Skip to main content
Glama
4DA-Systems

@4da/mcp-server

Official

@4da/mcp-server

npm version License: Apache-2.0 Node CI

Upgrade intelligence for AI coding agents. Before your agent bumps a dependency it learns what changes between the version you run and the one you want, which of your files that touches, and which vulnerabilities the move fixes, from your own lockfiles, on your machine. Plus vulnerability scanning at osv-scanner parity, ranked upgrade plans and decision memory. Zero config, no account.

You:     "Upgrade axum to 0.8"
Agent →  upgrade_impact { package: "axum", to_version: "0.8.4" }

         axum 0.7.9 -> 0.8.4: 5 releases (0.8.2 yanked), changelog from the 0.8.4 crate.
         12 breaking entries, 8 touch your code (Path, Query, Router, extract, serve):
           breaking  Remove OptionalFromRequestParts impl for `Query`        (you use Query)
           breaking  Require `Sync` for all handlers added to `Router`       (you use Router)
           ...
         Your code: 10 files import axum.

(Real output, abridged, run on this repository, 2026-10-02.)

One command to install. No API keys. No accounts. Your code never leaves your machine.

Install

Requires Node.js 22 or later.

npm 12+: npm 12 blocks dependency install scripts unless you allow them, which leaves the SQLite module (better-sqlite3) unbuilt. Allow it once, then clear the npx cache: npm config set allow-scripts=better-sqlite3 --location=user and npx clear-npx-cache. npx @4da/mcp-server --doctor checks this by opening a database. npm 10 and 11, which every current Node release ships, are not affected.

claude mcp add 4da -- npx @4da/mcp-server

As a Claude Code plugin (the MCP server plus a hook):

claude plugin marketplace add 4DA-Systems/4da-mcp-server
claude plugin install 4da@4da

The hook: when your agent edits a dependency's version in package.json, Cargo.toml, pyproject.toml, requirements.txt or go.mod, it is told which packages moved and given the exact dependency_check and upgrade_impact calls to make before it installs and builds. The hook is plain Node, contacts nothing, and stays silent for every other edit.

Add to ~/.cursor/mcp.json or ~/.windsurf/mcp.json:

{
  "mcpServers": {
    "4da": {
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}

Add to ~/.vscode/mcp.json:

{
  "servers": {
    "4da": {
      "type": "stdio",
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "4da": {
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}
npx @4da/mcp-server --setup

Then ask your AI: "What changes if I upgrade X to Y?", "Scan for vulnerabilities" or "What should I upgrade first?"

Related MCP server: upgrade-pilot-mcp

How It Works

The server reads every lockfile of the project it is started in, including independently-locked projects below the root (a repo with src-tauri/Cargo.lock beside a root pnpm-lock.yaml is scanned whole) and skipping what .gitignore excludes: package-lock.json / npm-shrinkwrap.json, pnpm-lock.yaml (v5–v9), yarn.lock (v1 and berry), bun.lock, Cargo.lock (Cargo workspaces included), poetry.lock, uv.lock, Pipfile.lock, requirements.txt pins, and go.mod / go.sum (Go's build list). Every installed copy is scanned, not one version per name, with the lockfile's own dev flags. It re-reads them whenever a lockfile changes, and for npm it also checks what node_modules actually holds.

Measured against osv-scanner on 12 projects (npm, pnpm, Cargo, Poetry, requirements.txt, Go): precision 1.00, recall 0.995; re-run before release from the installed package on those and 11 more never used to build the readers (yarn, pnpm, bun, uv, Pipfile, Go included), with every difference settled by OSV or Go's own build list.

  • OSV.dev for known vulnerabilities, matched to exact installed versions

  • npm registry, crates.io, PyPI, Go module proxy for versions, deprecations and yanks

  • The package's own registry archive (registry.npmjs.org, static.crates.io) for the changelog upgrade_impact reads; never GitHub

  • npm full packument and the crates.io versions API for dependency_check (publish times, publishers, install scripts, per-version dependencies). These requests carry the package name only; the version you have installed is never sent to a registry. Packuments are cached on disk and revalidated with If-None-Match; crates.io API reads are spaced one per second.

  • Hacker News Algolia API, only when you call ecosystem_pulse

Results are cached (24h for registry data, 1h for vulnerabilities, 30min for news) and rate-limited per source.

