Packagist abandoned), which is behavioral context the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The output content, behavior disclosures and sibling routing are all front-loaded and each sentence earns its place. The first sentence is dense with field enumerations, but it is information the agent needs rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by enumerating the returned fields and the maintenance summary, plus the ecosystem-specific withdrawal vocabulary. Combined with the auth and live-fetch disclosures, an agent has everything needed to call and interpret the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so ecosystem, name, limit and stable_only are already fully documented in the schema; the description adds no format or syntax details for them. Baseline 3 applies because the schema carries the parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Lists the published versions of one package, newest first') and immediately enumerates the returned fields. It explicitly differentiates itself from siblings package_status and version_status, so an agent can route correctly without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives three concrete use cases (judge release cadence, see which version was current at a date, check withdrawal status) and names both alternatives with the condition that selects each. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
model_statusAI model status and pricingARead-onlyInspect
Looks up AI models in the OpenRouter catalog: price per million input and output tokens in USD, context window, maximum output tokens, knowledge cutoff, supported modalities and announced retirement date, with a status of available / retiring / removed_from_catalog. With model_id it returns that one model (if the id is unknown, a list of similar ids); with provider and/or query it returns up to 40 matching models. Read-only and requires no authentication. Prices are OpenRouter reference prices and may differ from a provider's direct pricing; the catalog is refreshed every 15 minutes. Use it before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired. It does not call, run or benchmark models.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Case-insensitive substring matched against the model id and display name, e.g. "flash" or "haiku" | |
| model_id | No | Exact catalog id in provider/model form, e.g. "anthropic/claude-sonnet-4.5" or "openai/gpt-4o"; when given it takes precedence over the other parameters | |
| provider | No | Provider slug that lists all of its models, matched exactly, e.g. "anthropic", "openai", "google" or "meta-llama" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond readOnlyHint it discloses that no authentication is required, that prices are OpenRouter reference prices that may differ from a provider's direct pricing, that the catalog refreshes every 15 minutes, and how unknown ids are handled (similar-id fallback). These are exactly the operational caveats an agent needs and none are repeatable from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the resource and returned fields before modes and usage triggers, and every sentence carries distinct information. It is a dense single paragraph that runs long, but no sentence is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by enumerating every returned field (prices, context window, max output tokens, knowledge cutoff, modalities, retirement date, status enum values). Nothing needed to call or interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so parameter syntax is covered; the description still adds semantic detail the schema lacks, namely that provider/query return up to 40 matches and that an unknown model_id yields a list of similar ids. The model_id precedence rule is stated in both places, so it is only mildly additive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Looks up AI models in the OpenRouter catalog') and enumerates exactly which fields are returned. It is clearly distinguishable from sibling tools like package_status or eol_status, which cover packages and end-of-life data rather than model catalog entries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names four concrete triggers ('before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired') and an explicit exclusion ('It does not call, run or benchmark models'). The two invocation modes (single model_id vs. provider/query search) are also stated as conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_statusPackage statusARead-onlyInspect
Returns the current state of one package: latest stable version and its publish date, status (active / deprecated / yanked / not_found_in_registry), the deprecation message if any, runtime requirements (npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), license, known security advisories on the latest version, a release-activity summary (active / slowing / dormant) and the sources with their last verification time. Read-only and requires no authentication. A package Vigia does not track yet is fetched live from its registry on the first call (a few seconds); if the name does not exist the result has status not_found_in_registry plus similar-name suggestions. Use it to decide whether to add or recommend a package, or to learn its newest version. For a specific version you already have use version_status; for what breaks when moving between two versions use upgrade_impact; to find a release that fits an older runtime use find_compatible_version; to find a package whose exact name you do not know use find_package.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure | |
