Skip to main content
Glama

Server Details

npm/PyPI/Django dependency upgrades: security, runtime compatibility, migration, package ranking.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over 22 days
Last Tested
Transport
Streamable HTTP ยท MCP 2025-11-25
URL
Repository
mattpicone/upgradelens
GitHub Stars
0

TDQS

A4.4/5.0

Scored across 4 tools

Disambiguation4/5

Each tool targets a distinct stage of the dependency upgrade workflow: target selection, go/no-go risk check, migration planning, and pre-merge review. check and review are somewhat similar in risk assessment focus, but their usage contexts ('before changing' vs 'before merge') keep them distinguishable.

Naming Consistency4/5

Tool names consistently follow a verb-first pattern with clear dependency upgrade vocabulary. Minor deviation: find_safe_upgrade_target uses 'upgrade_target' while the other three use 'dependency_upgrade', but the pattern remains predictable and readable.

Tool Count5/5

Four tools is well-scoped for a focused dependency upgrade analysis server. Each tool covers a distinct need and none feel redundant or unnecessary.

Completeness5/5

The tool surface covers the full read-only dependency upgrade lifecycle: choosing a target, checking risk, planning migration actions, and reviewing an existing version change. No obvious dead ends or missing operations for the stated domain.

Available Tools

4 tools
check_dependency_upgradeAssess a known dependency upgrade target (go/no-go)A
Read-onlyIdempotent
Inspect

Use when a coding agent needs a cited go/no-go risk decision without steps before changing an existing npm or PyPI dependency between two exact versions. Returns action_allowed, vulnerability delta, compatibility, EOL, and breaking-change evidence. Use plan_dependency_upgrade instead for ordered migration work. Do not use to choose a target, install a new package, search general docs, or analyze another ecosystem. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
cache_hitNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
recommended_targetNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful behavioral context: it returns action_allowed, vulnerability delta, compatibility, EOL, and breaking-change evidence, and clarifies that it does not produce migration steps. This goes beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: use case, return value summary, alternative tool, exclusions, and safety. The critical context is front-loaded and the description is tight despite covering a lot of ground.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema, detailed annotations, and clear sibling distinctions, the description covers everything needed to select and invoke the tool correctly. It explains what the tool returns, when to use it, when not to use it, and which alternative to prefer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the schema already documents most parameters. The description reinforces that exact versions are expected ('between two exact versions') but does not add substantial new meaning beyond the schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: assessing a known npm/PyPI dependency upgrade between two exact versions. It clearly differentiates from plan_dependency_upgrade and explicitly lists exclusions such as choosing a target, installing packages, or analyzing other ecosystems.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('needs a cited go/no-go risk decision without steps'), names the alternative (plan_dependency_upgrade), and lists concrete negative use cases. An agent can route correctly without additional inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

find_safe_upgrade_targetRank upgrade candidates (not a safety verdict; full check required)A
Read-onlyIdempotent
Inspect

Use only when an existing npm or PyPI dependency has an exact current version but no chosen target. Ranks candidates; candidates are not declared safe and require check_dependency_upgrade or plan_dependency_upgrade. Do not use when a target is stated, for a new install, or as authorization to edit files. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
max_major_jumpNoOptional major-version jump cap. 0 = stay in the same major.
current_versionYesExact installed version.
allow_prereleaseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
coverageNo
evidenceNo
ecosystemNo
freshnessNo
candidatesNo
confidenceNo
next_actionNo
latest_stableNo
action_allowedNo
current_versionNo
analysis_versionNo
recommended_targetNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, and the description reinforces this. It adds valuable context beyond the annotations by clarifying that candidates are not declared safe and require check_dependency_upgrade or plan_dependency_upgrade, which is important behavioral nuance.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with clear usage conditions and exclusions in a few sentences. It loses a point because 'Read-only and safe to retry' repeats what the annotations already state, adding slight redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists and annotations cover safety and idempotency, the description provides all necessary invocation context: when to use it, when not to use it, what the output does not guarantee, and which sibling tools should be used instead. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 80%, so the schema already documents most parameters. The description adds context about 'exact current version' and the npm/PyPI scope, but it does not meaningfully explain max_major_jump or allow_prerelease beyond the schema. This meets the baseline but does not substantially enrich parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool ranks upgrade candidates for existing npm/PyPI dependencies and explicitly distinguishes this from a safety verdict. It references the sibling tools and leaves no ambiguity about what the tool does versus what it does not do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditions for use: only when an existing dependency has an exact current version but no chosen target. It also states clear exclusions, such as when a target is stated, for new installs, or as authorization to edit files, and directs the agent to the appropriate sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_dependency_upgradePlan a known dependency upgrade (migration/review checklist)A
Read-onlyIdempotent
Inspect

Use when a coding agent needs a migration checklist, refactor actions, ordered review actions, changelog links, or test steps for exact current and target npm/PyPI versions. Use check_dependency_upgrade instead for a go/no-go without steps. Do not use to choose a target, install a package, or provide a general tutorial. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