What's sent over the network: package names and versions (the same data visible in your lockfile), and, only for ecosystem_pulse, the names of a few of your dependencies as search terms. No source code, no file paths, no personal data. The call-site scan of upgrade_impact runs locally. Set FOURDA_OFFLINE=true to disable all network calls.

The one exception: if you explicitly configure an OpenAI embedding provider (FOURDA_EMBED_PROVIDER=openai) for semantic recall, the decision/memory text you store is sent to OpenAI to be embedded. The default — no embedding provider, or a local Ollama one — keeps everything on your machine, and FOURDA_OFFLINE=true overrides it regardless.

Ecosystems supported: npm, crates.io (Rust), PyPI (Python), Go. upgrade_impact: npm and crates.io.

Known limits, stated plainly: a requirements.txt without a lockfile names only your direct pins, so their transitive dependencies are not scanned (use uv lock, poetry lock or pip-compile). Many packages ship no changelog in their registry archive (fastembed, vite, zod among them); upgrade_impact then says so and gives the release-notes URL instead of guessing. Breaking entries are flagged from the changelog's headings and wording, and every entry carries the heading it sits under (under). Measured on 47 upgrades never used to build the rules, against three blind raters who saw each entry's heading: 99% of entries flagged breaking were breaking (95% CI 95-100%) and about 65% of breaking entries were flagged. Earlier corpora, before the last parser fixes, measured 73-87%, so treat the flags as a pre-sort: read every entry of a major upgrade. Each answer says this in _meta.classification.

What You Can Ask

"What changes if I upgrade axum to 0.8?"      -> upgrade_impact
"Check my dependency health"                  -> dependency_health
"Scan for vulnerabilities"                    -> vulnerability_scan
"Which deps should I upgrade first?"          -> upgrade_planner
"Is it safe to bump axios to 1.14.1?"         -> dependency_check
"I'm about to bump fastembed 5 -> 7"          -> what_should_i_know
"What's happening in the ecosystem?"          -> ecosystem_pulse
"What's my tech stack?"                       -> get_context
"Record a decision: we chose Postgres"        -> decision_memory
"Does switching to MySQL align?"              -> check_decision_alignment
"Remember: never use ORM for batch inserts"   -> agent_memory

All 16 Tools

Dependency Security

Tool

What it does

upgrade_impact

What changes between the installed and a target version of one dependency: releases in between, changelog entries classified breaking / deprecation / security, the breaking ones that touch your code (symbols you import, and route or pattern syntax in your string literals, e.g. axum 0.8's /:id -> /{id}), the files that import it, advisories fixed.

vulnerability_scan

Every installed copy in every lockfile matched against OSV.dev. Scope-adjusted severity, the fix version on your release line, where each version is pinned. Concise by default (one row per vulnerable package version, the 40 most severe, about 4k tokens on a 290-advisory project); package for one dependency; response_format: "detailed" for every advisory.

dependency_health

Version freshness, deprecation (of the version you run) and vulnerability counts per dependency.

upgrade_planner

The smallest version that fixes each vulnerability, majors flagged, transitive fixes waiting on upstream. package for a one-package plan.

dependency_check

Call before adding a dependency or applying a bump. Verdict per item (proceed / wait / review / avoid / unknown) with evidence: advisories on the target, release age (holds releases under 3 days unless they fix an advisory you have), publish-trust drop, new install scripts, brand-new transitive dependencies, yanked or deprecated. npm and crates.io.

Intelligence

Tool

What it does

what_should_i_know

Pre-task briefing built from the task: the dependencies it names, their versions and confirmed vulnerabilities, majors crossed, your recorded decisions, and a delegation verdict only confirmed evidence can raise.

ecosystem_pulse

Hacker News headlines that name your dependencies, then your languages (labelled as such). Fetched only when called.

get_context

Your tech stack, resolved dependency versions, interests, detected topics.

get_relevant_content*

Scored content feed that passed the desktop app's relevance judge.

get_actionable_signals*

Judge-accepted feed items the app classified (advisories, breaking changes), plus your live vulnerabilities.

knowledge_gaps*

Dependencies with judge-accepted advisories or releases you have not looked at.

record_feedback*

Save or dismiss items so 4DA can record explicit interaction history.

