Skip to main content
Glama

Server Details

What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.

Ownership verified
Status
Healthy
Uptime
99.8% over 22 days
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
MatiasDelosSantos/vigia
GitHub Stars
0
Server Listing
Vigia

TDQS

A4.4/5.0

Scored across 12 tools

Disambiguation4/5

Each tool has a distinct primary purpose, and descriptions explicitly cross-reference alternatives (e.g., package_status vs version_status vs list_versions). The only mild overlap is changes_since_cutoff vs recent_changes, but their scopes differ (curated major-change summary vs raw change feed).

Naming Consistency4/5

All names use lowercase snake_case, with a consistent entity_status pattern for status tools (package_status, version_status, model_status, eol_status) and verb_noun for actions (find_package, list_versions, check_dependencies). A few names like changes_since_cutoff break the verb/noun pattern but remain readable.

Tool Count5/5

12 tools is well within the ideal 3–15 range, and each tool covers a distinct facet (package, version, runtime, model, dependency audit, upgrade analysis, symbol lookup) without redundancy.

Completeness4/5

The surface covers package/version/runtime/model lifecycles, dependency auditing, compatibility, and upgrade impact thoroughly. Minor gaps exist: symbol_status and upgrade_impact are npm-only, and there is no direct cross-ecosystem vulnerability search beyond version-level checks.

Available Tools

12 tools
changes_since_cutoffWhat changed since my knowledge cutoffA
Read-only
Inspect

Returns what happened in software after a given date, so an agent can patch the gap between its training data and today: packages among the most popular on npm, PyPI, crates.io and Packagist that shipped a NEW MAJOR VERSION after the date (with the version that existed at that date, the new majors and their first release dates, the latest version, and an upgrade-guide link when one exists), runtimes, frameworks and platforms released or ended since (Python, Node.js, PHP, Java, Django, Laravel, Ubuntu, PostgreSQL and about 35 more), runtimes ending within 180 days, and AI models released since by the main providers with their prices. Read-only and requires no authentication. Results are computed from registry publication dates and cached for an hour. Coverage is the most popular packages (not every package), 0.x-to-0.y changes and calendar-versioned packages are not reported as major versions, and deprecations that happened before Vigia started tracking are not listed. Use it once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot. To dig into one package use upgrade_impact (npm) or package_status; for one runtime use eol_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of packages in new_major_versions, most popular first, from 1 to 100 (default 30)
cutoffYesThe month or date your training data ends, as YYYY-MM (the last day of that month is used) or YYYY-MM-DD, for example "2025-06". It must be a past date after 2015
ecosystemsNoRestrict the package list to these ecosystems; omit for all four

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses auth (none required), derivation (computed from registry publication dates), caching (one hour), and — crucially — coverage limits and exclusions (popular packages only, 0.x-to-0.y not reported as majors, calendar-versioned packages, pre-tracking deprecations). These constraints materially affect how an agent should interpret empty or partial results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and scope are front-loaded, and the dense parenthetical enumerations each carry distinct, load-bearing information rather than filler. It is a long block of prose, which costs a little readability, but nearly every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden of describing the return shape, and it does so item by item (version at cutoff date, new majors with first release dates, latest version, upgrade-guide link, runtimes ending within 180 days, AI models with prices). Combined with the stated coverage caveats, an agent has everything needed to call and interpret this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so cutoff format, limit bounds and the ecosystems enum are already fully documented in the schema. The description restates what is returned rather than adding parameter syntax or defaults beyond it, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Returns what happened in software after a given date') and then enumerates exactly what is returned: new major versions across npm/PyPI/crates/Packagist, runtimes/frameworks released or ended, EOL windows, and AI model releases with prices. It explicitly distinguishes itself from sibling tools (upgrade_impact, package_status, eol_status) so an agent can route correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('once at the start of a coding session, passing the month your training data ends, or when you suspect a library you know has changed a lot') and names three alternatives with the conditions that select them. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_dependenciesCheck dependenciesA
Read-only
Inspect

Audits a whole manifest in one call. For every dependency in a package.json (dependencies and devDependencies) or a requirements.txt it returns the latest version, whether the declared range includes it (up_to_date / outdated / outdated_major / unpinned / unsupported_spec), how many major versions behind it is, whether the package is deprecated, and the OSV vulnerability IDs of the lowest version the range allows; a summary with counts comes first. Read-only and requires no authentication. Nothing is stored. Up to 300 dependencies are handled per call; packages Vigia does not track yet are resolved live (up to 40 per call), and the rest come back as not_resolved_yet with retry_after_s. Only npm and PyPI manifests are supported. Use it when opening a project or before upgrading its dependencies. For a single package use package_status; for one exact version use version_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
manifestYesComplete file content as text (at most 200,000 characters): the JSON of a package.json, or the lines of a requirements.txt (pins, ranges, comments and extras are accepted)
ecosystemYesFormat of the manifest you are sending: "npm" for a package.json, "pypi" for a requirements.txt. Cargo.toml and composer.json are not supported