| ecosystem | Yes | Registry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond readOnlyHint/openWorldHint, the description discloses no-auth operation, a first-call live-registry fetch with a few-seconds latency cost, caching-implied 'not tracked yet' behavior, and the not_found_in_registry outcome plus similar-name suggestions. Latency and error semantics like these are exactly the context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded and the routing alternatives come last, which is the right order. The middle return-field enumeration is dense and slightly run-on, but every item is substantive information that no output schema supplies, so little is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and only two parameters, the description must carry the return contract itself, and it does: every field of the result is named, including the error/status variants and the advisory and activity summaries. Nothing needed to call or interpret this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents both parameters with examples, enum values, scope syntax and the 'partial names are not accepted' constraint. The prose adds nothing further about name or ecosystem, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (returns the current state of one package) and enumerates exactly what that state includes: version, publish date, status, deprecation message, runtime requirements, license, advisories, activity. It is clearly distinguishable from version_status, upgrade_impact and find_package, which are named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit use cases ('decide whether to add or recommend a package, or to learn its newest version') and then routes the agent away with four named alternatives tied to their triggering conditions (specific version → version_status; migration breakage → upgrade_impact; older runtime → find_compatible_version; unknown name → find_package). This is textbook when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
recent_changesRecent changesARead-onlyInspect
Lists the changes Vigia detected recently, newest first: new package releases (with old and new version), deprecations, yanks and removals, runtime-requirement changes, AI model price changes and model retirement announcements. Each item has the entity, the kind of change, the old and new values and the detection time. Without a name it returns the global feed; with ecosystem and name it returns the change history of that one package or model. Read-only and requires no authentication. History only goes back to when Vigia started tracking the entity, so it is not a package's full release history (use list_versions for that). Use it to find out what happened after your training data ends, or whether a dependency or model has just changed.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Exact package name or, for ecosystem "ai", a model id such as "anthropic/claude-sonnet-4.5"; returns that entity's own change history. Requires ecosystem | |
| limit | No | Maximum number of items to return, from 1 to 50 (default 20) | |
| ecosystem | No | Restrict to one ecosystem: "npm", "pypi", "crates", "packagist" or "ai" (AI models). Required when name is given |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only carry readOnlyHint, so the description adds real behavioral context: no authentication required, newest-first ordering, the per-item shape, and the crucial limitation that history starts at Vigia's tracking start rather than being full release history. Auth and ordering are genuinely useful disclosures, though return format/pagination detail is absent and the read-only claim largely restates the hint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the change taxonomy, then scope rules, then the alternative and use case. The opening enumeration of change kinds is dense but each item earns its place as disambiguation; overall it is slightly long but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by describing item fields (entity, kind, old/new values, detection time). Combined with scope rules, the auth statement, the history limitation and the sibling reference, an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: how omitting name produces the global feed versus supplying ecosystem + name producing one entity's history. The enum values and limit bounds are left to the schema, which is fine.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (lists) and resource (changes Vigia detected) and enumerates the change kinds covered. It also distinguishes the tool's feed scope from list_versions, so an agent can tell it apart from siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly frames when to reach for it ('find out what happened after your training data ends, or whether a dependency or model has just changed') and names the sibling to use instead for full release history (list_versions). The scoping rule (no name = global feed; ecosystem + name = single-entity history) further pins down usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
symbol_statusDoes this API exist in this version?ARead-onlyInspect
Checks whether an exported function, class, type or constant (or a Class.member) exists in a specific version of an npm package, using the package's TypeScript declarations. Returns whether it was found, its kind, its exact signature, the module path to import it from, whether it is deprecated (with the deprecation message) and, when it is not found, close-name suggestions. Read-only and requires no authentication. The first lookup for a package version can take up to about 25 seconds while its types are analyzed; a result with status "pending" and retry_after_s means call again after that delay. Limits: npm packages with TypeScript types only; exports that exist at runtime but have no type declaration are not visible. Use it before writing code that calls a library API you are not sure exists, or has the same signature, in the installed version, especially after a major upgrade. For a complete list of what changed between two versions use upgrade_impact.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | npm package name, e.g. "next", "zod" or "@tanstack/react-query" | |
| module | No | Restrict the lookup to one import path (a subpath export), e.g. "next/headers"; omit to search every exported module of the package | |