Decisions & Memory

Tool

What it does

decision_memory

Record, query, and manage architectural decisions across sessions.

check_decision_alignment

Verify if a proposed technology change aligns with recorded decisions.

agent_memory

Persistent memory that survives across sessions, agents, and editors.

Identity

Tool

What it does

developer_dna*

Your tech identity: primary stack, top dependencies, blind spots.

* Requires the 4DA desktop app for full data.

Prompt: deps

A user-invoked workflow (shown as a slash command by hosts that surface MCP prompts). It tells the agent to run upgrade_planner, check every proposed bump with dependency_check, apply only proceed items in small batches with the project's own tests after each batch, stop and report every review / avoid / wait / unknown item with its evidence, and re-run vulnerability_scan at the end. Optional argument scope (e.g. security only).

Standalone vs. Full Mode

The MCP server works without the desktop app. It keeps a small local database in your user data folder (%LOCALAPPDATA%\4da-mcp, ~/Library/Application Support/4da-mcp or ~/.local/share/4da-mcp, never inside your repository) and scans your project on every start:

Capability

Standalone

With 4DA Desktop

Upgrade impact (changelog, breaking changes, your call sites)

Yes

Yes

Vulnerability scanning (OSV.dev)

Yes

Yes

Dependency health (4 registries)

Yes

Yes

Upgrade planner

Yes

Yes

Pre-install dependency check

Yes

Yes

Ecosystem news (Hacker News, on request)

Yes

Yes

Pre-task intelligence briefing

Yes

Yes

Tech stack detection + resolved versions

Yes

Yes

Decision memory + alignment checking

Yes

Yes

Agent memory (cross-session)

Yes

Yes

Scored content feed (20+ sources)

--

Yes

Actionable signals + knowledge gaps

--

Yes

The analysis layer (Signal Chains, Knowledge Gaps, temporal analysis)

--

Yes

Download 4DA for the full experience.

Transports

stdio (default) -- works with all MCP hosts:

npx @4da/mcp-server

Streamable HTTP -- for remote or multi-client setups:

npx @4da/mcp-server --http --port 4840

The HTTP transport binds to 127.0.0.1 by default and applies a Host-header DNS rebinding guard to every request. Exposing it beyond this machine requires a shared secret:

MCP_AUTH_SECRET=<same value as the relay's JWT_SECRET> \
MCP_ALLOWED_HOSTS=mcp.internal \
  npx @4da/mcp-server --http --host 0.0.0.0

Without MCP_AUTH_SECRET a non-loopback bind is refused at startup. With it, every request must carry a Bearer token whose HMAC-SHA256 signature verifies against that secret, and the token's role is enforced per tool (viewer is read-only; member and admin may write). Put TLS in front of it.

CLI Reference

npx @4da/mcp-server              # Start server (stdio)
npx @4da/mcp-server --http       # Start server (Streamable HTTP)
npx @4da/mcp-server --setup      # Auto-configure your editors
npx @4da/mcp-server --doctor     # Verify installation health
npx @4da/mcp-server --version    # Print version

Environment Variables

Variable

Description

Default

FOURDA_DB_PATH

Path to 4DA's SQLite database

Auto-detected

FOURDA_OFFLINE

Disable all network calls

false

MCP_AUTH_SECRET

Shared secret for verifying Bearer tokens on --http (HMAC-SHA256). Falls back to JWT_SECRET. Unset means no token is accepted.

Unset

MCP_AUTH_REQUIRED

Require auth on a loopback --http bind. Always required on a non-loopback bind.

false

MCP_ALLOWED_HOSTS

Extra comma-separated hostnames accepted in Host/Origin (needed when binding to 0.0.0.0).

localhost only

FAQ

Does this send my code anywhere? No. The server sends package names and versions to public APIs (OSV.dev, npm registry, crates.io, PyPI, Go proxy), downloads the target version's archive from the package's own registry for upgrade_impact, and, only when you call ecosystem_pulse, sends a few dependency names as search terms to HN Algolia. No source code, no file paths, no personal data: the call-site scan runs locally. Set FOURDA_OFFLINE=true to disable all network calls. (The sole exception is opt-in OpenAI embeddings — see the network note above.)

Do I need the 4DA desktop app? No. 11 tools work standalone: upgrade impact, pre-install dependency checks, vulnerability scanning, dependency health, upgrade planning, ecosystem news, pre-task briefings, project context, decision memory, alignment checking, and agent memory. The desktop app adds a scored content feed from 20+ sources, judged against your actual stack.

