What's New

Review a dependency upgrade

upgrade_notes

Read-onlyIdempotent

Before or after upgrading dependencies — package.json / lockfile / requirements changes, npm update, pip install -U, a Gradle version catalog, go.mod, a workflow's actions — pass each package with the version you run and the version you are moving to. Returns every tracked release in between with the vendor's own breaking-change, deprecation, migration and security sections verbatim, the categorized change list, CVE ids and deterministic signals (major bump, removed/deprecated items, breaking mentions) — including breaking changes shipped in minor or patch versions. Pass repository (from the package's own package.json) for scoped or renamed packages; it makes the match exact. A Maven/Gradle, Go, NuGet or GitHub Actions package goes by its purl (e.g. pkg:maven/com.squareup.okhttp3/okhttp), or by its own coordinate as the name (group:artifact, a module path, owner/repo@ref), and is matched exactly or not at all.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`dependencies`	Yes	Up to 20 per call; split a larger upgrade.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`notes`	No
`dependencies`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed9 schema fields changedSep 23, 2026

changedInput schema / properties / dependencies / items / properties / name / description

Previous value: -"The package name as its registry spells it, e.g. \"better-auth\" or \"@tanstack/react-query\"."New value: +"The package as its ecosystem spells it: \"better-auth\", \"@tanstack/react-query\", a Maven \"group:artifact\", a Go module path, or an Action's \"owner/repo@ref\"."

addedInput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of from/to.",
+  "maxLength": 300,
+  "pattern": "^[Pp][Kk][Gg]:",
+  "type": "string"
+}

changedInput schema / properties / dependencies / items / properties / registry / description

Previous value: -"Default npm."New value: +"Default npm — unless purl, or the name's own shape (group:artifact, a Go module path), says otherwise."

changedInput schema / properties / dependencies / items / properties / repository / description

Previous value: -"The package's source repository — its package.json `repository` (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."New value: +"The package's source repository — its package.json `repository`, or the repo a Maven or NuGet package is built from (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / description

Previous value: -"identifier: a registry id or repository the catalog tracks. name: a name-only guess — check the product before trusting it, and pass repository to make it exact."New value: +"identifier: a registry id, a purl or a repository the catalog tracks. namespace: the package sits under a namespace the product claims (a Maven group, say) — the notes are the family's. name: a name-only guess — check the product before trusting it, and pass purl or repository to make it exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / enum

Previous value: -[
-  "identifier",
-  "name"
-]New value: +[
+  "identifier",
+  "namespace",
+  "name"
+]

addedOutput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a versionless purl, as it was matched.",
+  "type": "string"
+}

addedOutput schema / properties / dependencies / items / properties / registry / description

Added value: +"The registry, when the package is in one of these four; absent for a Maven, Go, NuGet or Actions package."

changedOutput schema / properties / dependencies / items / required

Previous value: -[
-  "name",
-  "registry",
-  "from",
-  "status"
-]New value: +[
+  "name",
+  "from",
+  "status"
+]

AddedSep 18, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, and the description adds substantial behavior beyond that: returns vendor sections verbatim, categorized changes, CVE IDs, deterministic signals, and breaking changes shipped in minor/patch versions. It also discloses exact-match semantics for Maven/Gradle, Go, NuGet, and GitHub Actions packages. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main usage context and each sentence earns its place: when to use it, what it returns, and how to identify packages correctly. It is dense and somewhat run-on, but the length is justified by the tool's complexity and the important edge cases it covers.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup tool with an output schema and safety annotations, the description covers the essential preconditions (from/to versions, package identity), return contents, and edge cases such as scoped packages, renamed packages, purls, and exact matching. Nothing critical is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds genuine value by explaining why `repository` matters for scoped/renamed packages and by illustrating purl/coordinate forms for non-npm ecosystems. The schema already documents the remaining parameter semantics, so the description complements rather than repeats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the resource (dependency upgrades) and the action ('pass each package...' / 'Returns...'), and enumerates specific outputs such as vendor breaking-change sections, categorized changes, and CVE IDs. It does not explicitly contrast itself with siblings like search_releases or whats_new, so differentiation relies on context rather than direct statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong contextual usage guidance: 'Before or after upgrading dependencies' plus concrete scenarios like package.json changes, npm update, pip install -U, Gradle version catalogs, go.mod, and workflow actions. It does not state when not to use the tool or name alternative sibling tools, so it falls short of full exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All What's New tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?