| symbol | Yes | Exported name or Class.member, letters, digits, "$" and "_" only, case-sensitive, e.g. "cookies", "z" or "ZodError.flatten" | |
| version | No | Exact version such as "15.0.0", or a major such as "15" (resolved to its latest stable release); omit for the latest stable release |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover readOnlyHint and openWorldHint, and the description adds substantially more: no authentication required, a first-lookup latency of ~25 seconds, a 'pending' status with retry_after_s to poll, and the visibility limit that runtime-only exports without type declarations are not found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is dense but front-loaded: what it checks, then what it returns, then latency/retry behavior, then limits and usage. Every sentence carries information, though the single long first sentence is heavy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so fully (found flag, kind, signature, import module path, deprecation plus message, close-name suggestions), and it also covers latency, async retry, and applicability limits for a 4-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter (name, module, symbol, version) already documented including examples and version-resolution rules. The description adds no parameter-level syntax or constraint beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Checks whether an exported function, class, type or constant ... exists in a specific version of an npm package') and names the mechanism (TypeScript declarations). It is clearly distinguishable from siblings like find_compatible_version or version_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('Use it before writing code that calls a library API you are not sure exists ... especially after a major upgrade') and routes to the alternative for a different need ('For a complete list of what changed between two versions use upgrade_impact'). Scope limits are also stated, so the agent knows when this tool will not help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upgrade_impactUpgrade impact (what breaks)ARead-onlyInspect
Reports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed exports and import paths, changed function signatures and class or interface members, newly deprecated APIs, changed engines and peerDependencies, and the changelog sections published in between. Returns a summary with counts and a likely_breaking flag, followed by the before/after detail of each change. Read-only and requires no authentication. The first request for a version pair can take up to about 25 seconds while the analysis runs; if it is still running the result has status "pending" and retry_after_s, and you should call again after that delay. Limits: only npm packages that ship TypeScript types (or have @types) can be analyzed, and behavior changes that do not alter types (for example new caching defaults) are invisible, so also read the returned changelog. Use it BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one. For one API in one version use symbol_status; for vulnerabilities use version_status; to choose a version that fits an older runtime use find_compatible_version.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | The version to move to, in the same formats; omit for the latest stable release. It must be newer than "from" | |
| from | Yes | The version you are on: an exact version such as "14.2.3", or a major such as "14", which resolves to the latest stable release of that major | |
| name | Yes | npm package name, e.g. "next" or "@tanstack/react-query" (scoped names allowed). PyPI, crates.io and Packagist packages are not supported by this tool |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Although annotations already declare readOnlyHint and openWorldHint, the description adds substantial context beyond them: no authentication required, ~25s first-request latency, a 'pending' status with retry_after_s and retry guidance, the types-only analysis method, and the blind spot for non-type behavior changes. It also describes the return shape (summary with counts and likely_breaking flag plus before/after detail).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and method, then output shape, operational traits, limits, and finally alternatives. Every sentence carries distinct, load-bearing information with no filler despite the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description explains the return contents (summary counts, likely_breaking flag, per-change before/after), the pending/retry flow, scope limits, and unsupported registries. An agent has everything needed to call and interpret it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so 'from' and 'to' formats and the newer-than constraint are fully documented in the schema. The description adds the version-pair pairing concept but no syntax the schema lacks, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb and resource ('Reports what changes between two versions of an npm package by diffing the public TypeScript API') and enumerates exactly what is diffed (exports, import paths, signatures, members, deprecations, engines/peerDependencies, changelog). This is immediately distinguishable from sibling tools like symbol_status or version_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit use cases ('BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one') and routes three alternative scenarios to named siblings: symbol_status for one API in one version, version_status for vulnerabilities, find_compatible_version for runtime fit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
version_statusVersion status and vulnerabilitiesARead-onlyInspect