Which AI tools does this work with? Any tool that supports MCP: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code (Copilot), and any custom MCP client.

Build from Source

git clone https://github.com/4DA-Systems/4da-mcp-server.git
cd 4da-mcp-server
pnpm install
pnpm build
pnpm test    # offline

License

Apache License 2.0 (Apache-2.0). See LICENSE.


Built by 4DA

Available Tools

11 tools
agent_memoryAgent memoryA

Cross-agent persistent memory: what one agent learns, any agent can recall. Call to store a discovery, decision, or warning, or to recall prior context before starting work.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagsNoTags to search for (for recall_by_tags)
limitNoMax results to return (default 20)
queryNoSearch term to match against subject and tags (for recall)
sinceNoISO datetime to get memories after (for get_recent)
actionYesAction to perform
contentNoFull memory content (for store)
subjectNoShort subject line for the memory (for store)
agent_typeNoAgent identifier, e.g. claude_code, cursor, windsurf (for store)
expires_atNoISO datetime when this memory expires (for store, optional)
session_idNoSession identifier (for store)
memory_typeNoType of memory (for store). Default: context
context_tagsNoTags for categorization (for store)
filter_agentNoFilter results to a specific agent type (for recall, get_recent)

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry the safety profile (readOnlyHint=false, destructiveHint=false, non-idempotent), and the description adds the genuinely useful behavioral trait that memories are persistent and shared across agents. It says nothing about expiry semantics, result volume, or what 'recall' returns, which the annotations do not cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, front-loaded with the defining capability followed by the usage instruction. The 'what one agent learns, any agent can recall' clause earns its place by conveying the cross-agent scope that is the tool's whole point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 parameters fully documented in the schema, no output schema, and annotations carrying safety hints, the description covers the essential read/write duality adequately. It is slightly thin on how the four actions differ in results and on the persistence/expiry model, but nothing critical to correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and every parameter is already documented in the schema with per-action hints, so the baseline is 3. The description adds no parameter-level detail (e.g., interplay of query/tags/limit or action-specific parameter usage) beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (cross-agent persistent memory) and the two core verbs (store, recall), so an agent immediately knows this tool reads and writes shared memory. It does not, however, distinguish itself from closely related siblings such as decision_memory, get_context, or what_should_i_know, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete usage context on both sides: 'store a discovery, decision, or warning' and 'recall prior context before starting work.' That is clear when-to-use guidance, but it offers no exclusions or explicit routing to the sibling memory tools, so it does not reach 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_decision_alignmentDecision alignment checkA
Read-only

Check whether a technology or pattern aligns with the developer's recorded decisions. Call BEFORE suggesting a major tech change, new library, or architecture shift.

ParametersJSON Schema
NameRequiredDescriptionDefault
patternNoArchitecture pattern to check (e.g., 'microservices', 'event-driven')
technologyYesTechnology name to check (e.g., 'postgresql', 'redis', 'graphql')

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, so the safety profile is known. The description adds the behavioral guidance to call before changes, but doesn't disclose return format, rate limits, or what happens if no decisions are recorded. Adds some value beyond annotations but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences: first states what it does, second states when to use it. No wasted words, front-loaded purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only check with fully documented parameters and no output schema, the description covers purpose and timing. It could mention what the check returns (e.g., aligned/misaligned) or how to interpret results, but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter having a clear description and examples. The description itself adds no parameter details, so it meets the baseline 3 when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check) and resource (alignment with recorded decisions), and distinguishes itself from siblings like dependency_check and decision_memory by naming what it validates. It doesn't explicitly differentiate from decision_memory, which likely stores decisions, but the purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent when to call: 'BEFORE suggesting a major tech change, new library, or architecture shift.' This is a clear pre-action trigger that no sibling provides.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decision_memoryDecision memoryA

Record, list, update, or supersede the developer's architectural and tech decisions. Call when the user makes, changes, or asks about a settled decision or convention.