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint and openWorldHint, but the description adds substantial context beyond them: no authentication needed, nothing stored, a 300-dependency cap, a 40-live-resolution cap with not_resolved_yet/retry_after_s behavior, and the supported ecosystems. That is genuinely useful operational detail, though it does not quantify per-dependency latency or caching.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then the return payload, then constraints and routing — a sensible order. It is somewhat dense and the 'Only npm and PyPI manifests are supported' line partially duplicates the ecosystem enum, but nearly every sentence carries weight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so thoroughly: each status enum (up_to_date/outdated/outdated_major/unpinned/unsupported_spec), the summary-first ordering, deprecation, OSV IDs, and the unresolved-path behavior are all disclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, so the schema already documents the manifest content and ecosystem enum. The description only restates supported formats (package.json/requirements.txt), adding little syntactic or format detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Audits a whole manifest in one call') and immediately distinguishes itself from siblings by naming package_status and version_status as the single-package/single-version alternatives. The scope (whole manifest, npm/PyPI only) is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names when to use it ('when opening a project or before upgrading its dependencies') and routes to the correct alternatives ('For a single package use package_status; for one exact version use version_status'). No inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

eol_statusSoftware end-of-life statusA
Read-only
Inspect

Tells whether a language, runtime, framework, database or operating-system version is still supported and when it reaches end of life. Covers about 480 products (Python, Node.js, PHP, Java, Ruby, Go, Rust, Django, Laravel, Rails, React, Angular, PostgreSQL, MySQL, Ubuntu, Debian, Kubernetes and more). With product and version it returns that version's status (supported / security_only / end_of_life / upcoming), its release, active-support and end-of-life dates, days remaining or elapsed, and the cycles that are still supported; with only product it returns every release cycle; with neither it lists the product identifiers. Read-only and requires no authentication. Status is computed on every call from today's date; the dates come from endoflife.date and are refreshed every 12 hours. Use it before choosing a runtime or base image, when writing a Dockerfile or CI matrix, or when auditing an old version. It concerns the language, runtime or platform itself; for a library's own versions use package_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
productNoProduct identifier or alias, case-insensitive, e.g. "python", "nodejs" (alias "node"), "php", "ubuntu", "django". Call the tool without arguments to list every identifier
versionNoVersion or release cycle, e.g. "3.9", "18" or "22.04"; a patch version such as "3.9.7" is matched to its cycle "3.9". Requires product

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true, but the description adds substantial context the agent could not infer: no authentication required, status is recomputed on every call from today's date, upstream data from endoflife.date refreshes every 12 hours, and the result shape changes with the argument combination. The freshness/staleness caveat is exactly the kind of behavioral disclosure annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then coverage breadth, behavioral semantics, freshness, and usage — a logical order with no filler sentences. It is on the long side for a two-parameter tool, and the product enumeration list of ~18 example names could be trimmed, since the schema already gives aliases and the no-arg call lists identifiers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries the full burden of explaining return values — and it does, enumerating the four status values, release/active-support/EOL dates, days remaining or elapsed, and supported cycles. Combined with the authentication, freshness, and routing details, nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so per-parameter formats and aliases are already documented, but the description adds combinatorial semantics the schema does not express: product+version returns that cycle's status, product alone returns every release cycle, and neither argument lists all product identifiers. That mapping is genuinely useful, though it restates some schema content.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a precise verb+resource ('Tells whether a language, runtime, framework, database or operating-system version is still supported') and scopes the domain to ~480 named products. It explicitly carves out its boundary against the sibling package_status ('for a library's own versions use package_status'), so an agent can route correctly without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete triggering scenarios — before choosing a runtime or base image, writing a Dockerfile or CI matrix, auditing an old version — and names the alternative tool (package_status) for the adjacent library-version use case. Both when-to-use and when-to-use-something-else are stated, not inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_compatible_versionNewest compatible versionA
Read-only
Inspect