ParametersJSON Schema
NameRequiredDescription
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
cache_hitNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
changelog_urlsNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
migration_actionsNo
recommended_targetNo

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds 'Read-only and safe to retry,' which largely repeats those annotations rather than adding new behavioral context like auth needs or return-format caveats. Since the bar is lower with annotations and no contradiction exists, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the first defines the deliverable, the second routes to the sibling, the third lists exclusions. Information is front-loaded with the most important condition first and no redundancy. This is a model of concise, structured tool documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool at this complexity (5 params, nested runtime object, output schema), the description covers trigger conditions, deliverable contents, alternative tool, and explicit non-goals. The output schema handles return-value details, and annotations cover safety, so nothing needed for correct invocation is missing. Complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 80% of the parameters with clear descriptions (exact package name, ecosystem enum with only npm/pypi, exact current/target versions). The description reinforces that versions are exact and tied to npm/PyPI, adding marginal clarity over the schema. Baseline 3 holds because the schema does the heavy lifting and the description doesn't add new parameter-level semantics beyond naming use cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: produces a migration checklist with refactor actions, ordered review actions, changelog links, or test steps for exact npm/PyPI versions. Explicitly contrasts with check_dependency_upgrade, distinguishing itself as the step-by-step planner rather than a go/no-go check. Clear scope that lets an agent select it without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Use when a coding agent needs...') and names the alternative ('Use check_dependency_upgrade instead for a go/no-go without steps'). Provides exclusions ('Do not use to choose a target, install a package, or provide a general tutorial'). This is exactly the when/when-not/alternatives guidance that earns a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_dependency_upgradeReview a dependency update before mergingA
Read-onlyIdempotent
Inspect

Use when an agent reviews a Dependabot, Renovate, npm, or PyPI version change before merge. One cited result combines security delta, runtime compatibility, breaking changes, go/no-go risk, and ordered migration actions for exact current and target versions. Do not use for new installs, unknown versions, general documentation, or other ecosystems. Read-only and safe to retry.

ParametersJSON Schema
NameRequiredDescriptionDefault
detailNocompact is optimized for agent decisions; full includes the complete legacy plan payload.compact
packageYesExact registry package name.
runtimeNo
ecosystemYesPackage ecosystem. Only npm and pypi are supported.
target_versionYesExact candidate version.
current_versionYesExact installed version.

Output Schema

ParametersJSON Schema
NameRequiredDescription
detailNo
billingNo
packageNo
reasonsNo
coverageNo
decisionNo
evidenceNo
headlineNo
cache_hitNo
citationsNo
ecosystemNo
freshnessNo
confidenceNo
risk_scoreNo
next_actionNo
compatibilityNo
latest_stableNo
version_factsNo
action_allowedNo
changelog_urlsNo
claim_evidenceNo
repository_urlNo
security_deltaNo
target_versionNo
current_versionNo
analysis_versionNo
breaking_changesNo
migration_actionsNo
recommended_targetNo

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint; the description reinforces these and adds the behavioral trait that it produces a single 'cited result' combining multiple analyses for exact current and target versions. This is useful context beyond the annotations, though it doesn't detail citation mechanics or output structure (covered by output schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, each earning its place: when-to-use, what result contains, and exclusions/safety. The critical scoping is front-loaded in the first sentence; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a read-only review tool with an output schema and high schema coverage. It covers use case, exclusions, safety, and key result contents, so an agent has enough to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 83%, so the schema already documents most parameter meanings. The description reinforces 'exact current and target versions' but adds no new semantics for detail, runtime, or ecosystem beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific verb ('reviews'), resource (Dependabot, Renovate, npm, or PyPI version change), and precise scope ('before merge'). It lists the distinct output components (security delta, runtime compatibility, breaking changes, go/no-go risk, migration actions), which differentiates it from sibling tools by deliverable, not just name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('reviews a ... version change before merge') and what not to use for ('new installs, unknown versions, general documentation, or other ecosystems'). However, it does not name sibling tools or explicitly route to check_dependency_upgrade, find_safe_upgrade_target, or plan_dependency_upgrade, so the guidance is clear but not fully alternative-aware.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Addedreview_dependency_upgrade
  2. 3 tool updates
    • First observedcheck_dependency_upgrade
    • First observedfind_safe_upgrade_target
    • First observedplan_dependency_upgrade

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI coding agents to verify, compare, and safely upgrade npm packages by scoring packages from public signals and sandboxed co-installation, detecting breaking API surface changes, and rewriting code that upgrades break.
    918 npm
    8
    MIT
  • A
    license
    B
    quality
    D
    maintenance
    Enables AI agents to safely upgrade JavaScript and TypeScript projects through dependency analysis, upgrade path detection, breaking change identification, codemod application, and PR summary generation.
    14
    14 npm
    MIT
Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.