ParametersJSON Schema
NameRequiredDescriptionDefault
idNoDecision ID (for update)
limitNoMax results to return (for list)
actionYesAction to perform
new_idNoID of new decision that replaces old (for supersede)
old_idNoID of decision to supersede (for supersede)
patternNoArchitecture pattern to check alongside the technology (check_alignment)
subjectNoSubject of the decision (for record, check_alignment)
decisionNoThe decision text (for record)
rationaleNoWhy this decision was made (for record)
confidenceNoConfidence level 0-1 (for record)
new_statusNoUpdated status (for update)
technologyNoTechnology to check alignment for (check_alignment)
filter_typeNoFilter by decision type (for list)
context_tagsNoTags for categorization (for record)
new_decisionNoUpdated decision text (for update)
decision_typeNoType of decision (for record)
filter_statusNoFilter by status: active, superseded, reconsidering (for list)
new_rationaleNoUpdated rationale (for update)
new_confidenceNoUpdated confidence (for update)
alternatives_rejectedNoAlternatives that were considered and rejected (for record)

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=false and idempotentHint=false, so the mutation/idempotency profile is covered structurally. The description adds only the notion of 'supersede' (implying the prior decision is retained rather than deleted), but says nothing about persistence scope, permissions, or what happens to state on update/supersede beyond that inference.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no redundancy: the first front-loads the action set and resource, the second front-loads the trigger condition. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 20-parameter, five-action tool this is thin. The description lists only four actions and omits check_alignment entirely, which is exactly where it collides with the sibling check_decision_alignment tool, and it gives no indication of what list/record returns (no output schema exists to compensate).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every one of the 20 parameters carries its own inline '(for <action>)' hint, so the schema does the heavy lifting. The description adds no per-parameter meaning beyond what the enum documentation already supplies, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names specific verbs (record, list, update, supersede) tied to a concrete resource (the developer's architectural and tech decisions), so the tool's function is unambiguous. It does not explicitly differentiate itself from the overlapping siblings check_decision_alignment or agent_memory, which keeps it out of 5 territory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

A clear triggering condition is given: 'Call when the user makes, changes, or asks about a settled decision or convention.' That covers the main invocation contexts, but there is no when-not guidance and no routing advice against the sibling check_decision_alignment tool even though this tool also exposes a check_alignment action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

dependency_checkDependency checkA
Read-onlyIdempotent

Verdict (proceed/wait/review/avoid/unknown) with evidence for adding a dependency or bumping one to a version. Call BEFORE you add a package or apply any version bump.

ParametersJSON Schema
NameRequiredDescriptionDefault
itemsYesThe proposed changes to check, 1 to 25.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and openWorldHint, so safety and side-effect profile are covered structurally. The description adds the shape of the response (the five verdict values), which is genuine value, but says nothing about latency, registry lookups, or how evidence is sourced for the open-world calls.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, and the most actionable item (the verdict vocabulary and what it covers) is front-loaded before the call-timing instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only batched check with no output schema, the description supplies the decision vocabulary and correct invocation timing, and the parameter schema carries the input contract. It could do slightly more on how multiple items are reported back, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single nested parameter set is fully documented (exact version semantics, omit-from-when-adding, ecosystem enum values). The description adds nothing beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific deliverable (a verdict enumerating proceed/wait/review/avoid/unknown) with evidence, and a specific scope: adding a dependency or bumping one to a version. A reader can tell it is a pre-flight decision tool, though it never names which sibling (vulnerability_scan, dependency_health, upgrade_planner) it supersedes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Call BEFORE you add a package or apply any version bump" gives an explicit trigger condition and sequencing relative to the action being gated. It stops short of naming alternatives or stating when this check is unnecessary, so it is clear context but not full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

dependency_healthDependency healthA
Read-only

Dependency version freshness, deprecation and CVE counts across npm/Rust/Python/Go. Call when the user asks whether their dependencies are outdated, stale or need updating.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax dependencies to return. Default: 50
sort_byNoSort order. 'risk' prioritizes vulnerable+deprecated+outdated. Default: risk
include_devNoInclude devDependencies. Default: false
ecosystem_filterNoOnly show deps from this ecosystem. Default: all detected.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and network-access profile is covered. The description adds that results span four ecosystems and include CVE/deprecation counts, but says nothing about pagination, cost, or freshness of the data source.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both earning their place: the first states scope and data covered, the second states the invocation trigger. Front-loaded and free of filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of signalling the return content, which it does by naming freshness, deprecation and CVE counts. The only gap is return shape/pagination, minor for a read-only listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all four parameters (limit, sort_by, include_dev, ecosystem_filter) are documented with defaults and enum meanings in the schema itself. The description adds no parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete verb-less but specific resource: version freshness, deprecation and CVE counts across npm/Rust/Python/Go. An agent can tell it produces a dependency-health report. However, it does not distinguish itself from close siblings such as vulnerability_scan or dependency_check, leaving overlap ambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear trigger: 'Call when the user asks whether their dependencies are outdated, stale or need updating.' This is explicit when-to-use guidance. It stops short of naming alternatives or when-not-to-use, so the agent must infer that vulnerability_scan handles deeper security work.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ecosystem_pulseEcosystem pulseA
Read-only

