What's New

Review a dependency upgrade

upgrade_notes

Read-onlyIdempotent

Before or after upgrading dependencies — package.json / lockfile / requirements changes, npm update, pip install -U, a Gradle version catalog, go.mod, a workflow's actions — pass each package with the version you run and the version you are moving to. Returns every tracked release in between with the vendor's own breaking-change, deprecation, migration and security sections verbatim, the categorized change list, CVE ids and deterministic signals (major bump, removed/deprecated items, breaking mentions) — including breaking changes shipped in minor or patch versions. Pass repository (from the package's own package.json) for scoped or renamed packages; it makes the match exact. A Maven/Gradle, Go, NuGet or GitHub Actions package goes by its purl (e.g. pkg:maven/com.squareup.okhttp3/okhttp), or by its own coordinate as the name (group:artifact, a module path, owner/repo@ref), and is matched exactly or not at all. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted, to decide what to track next; pass recordMisses: false for private packages.

Input Schema

Name	Required	Description	Default
`dependencies`	Yes	Up to 20 per call; split a larger upgrade.
`recordMisses`	No	Default true. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted per day, with nothing about the caller, to decide what to track next. Pass false for private packages.

Output Schema

Name	Required	Description	Default
`notes`	No
`dependencies`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedNov 3, 2026

addedOutput schema / properties / dependencies / items / properties / releases / items / properties / records

Added value: +{
+  "description": "Typed change records: what a user may have to change, by kind (ADR 2026-11.64f9). Model-extracted and labelled; never a verdict that the release breaks anything.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "evidence": {
+        "description": "The bullet or paragraph the record comes from, verbatim from the vendor's notes. Absent past the call's evidence budget.",
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "removed",
+          "renamed",
+          "signature_changed",
+          "behavior_changed",
+          "requirement_raised",
+          "config_changed",
+          "deprecated"
+        ],
+        "type": "string"
+      },
+      "label": {
+        "description": "Who says so, to keep with the record: e.g. “inferred by a model”.",
+        "type": "string"
+      },
+      "package": {
+        "description": "In a monorepo's notes, the package it is about.",
+        "type": "string"
+      },
+      "removalPlanned": {
+        "description": "For a deprecation, when the vendor says it goes.",
+        "type": "string"
+      },
+      "replacement": {
+        "type": "string"
+      },
+      "subject": {
+        "description": "The API, flag, key or platform it is about.",
+        "type": "string"
+      },
+      "subjectType": {
+        "enum": [
+          "api",
+          "cli_flag",
+          "config_key",
+          "env_var",
+          "endpoint",
+          "runtime",
+          "platform",
+          "dependency",
+          "file_format",
+          "license",
+          "other"
+        ],
+        "type": "string"
+      },
+      "tier": {
+        "description": "headed: under the vendor's own breaking / deprecation / migration / security heading. inferred: a model read it from the notes' prose and a second model call confirmed it. declared: from a Declarative Changelog release, read the same way.",
+        "enum": [
+          "declared",
+          "headed",
+          "inferred"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "kind",
+      "subjectType",
+      "subject",
+      "tier",
+      "label"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / dependencies / items / properties / releases / items / properties / recordsOmitted

Added value: +{
+  "const": true,
+  "description": "The call's record budget left some out; the permalink has them.",
+  "type": "boolean"
+}

changedOutput schema / properties / dependencies / items / properties / signals / description

Previous value: -"Deterministic, over every release in the interval: a SemVer major bump, Keep a Changelog removed/deprecated/security items, the vendor's literal “breaking” wording, CVE ids. No model judged anything."New value: +"Over every release in the interval. Deterministic: a SemVer major bump, the vendor's literal “breaking” wording, CVE ids. Model-derived, from what was stored when each release arrived: the removed / deprecated / security categories and the typed change records."

addedOutput schema / properties / dependencies / items / properties / signals / properties / records

Added value: +{
+  "additionalProperties": false,
+  "description": "User-facing typed change records across the interval, by kind; absent when none are stored.",
+  "properties": {
+    "behavior_changed": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "config_changed": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "deprecated": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "inferred": {
+      "description": "Of the total, read from prose rather than a heading.",
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "removed": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "renamed": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "requirement_raised": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "signature_changed": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "total": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    }
+  },
+  "required": [
+    "total",
+    "inferred",
+    "removed",
+    "renamed",
+    "signature_changed",
+    "behavior_changed",
+    "requirement_raised",
+    "config_changed",
+    "deprecated"
+  ],
+  "type": "object"
+}

Changed1 schema field changedSep 25, 2026

changedInput schema / properties / dependencies / items / properties / purl / description

Previous value: -"The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of from/to."New value: +"The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of the versions passed beside it."