Finds the newest stable, non-withdrawn version of a package whose own declared requirements admit the runtimes you give it: npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version (minimum Rust), PHP require.php and required packages. Returns the best version with the per-constraint checks, the newest release that is incompatible together with the reason it fails, and a list of unverified constraints (a version that declares nothing for a constraint is not counted against it but is flagged). Read-only and requires no authentication. If per-version requirement data for a package is still being loaded, the result has status "requirements_not_synced_yet" and retry_after_s. Use it when a project is pinned to an older Node, React, Python, Rust or PHP and the latest release may not support it. For the plain latest version use package_status; to check whether the runtime itself is still supported use eol_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact package name, e.g. "vite", "django", "tokio" or "laravel/framework"
withYesComma-separated name@version constraints. npm: "node@18,react@18"; pypi: "python@3.8"; crates: "rust@1.70"; packagist: "php@8.1" or other packages such as "illuminate/support@10". A bare major such as "18" means any 18.x
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, but the description adds real behavioral context: no authentication required, the full shape of the result (best version, incompatible newest release with reason, unverified constraints, per-constraint checks), and the transient requirements_not_synced_yet status with retry_after_s. This meaningfully exceeds the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core definition and scoping before the return-value detail and the alternatives. It is dense and long, but nearly every clause adds distinct information (constraint semantics, retry status, when-to-use, alternatives); a small amount of compression is possible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so fully – best version, per-constraint checks, incompatible release plus reason, unverified constraints, and the transient status field. Combined with the when-to-use guidance and named alternatives, an agent has everything needed to select and call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the schema already documents all three parameters including the with-constraint format. The description adds semantic value by enumerating which runtime constraints are actually evaluated per ecosystem (npm engines/peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), which goes beyond the schema's examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource (finds the newest stable, non-withdrawn version of a package) with the key qualifier that the package's declared requirements must admit the given runtimes. It distinguishes itself clearly from siblings by naming package_status and eol_status and the conditions under which each is preferred.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly gives the triggering scenario (a project pinned to an older Node, React, Python, Rust or PHP where the latest release may not support it) and names two alternatives with their own selection conditions (package_status for plain latest, eol_status for runtime support). Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_packageFind packageA
Read-only
Inspect

Searches the catalog of tracked packages and AI models by case-insensitive name prefix and returns up to 15 matches ordered by popularity, each with its ecosystem, name and popularity rank. Read-only and requires no authentication. It matches only the beginning of the name (not descriptions or keywords) and covers tracked packages only, about 34,000 across npm, PyPI, crates.io and Packagist. Use it when you do not know the exact package or model name before calling package_status, list_versions or model_status; it is not a way to discover packages by what they do.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesName prefix of 1 to 100 characters, case-insensitive, e.g. "react-q", "serde_" or "anthropic/claude"
ecosystemNoOptional filter: "npm", "pypi", "crates", "packagist" or "ai" (AI models); omit to search all ecosystems

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description reinforces it with "Read-only and requires no authentication." It adds real behavioral context beyond annotations: a 15-result cap, popularity ordering, prefix-only matching against names, and catalog scope (~34,000 packages across npm, PyPI, crates.io, Packagist). Largely complete, though no note on pagination or how truncation past 15 matches is signalled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the verb, matching rule and result shape before routing guidance. Every sentence carries distinct information — matching semantics, coverage scope, and routing — with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the work of describing returns (up to 15 matches with ecosystem, name and popularity rank). Combined with the catalog scope and the prefix-only limitation, an agent can call this correctly; only the behavior when more than 15 packages match is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, including the enum of ecosystems and the 1-100 character prefix constraint. The description restates prefix matching and ecosystem coverage without adding syntax, defaults, or edge cases the schema lacks. Baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (searches), resource (catalog of tracked packages and AI models), matching mode (case-insensitive name prefix), result shape and ordering. It is immediately distinguishable from package_status, list_versions and model_status, which it names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ("when you do not know the exact package or model name before calling package_status, list_versions or model_status") plus an explicit when-not ("not a way to discover packages by what they do"). Routing to alternatives is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_versionsList package versionsA
Read-only
Inspect

Lists the published versions of one package, newest first, each with its publish date, a prerelease flag and whether it is withdrawn (npm: deprecated; PyPI and crates.io: yanked; Packagist: abandoned), plus a maintenance summary: last release date, releases in the last 12 months and an activity label (active / slowing / dormant). Read-only and requires no authentication. A package Vigia does not track yet is fetched live on the first call. Use it to judge release cadence, to see which version was current at a given date, or to check whether a version was ever withdrawn. For only the latest version use package_status; for the vulnerabilities of one version use version_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
limitNoMaximum number of versions to return, from 1 to 200 (default 30)
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")
stable_onlyNoWhen true, prereleases (alpha, beta, rc) are excluded; default false