Recent Hacker News discussions that name a dependency or framework this project actually uses. Call when the user asks what is new or being discussed in their ecosystem.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum headlines to return. Default: 15
min_pointsNoMinimum HN points to include. Default: 0

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the agent knows this is a safe, externally-sourced read. The description adds the meaningful constraint that results are limited to named dependencies the project uses, which is real behavioral context. It says nothing about recency window, ranking, or how the ecosystem is resolved, so a 3 is appropriate with annotations carrying the safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, and the scoping constraint is front-loaded before the usage trigger. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-param, no-required-argument read tool with annotations covering safety and no output schema, the description is essentially complete. The only unaddressed item is how 'the project's ecosystem' is determined, which is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: limit and min_points are both documented with defaults in the schema. The description adds no parameter detail beyond that, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb+resource: it surfaces recent Hacker News discussions, filtered to dependencies or frameworks the project actually uses. That scoping constraint ('actually uses') is the distinguishing feature and is stated plainly. It stops short of naming which sibling to prefer for adjacent questions (e.g. what_should_i_know), so it is clear but not fully sibling-differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger: 'Call when the user asks what is new or being discussed in their ecosystem.' That is a clear use context. There is no when-not guidance or named alternative for overlapping questions like general project news, which keeps it below a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_contextUser contextA
Read-only

What 4DA knows about the user: role, tech stack, interests, exclusions, and detected project context. Call FIRST when you need to know what the user works on before answering or recommending.

ParametersJSON Schema
NameRequiredDescriptionDefault
include_aceNoInclude ACE-detected context (detected tech, active topics). Default: true
include_learnedNoInclude the retained learned-preferences compatibility field. Default: true

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety and scope are covered. The description adds the useful detail of what the payload contains (role, stack, interests, exclusions, project context), which matters because there is no output schema, but it says nothing about freshness, caching, or empty-result behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no waste. The content listing comes first and the invocation guidance second, which is the right front-loading for a tool meant to be called early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with two optional boolean flags, the description covers purpose, contents, and invocation timing, and the absence of an output schema is offset by the enumeration of returned context categories. Minor gaps remain around what happens when context is missing for a new user.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (include_ace, include_learned) are documented with defaults in the schema. The description never mentions either toggle, so it adds no meaning beyond the structured fields; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (the user context that 4DA holds) and enumerates its contents: role, tech stack, interests, exclusions, detected project context. It is clear what the tool returns, but it does not distinguish itself from siblings such as what_should_i_know or agent_memory, which also surface user-relevant knowledge.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger and priority: 'Call FIRST when you need to know what the user works on before answering or recommending.' That tells the agent both when to reach for it and that it should precede other calls. It stops short of naming an alternative or a when-not-to-use condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_impactUpgrade impactA
Read-only

What changes between the installed version of ONE dependency and a target version: changelog entries per release, breaking changes, deprecations, security fixes, and the files in this project that import it. Call before upgrading or bumping a dependency.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYesPackage name exactly as published (npm: `zod`, `@scope/pkg`; crates.io: `fastembed`).
ecosystemNoRegistry. Default: inferred from the project's dependencies (required when the name exists in both).
to_versionNoTarget version. Default: the highest stable version on the registry.
from_versionNoCurrent version. Default: the version this project's lockfile resolves.
response_formatNoconcise (default): every breaking/deprecation/security entry plus up to 3 others per version. detailed: all entries, capped at 400.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and openWorldHint=true, so safety and network behavior are already covered. The description adds that it consults the registry for changelog data, but doesn't mention caching, latency, or handling of missing/unpublished versions. With annotations doing the heavy lifting, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and followed by the call trigger. No filler; every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given annotations cover safety and open-world behavior, and the schema fully documents all five parameters, the description supplies the output contract and a usage trigger. It is nearly complete, though it doesn't address result size or error cases when the package/version isn't found.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with clear descriptions for all five parameters including defaults and enum semantics. The description adds no parameter detail beyond naming what the tool returns, so baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: what changes between installed and target version of one dependency. Enumerates the outputs (changelog entries, breaking changes, deprecations, security fixes, importer files), which distinguishes it clearly from siblings like vulnerability_scan or dependency_health.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Call before upgrading or bumping a dependency,' which gives a clear when-to-use. However, it doesn't distinguish itself from upgrade_planner, the closest sibling, nor state when another tool is preferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upgrade_plannerUpgrade plannerA
Read-only

