What's New

Review a dependency upgrade

upgrade_notes

Read-onlyIdempotent

Before or after upgrading dependencies — package.json / lockfile / requirements changes, npm update, pip install -U, a Gradle version catalog, go.mod, a workflow's actions — pass each package with the version you run and the version you are moving to. Returns every tracked release in between with the vendor's own breaking-change, deprecation, migration and security sections verbatim, the categorized change list, CVE ids and deterministic signals (major bump, removed/deprecated items, breaking mentions) — including breaking changes shipped in minor or patch versions. Pass repository (from the package's own package.json) for scoped or renamed packages; it makes the match exact. A Maven/Gradle, Go, NuGet or GitHub Actions package goes by its purl (e.g. pkg:maven/com.squareup.okhttp3/okhttp), or by its own coordinate as the name (group:artifact, a module path, owner/repo@ref), and is matched exactly or not at all. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted, to decide what to track next; pass recordMisses: false for private packages.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`dependencies`	Yes	Up to 20 per call; split a larger upgrade.
`recordMisses`	No	Default true. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted per day, with nothing about the caller, to decide what to track next. Pass false for private packages.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`notes`	No
`dependencies`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedSep 25, 2026

changedInput schema / properties / dependencies / items / properties / purl / description

Previous value: -"The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of from/to."New value: +"The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of the versions passed beside it."

Changed1 schema field changedSep 23, 2026

addedInput schema / properties / recordMisses

Added value: +{
+  "description": "Default true. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted per day, with nothing about the caller, to decide what to track next. Pass false for private packages.",
+  "type": "boolean"
+}

Changed9 schema fields changedSep 23, 2026

changedInput schema / properties / dependencies / items / properties / name / description

Previous value: -"The package name as its registry spells it, e.g. \"better-auth\" or \"@tanstack/react-query\"."New value: +"The package as its ecosystem spells it: \"better-auth\", \"@tanstack/react-query\", a Maven \"group:artifact\", a Go module path, or an Action's \"owner/repo@ref\"."

addedInput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of from/to.",
+  "maxLength": 300,
+  "pattern": "^[Pp][Kk][Gg]:",
+  "type": "string"
+}

changedInput schema / properties / dependencies / items / properties / registry / description

Previous value: -"Default npm."New value: +"Default npm — unless purl, or the name's own shape (group:artifact, a Go module path), says otherwise."

changedInput schema / properties / dependencies / items / properties / repository / description

Previous value: -"The package's source repository — its package.json `repository` (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."New value: +"The package's source repository — its package.json `repository`, or the repo a Maven or NuGet package is built from (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / description

Previous value: -"identifier: a registry id or repository the catalog tracks. name: a name-only guess — check the product before trusting it, and pass repository to make it exact."New value: +"identifier: a registry id, a purl or a repository the catalog tracks. namespace: the package sits under a namespace the product claims (a Maven group, say) — the notes are the family's. name: a name-only guess — check the product before trusting it, and pass purl or repository to make it exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / enum

Previous value: -[
-  "identifier",
-  "name"
-]New value: +[
+  "identifier",
+  "namespace",
+  "name"
+]

addedOutput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a versionless purl, as it was matched.",
+  "type": "string"
+}

addedOutput schema / properties / dependencies / items / properties / registry / description

Added value: +"The registry, when the package is in one of these four; absent for a Maven, Go, NuGet or Actions package."

changedOutput schema / properties / dependencies / items / required

Previous value: -[
-  "name",
-  "registry",
-  "from",
-  "status"
-]New value: +[
+  "name",
+  "from",
+  "status"
+]

AddedSep 18, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/openWorld/idempotent annotations, the description discloses rich behavioral details: returns verbatim vendor sections, categorized changes, CVE IDs, deterministic signals, and breaking changes even in minor/patch releases. It also explains exact-match behavior for non-npm ecosystems and the deps.dev fallback tracking, including the recordMisses privacy option. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a dense single paragraph, but every sentence contributes unique information about usage, matching rules, or behavior. It front-loads the primary use case and then adds identifier and privacy details. It is longer than ideal, but the complexity of the tool justifies the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the full calling context: when to use it, what to pass, how identifiers work across ecosystems, return contents, exact-match semantics, and the deps.dev fallback. An output schema exists and the description does not need to restate return structure. Nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds substantial meaning: repository disambiguates scoped/renamed packages, purl takes precedence and is the right identifier for Maven/Go/NuGet/Actions, and recordMisses should be false for private packages. These are usage insights beyond the schema field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: pass a package with current and target versions to get release notes and breaking-change signals. It is specific about the resource (dependency upgrades) and the output. However, it does not explicitly differentiate itself from siblings like whats_new or search_releases, though the upgrade-focused scope implies a distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: before or after upgrading dependencies, with concrete scenarios like npm update, pip install -U, Gradle version catalogs, go.mod, and workflow actions. It does not mention when not to use it or name alternative tools, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All What's New tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?