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint, it discloses that no authentication is required and that untracked packages are fetched live on the first call — non-obvious side-effect behavior an agent should anticipate. It also maps withdrawal semantics per ecosystem (npm deprecated, PyPI/crates yanked, Packagist abandoned), which is behavioral context the annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The output content, behavior disclosures and sibling routing are all front-loaded and each sentence earns its place. The first sentence is dense with field enumerations, but it is information the agent needs rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description compensates by enumerating the returned fields and the maintenance summary, plus the ecosystem-specific withdrawal vocabulary. Combined with the auth and live-fetch disclosures, an agent has everything needed to call and interpret the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so ecosystem, name, limit and stable_only are already fully documented in the schema; the description adds no format or syntax details for them. Baseline 3 applies because the schema carries the parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Lists the published versions of one package, newest first') and immediately enumerates the returned fields. It explicitly differentiates itself from siblings package_status and version_status, so an agent can route correctly without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives three concrete use cases (judge release cadence, see which version was current at a date, check withdrawal status) and names both alternatives with the condition that selects each. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

model_statusAI model status and pricingA
Read-only
Inspect

Looks up AI models in the OpenRouter catalog: price per million input and output tokens in USD, context window, maximum output tokens, knowledge cutoff, supported modalities and announced retirement date, with a status of available / retiring / removed_from_catalog. With model_id it returns that one model (if the id is unknown, a list of similar ids); with provider and/or query it returns up to 40 matching models. Read-only and requires no authentication. Prices are OpenRouter reference prices and may differ from a provider's direct pricing; the catalog is refreshed every 15 minutes. Use it before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired. It does not call, run or benchmark models.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNoCase-insensitive substring matched against the model id and display name, e.g. "flash" or "haiku"
model_idNoExact catalog id in provider/model form, e.g. "anthropic/claude-sonnet-4.5" or "openai/gpt-4o"; when given it takes precedence over the other parameters
providerNoProvider slug that lists all of its models, matched exactly, e.g. "anthropic", "openai", "google" or "meta-llama"

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint it discloses that no authentication is required, that prices are OpenRouter reference prices that may differ from a provider's direct pricing, that the catalog refreshes every 15 minutes, and how unknown ids are handled (similar-id fallback). These are exactly the operational caveats an agent needs and none are repeatable from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the resource and returned fields before modes and usage triggers, and every sentence carries distinct information. It is a dense single paragraph that runs long, but no sentence is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating every returned field (prices, context window, max output tokens, knowledge cutoff, modalities, retirement date, status enum values). Nothing needed to call or interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so parameter syntax is covered; the description still adds semantic detail the schema lacks, namely that provider/query return up to 40 matches and that an unknown model_id yields a list of similar ids. The model_id precedence rule is stated in both places, so it is only mildly additive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource ('Looks up AI models in the OpenRouter catalog') and enumerates exactly which fields are returned. It is clearly distinguishable from sibling tools like package_status or eol_status, which cover packages and end-of-life data rather than model catalog entries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names four concrete triggers ('before writing a model ID in code, choosing between models, estimating costs, or checking whether a model is being retired') and an explicit exclusion ('It does not call, run or benchmark models'). The two invocation modes (single model_id vs. provider/query search) are also stated as conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_statusPackage statusA
Read-only
Inspect

Returns the current state of one package: latest stable version and its publish date, status (active / deprecated / yanked / not_found_in_registry), the deprecation message if any, runtime requirements (npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), license, known security advisories on the latest version, a release-activity summary (active / slowing / dormant) and the sources with their last verification time. Read-only and requires no authentication. A package Vigia does not track yet is fetched live from its registry on the first call (a few seconds); if the name does not exist the result has status not_found_in_registry plus similar-name suggestions. Use it to decide whether to add or recommend a package, or to learn its newest version. For a specific version you already have use version_status; for what breaks when moving between two versions use upgrade_impact; to find a release that fits an older runtime use find_compatible_version; to find a package whose exact name you do not know use find_package.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint, the description discloses no-auth operation, a first-call live-registry fetch with a few-seconds latency cost, caching-implied 'not tracked yet' behavior, and the not_found_in_registry outcome plus similar-name suggestions. Latency and error semantics like these are exactly the context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the routing alternatives come last, which is the right order. The middle return-field enumeration is dense and slightly run-on, but every item is substantive information that no output schema supplies, so little is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and only two parameters, the description must carry the return contract itself, and it does: every field of the result is named, including the error/status variants and the advisory and activity summaries. Nothing needed to call or interpret this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents both parameters with examples, enum values, scope syntax and the 'partial names are not accepted' constraint. The prose adds nothing further about name or ecosystem, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (returns the current state of one package) and enumerates exactly what that state includes: version, publish date, status, deprecation message, runtime requirements, license, advisories, activity. It is clearly distinguishable from version_status, upgrade_impact and find_package, which are named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit use cases ('decide whether to add or recommend a package, or to learn its newest version') and then routes the agent away with four named alternatives tied to their triggering conditions (specific version → version_status; migration breakage → upgrade_impact; older runtime → find_compatible_version; unknown name → find_package). This is textbook when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_changesRecent changesA
Read-only
Inspect