Prioritized upgrade plan: the 4DA app's work order when computed (per-line targets, manifest vs lockfile fix), else the smallest version that fixes each vulnerability from the lockfiles. Call when the user asks what to upgrade.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageNoPlan for this one package only (exact name, any ecosystem). Default: every dependency.
include_devNoInclude devDependencies. Default: false
risk_thresholdNoOnly show upgrades at or above this risk level. Default: all
max_recommendationsNoMax recommendations to return. Default: 20

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnlyHint true, openWorldHint true), so the description's burden is reduced, and it still adds real behavioral context: the result is a prioritized plan whose per-line targets come either from a computed work order or from the minimal fixing version per vulnerability. With no output schema, it carries return-value information reasonably well, though it never describes the shape or ordering of the returned plan.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, with the core deliverable front-loaded before the computation details and the trigger sentence last. The parenthetical is dense but each clause carries information; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with four optional params and no output schema, the description supplies the two computation modes and the natural-language trigger, which is most of what an agent needs to decide to call it. It leaves the structure of the returned plan and the meaning of risk levels undescribed, a modest gap given the absent output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter (package, include_dev, risk_threshold, max_recommendations) already documents itself including defaults and the enum. The description adds no parameter-level detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause states a specific resource — a prioritized upgrade plan — and explains the two ways it is computed (a computed 'work order' versus the smallest version fixing each vulnerability). That is enough for an agent to recognize the tool. It loses a point because internal jargon ('4DA app', 'manifest vs lockfile fix', 'per-line targets') is never unpacked and no sibling tool is named to contrast against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Ends with an explicit trigger: 'Call when the user asks what to upgrade.' That is clear, actionable usage context. It offers no when-not guidance and does not distinguish itself from adjacent siblings like upgrade_impact or vulnerability_scan, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vulnerability_scanVulnerability scanA
Read-only

Scan this project's lockfiles (npm/pnpm/yarn/bun, Cargo, Python, Go) for known OSV.dev vulnerabilities, transitives included, with fix versions and where each is pinned; package for one dep. Call when the user asks about security, vulnerabilities or CVEs, or before recommending a dependency.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageNoOnly this package (any ecosystem, every installed copy, transitives included), with a `package_note` saying what the lockfiles hold for it. Use it to ask about one dependency instead of reading the whole report.
include_devNoInclude known direct devDependencies. Transitive dev/runtime scope may be unknown. Default: false.
project_pathNoProject directory to scan. Default: current working directory.
force_refreshNoIgnore the OSV advisory cache and fetch fresh advisory data from OSV.dev (dependency versions are re-read on every lockfile change regardless). Default: false.
response_formatNoconcise (default): one row per vulnerable package version (worst severity, the version that fixes all its advisories, advisory count and first ids, where it is pinned), the 40 most severe and 25 recommendations, with counts of anything left out. detailed: one row per advisory with references, plus platform-inactive advisories, maintenance notices, install drift and resolution provenance.
severity_filterNoOnly show vulnerabilities whose presented severity is at or above this level.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so safety is covered; the description adds useful behavior beyond them by stating transitives are included, that fix versions and pin locations are returned, and that advisories come from OSV.dev. It does not mention caching/refresh behavior or output size limits, which are only in the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence front-loads the scope (lockfiles, ecosystems) and closes with the trigger condition; every clause earns its place and nothing is repeated from structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only scan with no output schema and full schema coverage, the description covers scope, ecosystems, transitives and the returned fix/pin information. Minor gaps remain around output limits and caching, but these are addressed in the schema rather than being genuinely missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters including enums, defaults and the `package` scoping mode. The description's '`package` for one dep' merely echoes the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Scan this project's lockfiles ... for known OSV.dev vulnerabilities'), enumerates the ecosystems covered (npm/pnpm/yarn/bun, Cargo, Python, Go) and scope (transitives included, fix versions, pin locations). It is clearly a vulnerability scanner, but it never names or contrasts the closest siblings (dependency_check, dependency_health), so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger: 'Call when the user asks about security, vulnerabilities or CVEs, or before recommending a dependency,' plus a scoped-query mode ('`package` for one dep'). It provides clear positive context but no when-not conditions and does not route to an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

