wheelripe
Queries the PyPI JSON API for package release file lists to determine whether locked dependency versions have compatible wheels (cp315, abi3, free-threaded) for target Python versions and platforms, helping agents identify ready packages, required version bumps, or upstream blockers.
wheelripe
Before you move to a new Python, find every dependency that has no wheel for it yet — and the version bump that fixes each one.
Python 3.15 shipped on 2026-10-09. Moving a project means finding out, package by package, whether each locked dependency has a cp315 (or abi3, or free-threaded cp315t/abi3t) wheel for your platforms. Today that means upgrading, watching pip/uv fall back to an sdist and fail on a missing compiler or header, fixing one, and repeating — or hand-checking the PyPI JSON API like harlequin#1119 and dynamic-des#40 do. pip install --only-binary=:all: --python-version 3.15 stops at the first failure and never tells you which newer release would work.
wheelripe reads your lockfile, asks the index for every release's file list, and applies the same tag rules pip does (PEP 425/600/656/803 — CI cross-checks every verdict against pip on the real PyPI) for every target platform at once.

Install
uvx --from git+https://github.com/Blackman99/wheelripe wheelripe # one-off
pipx install git+https://github.com/Blackman99/wheelripe # or keep itNot on PyPI yet; the release has a wheel you can pip install directly.
Related MCP server: mcp-toolkit
Use
wheelripe # auto-detects uv.lock / pylock.toml / poetry.lock / requirements.txt / pyproject.toml
wheelripe uv.lock --python 3.15t # free-threaded
wheelripe requirements.txt --platform linux-aarch64,musllinux-x86_64 --glibc 2.28BLOCKED confluent-kafka 2.16.0 no cp315 wheel for any target platform (ships cp38–cp314)
BUMP numpy 1.26.4 → 2.5.2 no cp315 wheel in 1.26.4 (ships cp39–cp312); 2.5.2 is the first release with one
BUMP pydantic_core 2.41.5 → 2.48.0 no cp315 wheel in 2.41.5 (ships cp39–cp314); 2.48.0 is the first release with one
READY 1 package (0 with binary wheels · 1 pure Python)
NOT RIPE for CPython 3.15: 1 blocked upstream · 2 need a version bumpExit code is 1 when anything needs a bump or is blocked (--fail-on blocked|build|never to change). Also: -f json|markdown|github, a GitHub Action (uses: Blackman99/wheelripe@v0.1.0), and an MCP server (wheelripe mcp) so coding agents check before they bump.
Docs: https://blackman99.github.io/wheelripe/docs/ · GOAL.md · ROADMAP.md · MIT
This server cannot be deployed
Maintenance
Related MCP Connectors
What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.
Security research: MCP registries verify identity, not tool behavior. See gtfo.dev.
npm/PyPI package dependency upgrade reviews: security, runtime compatibility, cited migration.
Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.
Related MCP Servers
- AlicenseAqualityDmaintenanceDiagnose, secure, and benchmark your MCP servers. Zero-config CLI for Claude Code, Cursor, VS Code, and Windsurf.411 npm3MIT
- AlicenseAqualityCmaintenance9 MCP servers for React + TypeScript development automation — component scaffolding, dependency auditing, WCAG accessibility checking, test generation, TypeScript enforcement, and monorepo management. 134 tests, CI on Node 20+22.7137 npm3MIT
- AlicenseAqualityBmaintenanceAn MCP server that scans your lockfiles (npm, PyPI, Go, Rust, Ruby, PHP) for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions. $14/mo — not per-seat.960 PyPI1MIT
- AlicenseNot gradedqualityAmaintenancedeptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.106 npm61MIT