Lists the changes Vigia detected recently, newest first: new package releases (with old and new version), deprecations, yanks and removals, runtime-requirement changes, AI model price changes and model retirement announcements. Each item has the entity, the kind of change, the old and new values and the detection time. Without a name it returns the global feed; with ecosystem and name it returns the change history of that one package or model. Read-only and requires no authentication. History only goes back to when Vigia started tracking the entity, so it is not a package's full release history (use list_versions for that). Use it to find out what happened after your training data ends, or whether a dependency or model has just changed.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoExact package name or, for ecosystem "ai", a model id such as "anthropic/claude-sonnet-4.5"; returns that entity's own change history. Requires ecosystem
limitNoMaximum number of items to return, from 1 to 50 (default 20)
ecosystemNoRestrict to one ecosystem: "npm", "pypi", "crates", "packagist" or "ai" (AI models). Required when name is given

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only carry readOnlyHint, so the description adds real behavioral context: no authentication required, newest-first ordering, the per-item shape, and the crucial limitation that history starts at Vigia's tracking start rather than being full release history. Auth and ordering are genuinely useful disclosures, though return format/pagination detail is absent and the read-only claim largely restates the hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the change taxonomy, then scope rules, then the alternative and use case. The opening enumeration of change kinds is dense but each item earns its place as disambiguation; overall it is slightly long but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by describing item fields (entity, kind, old/new values, detection time). Combined with scope rules, the auth statement, the history limitation and the sibling reference, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema does not: how omitting name produces the global feed versus supplying ecosystem + name producing one entity's history. The enum values and limit bounds are left to the schema, which is fine.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (lists) and resource (changes Vigia detected) and enumerates the change kinds covered. It also distinguishes the tool's feed scope from list_versions, so an agent can tell it apart from siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly frames when to reach for it ('find out what happened after your training data ends, or whether a dependency or model has just changed') and names the sibling to use instead for full release history (list_versions). The scoping rule (no name = global feed; ecosystem + name = single-entity history) further pins down usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

symbol_statusDoes this API exist in this version?A
Read-only
Inspect

Checks whether an exported function, class, type or constant (or a Class.member) exists in a specific version of an npm package, using the package's TypeScript declarations. Returns whether it was found, its kind, its exact signature, the module path to import it from, whether it is deprecated (with the deprecation message) and, when it is not found, close-name suggestions. Read-only and requires no authentication. The first lookup for a package version can take up to about 25 seconds while its types are analyzed; a result with status "pending" and retry_after_s means call again after that delay. Limits: npm packages with TypeScript types only; exports that exist at runtime but have no type declaration are not visible. Use it before writing code that calls a library API you are not sure exists, or has the same signature, in the installed version, especially after a major upgrade. For a complete list of what changed between two versions use upgrade_impact.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesnpm package name, e.g. "next", "zod" or "@tanstack/react-query"
moduleNoRestrict the lookup to one import path (a subpath export), e.g. "next/headers"; omit to search every exported module of the package
symbolYesExported name or Class.member, letters, digits, "$" and "_" only, case-sensitive, e.g. "cookies", "z" or "ZodError.flatten"
versionNoExact version such as "15.0.0", or a major such as "15" (resolved to its latest stable release); omit for the latest stable release

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only cover readOnlyHint and openWorldHint, and the description adds substantially more: no authentication required, a first-lookup latency of ~25 seconds, a 'pending' status with retry_after_s to poll, and the visibility limit that runtime-only exports without type declarations are not found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is dense but front-loaded: what it checks, then what it returns, then latency/retry behavior, then limits and usage. Every sentence carries information, though the single long first sentence is heavy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does so fully (found flag, kind, signature, import module path, deprecation plus message, close-name suggestions), and it also covers latency, async retry, and applicability limits for a 4-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter (name, module, symbol, version) already documented including examples and version-resolution rules. The description adds no parameter-level syntax or constraint beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Checks whether an exported function, class, type or constant ... exists in a specific version of an npm package') and names the mechanism (TypeScript declarations). It is clearly distinguishable from siblings like find_compatible_version or version_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger ('Use it before writing code that calls a library API you are not sure exists ... especially after a major upgrade') and routes to the alternative for a different need ('For a complete list of what changed between two versions use upgrade_impact'). Scope limits are also stated, so the agent knows when this tool will not help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_impactUpgrade impact (what breaks)A
Read-only
Inspect