what_should_i_knowPre-task briefingA
Read-only

Pre-task briefing scoped to the task: the dependencies it touches, their installed versions, version-confirmed vulnerabilities, releases since, your recorded decisions, and a delegation verdict. Call BEFORE starting a non-trivial task, especially one that changes dependencies.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskYesWhat you are about to do, naming packages and versions where you know them (e.g. "upgrade fastembed from 5 to 7").
filesNoFile paths involved in the task (optional). Manifest and source paths help find the packages involved.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and reach profile is covered. The description adds the useful fact that the briefing is task-scoped and aggregates multiple data sources, but says nothing about auth requirements, rate limits, caching, or latency that would matter for an open-world aggregate call.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the contents of the briefing front-loaded before the call-to-action. Appropriately sized for a pre-task aggregate tool, though the long enumeration in the first sentence is dense.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the burden of describing return values — and it does list the expected briefing contents (dependencies, versions, vulnerabilities, releases, decisions, verdict). It is complete enough for an agent to know what it will get back, with only the exact format left unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already explains both 'task' and 'files' with examples, so the description is not required to compensate. It adds no syntax or format detail beyond what the schema provides, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates the concrete contents of the briefing — touched dependencies, installed versions, version-confirmed vulnerabilities, releases since, recorded decisions, and a delegation verdict — which clearly differentiates it from narrower siblings like vulnerability_scan or dependency_health. It is a clear aggregate verb+resource, though the vague tool name ('what_should_i_know') carries no signal on its own and the description must do all the work.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to call: 'Call BEFORE starting a non-trivial task, especially one that changes dependencies.' That is a clear triggering context with a qualifier. It does not, however, name any alternative (e.g. when to reach for dependency_check or get_context instead), so there are no explicit exclusions or routing rules.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv6.0.1
    • First observedagent_memory
    • First observedcheck_decision_alignment
    • First observeddecision_memory
    • First observeddependency_check
    • First observeddependency_health
    • First observedecosystem_pulse
    • First observedget_context
    • First observedupgrade_impact
    • First observedupgrade_planner
    • First observedvulnerability_scan
    • First observedwhat_should_i_know

TDQS

A3.8/5.0

Scored across 11 tools

Disambiguation4/5

The dependency tools (vulnerability_scan, dependency_health, upgrade_planner, upgrade_impact, dependency_check) each have distinct triggers and outputs, but they cluster tightly around the same CVE/version domain and could be confused at the edges. The memory tools (decision_memory, agent_memory, check_decision_alignment) overlap more noticeably, since agent_memory explicitly also stores decisions that decision_memory owns.

Naming Consistency3/5

Most names are snake_case noun phrases (vulnerability_scan, dependency_health, upgrade_planner, decision_memory), but the set mixes noun-phrase and verb_noun styles (get_context, check_decision_alignment) and includes the outlier 'what_should_i_know'. Readable, but no single predictable pattern.

Tool Count5/5

11 tools is well-scoped for a dependency-intelligence and memory assistant, and each tool appears to earn its place with a defined workflow role (pre-task briefing, scanning, planning, impact, memory).

Completeness4/5

Coverage spans scanning, health, planning, impact, decisions, and cross-agent memory, which is strong for the stated domain. Minor gaps: no tool to enumerate the project's declared dependencies/manifests directly, and no way to record or apply the upgrade outcome after planning.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Enables AI agents to safely upgrade JavaScript and TypeScript projects through dependency analysis, upgrade path detection, breaking change identification, codemod application, and PR summary generation.
    14
    35 npm
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides a dependency graph of any local repository with tools for change impact, transitive dependents, health audits, and more, enabling AI coding agents to see structure and refactor safely.
    4,912 npm
    4
    MIT