Reports on one exact version of an npm, PyPI, crates.io or Packagist package: whether that version exists, when it was published, whether it is withdrawn (npm deprecated, PyPI and crates.io yanked, Packagist abandoned), how many stable releases and major versions it is behind the latest, and its known vulnerabilities from OSV with severity, summary, the version that fixes each one, and the single nearest version that fixes all of them (null if any has no fix). Read-only and requires no authentication. Vulnerability data is cached for up to 6 hours, and the response states when OSV could not be reached. Use it before keeping, pinning or recommending a specific version, or when auditing one lockfile entry. For the latest version and general package health use package_status; to audit a whole manifest at once use check_dependencies.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure | |
| version | Yes | Exact version string as published, e.g. "4.17.1", "2.25.0" or "1.0.100". Ranges and tags such as "^4" or "latest" are not accepted | |
| ecosystem | Yes | Registry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only and open-world, but the description adds materially: no authentication required, vulnerability data cached up to 6 hours, and explicit disclosure that the response signals when OSV could not be reached. This degradation/caching behavior is not derivable from the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly information-dense with no filler: the long opening sentence packs the full report surface, followed by auth/caching caveats and then routing guidance. The first sentence is a run-on with many comma-linked clauses, which slightly hurts front-loading, but every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the full burden of return-value disclosure, and it does so thoroughly: existence, publish date, withdrawal semantics per registry, version-behind counts, and vulnerability fields including severity, summary, fixing version and nearest universal fix. Complete for a read-only query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents name, version and ecosystem, including the enum values and format constraints. The description restates the ecosystem list but adds no syntax or format guidance beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource: reports on one exact version of a package across four named ecosystems, enumerating exactly what is reported (existence, publish date, withdrawn status, versions behind, vulnerabilities with fixes). It explicitly names sibling tools (package_status, check_dependencies) so an agent can distinguish scope without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use triggers (before keeping, pinning or recommending a version; auditing one lockfile entry) and names the alternatives for adjacent jobs — package_status for latest/overall health, check_dependencies for whole-manifest audits. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Added
changes_since_cutoff
12 tool updates
- Changed
check_dependencies2 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Manifest type: npm = package.json, pypi = requirements.txt"New value: +"Format of the manifest you are sending: \"npm\" for a package.json, \"pypi\" for a requirements.txt. Cargo.toml and composer.json are not supported" - changed
Input schema / properties / manifest / descriptionPrevious value: -"Full content of the manifest file"New value: +"Complete file content as text (at most 200,000 characters): the JSON of a package.json, or the lines of a requirements.txt (pins, ranges, comments and extras are accepted)"
- Changed
eol_status2 fields changed- changed
Input schema / properties / product / descriptionPrevious value: -"Product identifier or alias, e.g. \"python\", \"nodejs\", \"php\", \"ubuntu\", \"django\""New value: +"Product identifier or alias, case-insensitive, e.g. \"python\", \"nodejs\" (alias \"node\"), \"php\", \"ubuntu\", \"django\". Call the tool without arguments to list every identifier" - changed
Input schema / properties / version / descriptionPrevious value: -"Version or cycle, e.g. \"3.9\", \"3.9.7\", \"18\", \"22.04\""New value: +"Version or release cycle, e.g. \"3.9\", \"18\" or \"22.04\"; a patch version such as \"3.9.7\" is matched to its cycle \"3.9\". Requires product"
- Changed
find_compatible_version3 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")" - changed
Input schema / properties / name / descriptionPrevious value: -"Package name"New value: +"Exact package name, e.g. \"vite\", \"django\", \"tokio\" or \"laravel/framework\"" - changed
Input schema / properties / with / descriptionPrevious value: -"Comma-separated constraints: \"node@18,react@18\" (npm), \"python@3.8\" (pypi), \"rust@1.70\" (crates) or \"php@8.1\" (packagist)"New value: +"Comma-separated name@version constraints. npm: \"node@18,react@18\"; pypi: \"python@3.8\"; crates: \"rust@1.70\"; packagist: \"php@8.1\" or other packages such as \"illuminate/support@10\". A bare major such as \"18\" means any 18.x"
- Changed
find_package2 fields changed- added
Input schema / properties / ecosystem / descriptionAdded value: +"Optional filter: \"npm\", \"pypi\", \"crates\", \"packagist\" or \"ai\" (AI models); omit to search all ecosystems" - added
Input schema / properties / query / descriptionAdded value: +"Name prefix of 1 to 100 characters, case-insensitive, e.g. \"react-q\", \"serde_\" or \"anthropic/claude\""
- Added
list_versions - Removed
model_info - Added
model_status - Changed
package_status2 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")" - changed
Input schema / properties / name / descriptionPrevious value: -"Exact package name, e.g. \"next\", \"@types/node\", \"requests\""New value: +"Exact package name as published (case-insensitive), e.g. \"next\", \"@types/node\" (npm scopes allowed), \"requests\", \"serde\", \"laravel/framework\". Partial names are not accepted; use find_package when unsure"
- Changed
recent_changes3 fields changed- added
Input schema / properties / ecosystem / descriptionAdded value: +"Restrict to one ecosystem: \"npm\", \"pypi\", \"crates\", \"packagist\" or \"ai\" (AI models). Required when name is given" - added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of items to return, from 1 to 50 (default 20)" - changed