Reports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed exports and import paths, changed function signatures and class or interface members, newly deprecated APIs, changed engines and peerDependencies, and the changelog sections published in between. Returns a summary with counts and a likely_breaking flag, followed by the before/after detail of each change. Read-only and requires no authentication. The first request for a version pair can take up to about 25 seconds while the analysis runs; if it is still running the result has status "pending" and retry_after_s, and you should call again after that delay. Limits: only npm packages that ship TypeScript types (or have @types) can be analyzed, and behavior changes that do not alter types (for example new caching defaults) are invisible, so also read the returned changelog. Use it BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one. For one API in one version use symbol_status; for vulnerabilities use version_status; to choose a version that fits an older runtime use find_compatible_version.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoThe version to move to, in the same formats; omit for the latest stable release. It must be newer than "from"
fromYesThe version you are on: an exact version such as "14.2.3", or a major such as "14", which resolves to the latest stable release of that major
nameYesnpm package name, e.g. "next" or "@tanstack/react-query" (scoped names allowed). PyPI, crates.io and Packagist packages are not supported by this tool

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Although annotations already declare readOnlyHint and openWorldHint, the description adds substantial context beyond them: no authentication required, ~25s first-request latency, a 'pending' status with retry_after_s and retry guidance, the types-only analysis method, and the blind spot for non-type behavior changes. It also describes the return shape (summary with counts and likely_breaking flag plus before/after detail).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and method, then output shape, operational traits, limits, and finally alternatives. Every sentence carries distinct, load-bearing information with no filler despite the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description explains the return contents (summary counts, likely_breaking flag, per-change before/after), the pending/retry flow, scope limits, and unsupported registries. An agent has everything needed to call and interpret it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so 'from' and 'to' formats and the newer-than constraint are fully documented in the schema. The description adds the version-pair pairing concept but no syntax the schema lacks, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource ('Reports what changes between two versions of an npm package by diffing the public TypeScript API') and enumerates exactly what is diffed (exports, import paths, signatures, members, deprecations, engines/peerDependencies, changelog). This is immediately distinguishable from sibling tools like symbol_status or version_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit use cases ('BEFORE upgrading a dependency across a major version, or when code written for an old version fails on a new one') and routes three alternative scenarios to named siblings: symbol_status for one API in one version, version_status for vulnerabilities, find_compatible_version for runtime fit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

version_statusVersion status and vulnerabilitiesA
Read-only
Inspect

Reports on one exact version of an npm, PyPI, crates.io or Packagist package: whether that version exists, when it was published, whether it is withdrawn (npm deprecated, PyPI and crates.io yanked, Packagist abandoned), how many stable releases and major versions it is behind the latest, and its known vulnerabilities from OSV with severity, summary, the version that fixes each one, and the single nearest version that fixes all of them (null if any has no fix). Read-only and requires no authentication. Vulnerability data is cached for up to 6 hours, and the response states when OSV could not be reached. Use it before keeping, pinning or recommending a specific version, or when auditing one lockfile entry. For the latest version and general package health use package_status; to audit a whole manifest at once use check_dependencies.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact package name as published (case-insensitive), e.g. "next", "@types/node" (npm scopes allowed), "requests", "serde", "laravel/framework". Partial names are not accepted; use find_package when unsure
versionYesExact version string as published, e.g. "4.17.1", "2.25.0" or "1.0.100". Ranges and tags such as "^4" or "latest" are not accepted
ecosystemYesRegistry to query: "npm" (JavaScript/TypeScript), "pypi" (Python), "crates" (Rust, crates.io) or "packagist" (PHP, Composer; names have the form "vendor/package")