Changed1 schema field changedSep 23, 2026

addedInput schema / properties / recordMisses

Added value: +{
+  "description": "Default true. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted per day, with nothing about the caller, to decide what to track next. Pass false for private packages.",
+  "type": "boolean"
+}

Changed9 schema fields changedSep 23, 2026

changedInput schema / properties / dependencies / items / properties / name / description

Previous value: -"The package name as its registry spells it, e.g. \"better-auth\" or \"@tanstack/react-query\"."New value: +"The package as its ecosystem spells it: \"better-auth\", \"@tanstack/react-query\", a Maven \"group:artifact\", a Go module path, or an Action's \"owner/repo@ref\"."

addedInput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a purl (package URL), e.g. \"pkg:maven/com.squareup.okhttp3/okhttp\", \"pkg:golang/github.com/spf13/cobra\" or \"pkg:nuget/Newtonsoft.Json\" — what an SBOM, OSV or Renovate already names it by. Takes precedence over name and registry; a version inside it is ignored in favour of from/to.",
+  "maxLength": 300,
+  "pattern": "^[Pp][Kk][Gg]:",
+  "type": "string"
+}

changedInput schema / properties / dependencies / items / properties / registry / description

Previous value: -"Default npm."New value: +"Default npm — unless purl, or the name's own shape (group:artifact, a Go module path), says otherwise."

changedInput schema / properties / dependencies / items / properties / repository / description

Previous value: -"The package's source repository — its package.json `repository` (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."New value: +"The package's source repository — its package.json `repository`, or the repo a Maven or NuGet package is built from (any GitHub URL, github:owner/repo or owner/repo). Resolves scoped and renamed packages the name alone cannot, and makes the match exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / description

Previous value: -"identifier: a registry id or repository the catalog tracks. name: a name-only guess — check the product before trusting it, and pass repository to make it exact."New value: +"identifier: a registry id, a purl or a repository the catalog tracks. namespace: the package sits under a namespace the product claims (a Maven group, say) — the notes are the family's. name: a name-only guess — check the product before trusting it, and pass purl or repository to make it exact."

changedOutput schema / properties / dependencies / items / properties / match / properties / tier / enum

Previous value: -[
-  "identifier",
-  "name"
-]New value: +[
+  "identifier",
+  "namespace",
+  "name"
+]

addedOutput schema / properties / dependencies / items / properties / purl

Added value: +{
+  "description": "The package as a versionless purl, as it was matched.",
+  "type": "string"
+}

addedOutput schema / properties / dependencies / items / properties / registry / description

Added value: +"The registry, when the package is in one of these four; absent for a Maven, Go, NuGet or Actions package."

changedOutput schema / properties / dependencies / items / required

Previous value: -[
-  "name",
-  "registry",
-  "from",
-  "status"
-]New value: +[
+  "name",
+  "from",
+  "status"
+]

AddedSep 18, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/openWorld, so the bar is lower, yet the description still adds real context: untracked Maven/Go/NuGet packages are looked up on deps.dev after the answer and counted per day, and 'matched exactly or not at all' sets expectations for failed matches. It does not cover error behaviour, latency or rate limits for a call that fans out across many releases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The trigger is front-loaded in the first clause and every sentence carries real information: return contents, matching rules, then the miss-recording caveat. It is dense and long — the ecosystem enumeration in sentence one could be tightened — but nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with full schema coverage, annotations and an output schema, the description covers the trigger, the return payload, cross-ecosystem matching rules and the deps.dev side effect. An agent has everything needed to call it correctly on the first attempt.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, but the description adds meaning the schema does not spell out — why repository matters (resolves scoped and renamed packages, makes the match exact) and why purl or a native coordinate is the only route for Maven/Go/NuGet/Actions. The remaining fields (from, to, registry) are largely restated from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — pass each package's from/to versions and get back every tracked release in between with verbatim breaking-change, deprecation, migration and security sections. It also scopes the resource precisely (package.json, lockfile, requirements, go.mod, Gradle catalogs, Actions), which an agent can use to tell it apart from list_products, search_releases or whats_new.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear trigger ('before or after upgrading dependencies') plus concrete routing rules: purl or native coordinate for Maven/Gradle, Go, NuGet and GitHub Actions, name/registry otherwise, and recordMisses:false for private packages. It never names the sibling tools or states when NOT to use this in favour of search_releases or whats_new, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All What's New tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?