Input schema / properties / name / descriptionPrevious value: -"If set, history of that package or model"New value: +"Exact package name or, for ecosystem \"ai\", a model id such as \"anthropic/claude-sonnet-4.5\"; returns that entity's own change history. Requires ecosystem"
- Changed
symbol_status4 fields changed- changed
Input schema / properties / module / descriptionPrevious value: -"Optional import path to restrict the lookup, e.g. \"next/headers\""New value: +"Restrict the lookup to one import path (a subpath export), e.g. \"next/headers\"; omit to search every exported module of the package" - changed
Input schema / properties / name / descriptionPrevious value: -"npm package name"New value: +"npm package name, e.g. \"next\", \"zod\" or \"@tanstack/react-query\"" - changed
Input schema / properties / symbol / descriptionPrevious value: -"Exported name, or Class.member, e.g. \"cookies\" or \"ZodError.flatten\""New value: +"Exported name or Class.member, letters, digits, \"$\" and \"_\" only, case-sensitive, e.g. \"cookies\", \"z\" or \"ZodError.flatten\"" - changed
Input schema / properties / version / descriptionPrevious value: -"Exact version or major; default: latest"New value: +"Exact version such as \"15.0.0\", or a major such as \"15\" (resolved to its latest stable release); omit for the latest stable release"
- Changed
upgrade_impact3 fields changed- changed
Input schema / properties / from / descriptionPrevious value: -"Current version or major, e.g. \"14\" or \"14.2.3\""New value: +"The version you are on: an exact version such as \"14.2.3\", or a major such as \"14\", which resolves to the latest stable release of that major" - changed
Input schema / properties / name / descriptionPrevious value: -"npm package name, e.g. \"next\" or \"@tanstack/react-query\""New value: +"npm package name, e.g. \"next\" or \"@tanstack/react-query\" (scoped names allowed). PyPI, crates.io and Packagist packages are not supported by this tool" - changed
Input schema / properties / to / descriptionPrevious value: -"Target version or major; default: latest"New value: +"The version to move to, in the same formats; omit for the latest stable release. It must be newer than \"from\""
- Changed
version_status3 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")" - changed
Input schema / properties / name / descriptionPrevious value: -"Exact package name"New value: +"Exact package name as published (case-insensitive), e.g. \"next\", \"@types/node\" (npm scopes allowed), \"requests\", \"serde\", \"laravel/framework\". Partial names are not accepted; use find_package when unsure" - changed
Input schema / properties / version / descriptionPrevious value: -"Exact version, e.g. \"4.17.1\""New value: +"Exact version string as published, e.g. \"4.17.1\", \"2.25.0\" or \"1.0.100\". Ranges and tags such as \"^4\" or \"latest\" are not accepted"
7 tool updates
- Changed
check_dependencies1 field changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem"New value: +"Manifest type: npm = package.json, pypi = requirements.txt"
- Added
eol_status - Changed
find_compatible_version3 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")" - changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi" -]New value: +[ + "npm", + "pypi", + "crates", + "packagist" +] - changed
Input schema / properties / with / descriptionPrevious value: -"Comma-separated constraints: \"node@18,react@18\" (npm) or \"python@3.8\" (pypi)"New value: +"Comma-separated constraints: \"node@18,react@18\" (npm), \"python@3.8\" (pypi), \"rust@1.70\" (crates) or \"php@8.1\" (packagist)"
- Changed
find_package1 field changed- changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi", - "ai" -]New value: +[ + "npm", + "pypi", + "crates", + "packagist", + "ai" +]
- Changed
package_status2 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")" - changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi" -]New value: +[ + "npm", + "pypi", + "crates", + "packagist" +]
- Changed
recent_changes1 field changed- changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi", - "ai" -]New value: +[ + "npm", + "pypi", + "crates", + "packagist", + "ai" +]
- Changed
version_status2 fields changed- changed
Input schema / properties / ecosystem / descriptionPrevious value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")" - changed
Input schema / properties / ecosystem / enumPrevious value: -[ - "npm", - "pypi" -]New value: +[ + "npm", + "pypi", + "crates", + "packagist" +]
3 tool updates
- Added
find_compatible_version - Added
symbol_status - Added
upgrade_impact
1 tool update
- Added
version_status
5 tool updates
- First observed
check_dependencies - First observed
find_package - First observed
model_info - First observed
package_status - First observed
recent_changes
Related MCP Connectors
Check exact npm/PyPI upgrades for evidence-backed breaking changes; query APIs and components.
npm & PyPI freshness for AI agents: latest version, deprecations, dated breaking-change diffs.
Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
Latest versions, LTS windows, and EOL dates for 300+ products. Fresh ground truth for stale models.
Related MCP Servers
- AlicenseAqualityCmaintenanceChecks npm and PyPI packages for outdated versions, deprecation status, and breaking changes with cited sources, enabling AI agents to verify dependency freshness.18 npmISC
- AlicenseAqualityAmaintenanceDependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.91,229 npm2Apache 2.0
- AlicenseAqualityCmaintenanceBreaking-change diffs for npm packages, served over REST and MCP, so coding agents stop writing code against outdated API knowledge.2Functional Source , Version 1.1, MIT Future
- AlicenseNot gradedqualityCmaintenanceEnables users to look up package versions, scan for vulnerabilities, and analyze dependencies across multiple registries (npm, Maven, PyPI, etc.) using exact version recommendations for security.4MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.