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and open-world, but the description adds materially: no authentication required, vulnerability data cached up to 6 hours, and explicit disclosure that the response signals when OSV could not be reached. This degradation/caching behavior is not derivable from the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Highly information-dense with no filler: the long opening sentence packs the full report surface, followed by auth/caching caveats and then routing guidance. The first sentence is a run-on with many comma-linked clauses, which slightly hurts front-loading, but every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the full burden of return-value disclosure, and it does so thoroughly: existence, publish date, withdrawal semantics per registry, version-behind counts, and vulnerability fields including severity, summary, fixing version and nearest universal fix. Complete for a read-only query tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents name, version and ecosystem, including the enum values and format constraints. The description restates the ecosystem list but adds no syntax or format guidance beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource: reports on one exact version of a package across four named ecosystems, enumerating exactly what is reported (existence, publish date, withdrawn status, versions behind, vulnerabilities with fixes). It explicitly names sibling tools (package_status, check_dependencies) so an agent can distinguish scope without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use triggers (before keeping, pinning or recommending a version; auditing one lockfile entry) and names the alternatives for adjacent jobs — package_status for latest/overall health, check_dependencies for whole-manifest audits. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Addedchanges_since_cutoff
  2. 12 tool updates
    • Changedcheck_dependencies2 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Manifest type: npm = package.json, pypi = requirements.txt"New value: +"Format of the manifest you are sending: \"npm\" for a package.json, \"pypi\" for a requirements.txt. Cargo.toml and composer.json are not supported"
      • changedInput schema / properties / manifest / description
        Previous value: -"Full content of the manifest file"New value: +"Complete file content as text (at most 200,000 characters): the JSON of a package.json, or the lines of a requirements.txt (pins, ranges, comments and extras are accepted)"
    • Changedeol_status2 fields changed
      • changedInput schema / properties / product / description
        Previous value: -"Product identifier or alias, e.g. \"python\", \"nodejs\", \"php\", \"ubuntu\", \"django\""New value: +"Product identifier or alias, case-insensitive, e.g. \"python\", \"nodejs\" (alias \"node\"), \"php\", \"ubuntu\", \"django\". Call the tool without arguments to list every identifier"
      • changedInput schema / properties / version / description
        Previous value: -"Version or cycle, e.g. \"3.9\", \"3.9.7\", \"18\", \"22.04\""New value: +"Version or release cycle, e.g. \"3.9\", \"18\" or \"22.04\"; a patch version such as \"3.9.7\" is matched to its cycle \"3.9\". Requires product"
    • Changedfind_compatible_version3 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")"
      • changedInput schema / properties / name / description
        Previous value: -"Package name"New value: +"Exact package name, e.g. \"vite\", \"django\", \"tokio\" or \"laravel/framework\""
      • changedInput schema / properties / with / description
        Previous value: -"Comma-separated constraints: \"node@18,react@18\" (npm), \"python@3.8\" (pypi), \"rust@1.70\" (crates) or \"php@8.1\" (packagist)"New value: +"Comma-separated name@version constraints. npm: \"node@18,react@18\"; pypi: \"python@3.8\"; crates: \"rust@1.70\"; packagist: \"php@8.1\" or other packages such as \"illuminate/support@10\". A bare major such as \"18\" means any 18.x"
    • Changedfind_package2 fields changed
      • addedInput schema / properties / ecosystem / description
        Added value: +"Optional filter: \"npm\", \"pypi\", \"crates\", \"packagist\" or \"ai\" (AI models); omit to search all ecosystems"
      • addedInput schema / properties / query / description
        Added value: +"Name prefix of 1 to 100 characters, case-insensitive, e.g. \"react-q\", \"serde_\" or \"anthropic/claude\""
    • Addedlist_versions
    • Removedmodel_info
    • Addedmodel_status
    • Changedpackage_status2 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")"
      • changedInput schema / properties / name / description
        Previous value: -"Exact package name, e.g. \"next\", \"@types/node\", \"requests\""New value: +"Exact package name as published (case-insensitive), e.g. \"next\", \"@types/node\" (npm scopes allowed), \"requests\", \"serde\", \"laravel/framework\". Partial names are not accepted; use find_package when unsure"
    • Changedrecent_changes3 fields changed
      • addedInput schema / properties / ecosystem / description
        Added value: +"Restrict to one ecosystem: \"npm\", \"pypi\", \"crates\", \"packagist\" or \"ai\" (AI models). Required when name is given"
      • addedInput schema / properties / limit / description
        Added value: +"Maximum number of items to return, from 1 to 50 (default 20)"
      • changedInput schema / properties / name / description
        Previous value: -"If set, history of that package or model"New value: +"Exact package name or, for ecosystem \"ai\", a model id such as \"anthropic/claude-sonnet-4.5\"; returns that entity's own change history. Requires ecosystem"
    • Changedsymbol_status4 fields changed
      • changedInput schema / properties / module / description
        Previous value: -"Optional import path to restrict the lookup, e.g. \"next/headers\""New value: +"Restrict the lookup to one import path (a subpath export), e.g. \"next/headers\"; omit to search every exported module of the package"
      • changedInput schema / properties / name / description
        Previous value: -"npm package name"New value: +"npm package name, e.g. \"next\", \"zod\" or \"@tanstack/react-query\""
      • changedInput schema / properties / symbol / description
        Previous value: -"Exported name, or Class.member, e.g. \"cookies\" or \"ZodError.flatten\""New value: +"Exported name or Class.member, letters, digits, \"$\" and \"_\" only, case-sensitive, e.g. \"cookies\", \"z\" or \"ZodError.flatten\""
      • changedInput schema / properties / version / description
        Previous value: -"Exact version or major; default: latest"New value: +"Exact version such as \"15.0.0\", or a major such as \"15\" (resolved to its latest stable release); omit for the latest stable release"
    • Changedupgrade_impact3 fields changed
      • changedInput schema / properties / from / description
        Previous value: -"Current version or major, e.g. \"14\" or \"14.2.3\""New value: +"The version you are on: an exact version such as \"14.2.3\", or a major such as \"14\", which resolves to the latest stable release of that major"
      • changedInput schema / properties / name / description
        Previous value: -"npm package name, e.g. \"next\" or \"@tanstack/react-query\""New value: +"npm package name, e.g. \"next\" or \"@tanstack/react-query\" (scoped names allowed). PyPI, crates.io and Packagist packages are not supported by this tool"
      • changedInput schema / properties / to / description
        Previous value: -"Target version or major; default: latest"New value: +"The version to move to, in the same formats; omit for the latest stable release. It must be newer than \"from\""
    • Changedversion_status3 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"New value: +"Registry to query: \"npm\" (JavaScript/TypeScript), \"pypi\" (Python), \"crates\" (Rust, crates.io) or \"packagist\" (PHP, Composer; names have the form \"vendor/package\")"
      • changedInput schema / properties / name / description
        Previous value: -"Exact package name"New value: +"Exact package name as published (case-insensitive), e.g. \"next\", \"@types/node\" (npm scopes allowed), \"requests\", \"serde\", \"laravel/framework\". Partial names are not accepted; use find_package when unsure"
      • changedInput schema / properties / version / description
        Previous value: -"Exact version, e.g. \"4.17.1\""New value: +"Exact version string as published, e.g. \"4.17.1\", \"2.25.0\" or \"1.0.100\". Ranges and tags such as \"^4\" or \"latest\" are not accepted"
  3. 7 tool updates
    • Changedcheck_dependencies1 field changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem"New value: +"Manifest type: npm = package.json, pypi = requirements.txt"
    • Addedeol_status
    • Changedfind_compatible_version3 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"
      • changedInput schema / properties / ecosystem / enum
        Previous value: -[
        -  "npm",
        -  "pypi"
        -]New value: +[
        +  "npm",
        +  "pypi",
        +  "crates",
        +  "packagist"
        +]
      • changedInput schema / properties / with / description
        Previous value: -"Comma-separated constraints: \"node@18,react@18\" (npm) or \"python@3.8\" (pypi)"New value: +"Comma-separated constraints: \"node@18,react@18\" (npm), \"python@3.8\" (pypi), \"rust@1.70\" (crates) or \"php@8.1\" (packagist)"
    • Changedfind_package1 field changed
      • changedInput schema / properties / ecosystem / enum
        Previous value: -[
        -  "npm",
        -  "pypi",
        -  "ai"
        -]New value: +[
        +  "npm",
        +  "pypi",
        +  "crates",
        +  "packagist",
        +  "ai"
        +]
    • Changedpackage_status2 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"
      • changedInput schema / properties / ecosystem / enum
        Previous value: -[
        -  "npm",
        -  "pypi"
        -]New value: +[
        +  "npm",
        +  "pypi",
        +  "crates",
        +  "packagist"
        +]
    • Changedrecent_changes1 field changed
      • changedInput schema / properties / ecosystem / enum
        Previous value: -[
        -  "npm",
        -  "pypi",
        -  "ai"
        -]New value: +[
        +  "npm",
        +  "pypi",
        +  "crates",
        +  "packagist",
        +  "ai"
        +]
    • Changedversion_status2 fields changed
      • changedInput schema / properties / ecosystem / description
        Previous value: -"Package ecosystem"New value: +"Package ecosystem (crates = Rust/crates.io, packagist = PHP/Composer, names like \"laravel/framework\")"
      • changedInput schema / properties / ecosystem / enum
        Previous value: -[
        -  "npm",
        -  "pypi"
        -]New value: +[
        +  "npm",
        +  "pypi",
        +  "crates",
        +  "packagist"
        +]
  4. 3 tool updates
    • Addedfind_compatible_version
    • Addedsymbol_status
    • Addedupgrade_impact
  5. 1 tool update
    • Addedversion_status
  6. 5 tool updates
    • First observedcheck_dependencies
    • First observedfind_package
    • First observedmodel_info
    • First observedpackage_status
    • First observedrecent_changes

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Breaking-change diffs for npm packages, served over REST and MCP, so coding agents stop writing code against outdated API knowledge.
    2
    Functional Source , Version 1.1, MIT Future
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables users to look up package versions, scan for vulnerabilities, and analyze dependencies across multiple registries (npm, Maven, PyPI, etc.) using exact version recommendations for security.
    4
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.