dep-diff-mcp

Analyze a single dependency version change

analyze_package_change

Read-onlyIdempotent

Compare two package versions to receive a structured upgrade analysis: semver classification, breaking changes, security advisories, migration guides, and a recommendation.

Instructions

Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.

Input Schema

TableJSON Schema

Name	Required	Description
`name`	Yes	Package name (e.g. 'react', 'requests')
`ecosystem`	Yes	Package ecosystem
`toVersion`	Yes	Target version (e.g. '19.0.0')
`fromVersion`	Yes	Current version (e.g. '18.2.0')

Output Schema

TableJSON Schema

Name	Required	Description
`package`	Yes	Package name that was analyzed
`repoUrl`	Yes	Source repository URL, or null when none could be resolved
`ecosystem`	Yes	Package ecosystem
`toVersion`	Yes	Version being upgraded to
`fromVersion`	Yes	Version being upgraded from
`semverClass`	Yes	Semver relationship between the two versions
`releaseCount`	Yes	Number of GitHub releases found strictly between the two versions
`securityFixes`	Yes	Advisories affecting fromVersion that are resolved at toVersion
`migrationLinks`	Yes	Migration or upgrade guide URLs found in release notes
`recommendation`	Yes	Single-line verdict explaining the recommendation level
`breakingChanges`	Yes	Breaking changes extracted from release notes; empty when none were found
`releaseExcerpts`	No	Raw release-note excerpts, present only as a fallback when a major/minor bump yielded no breaking changes
`recommendationLevel`	Yes	Risk classification, used to rank packages in bulk results

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

Changed2 schema fields changedv0.3.2Sep 5, 2026

changedInput schema / properties / ecosystem / enum

Previous value: -[
-  "npm",
-  "pypi"
-]New value: +[
+  "npm",
+  "pypi",
+  "github-actions"
+]

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "properties": {
+    "breakingChanges": {
+      "description": "Breaking changes extracted from release notes; empty when none were found",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "ecosystem": {
+      "description": "Package ecosystem",
+      "enum": [
+        "npm",
+        "pypi",
+        "github-actions"
+      ],
+      "type": "string"
+    },
+    "fromVersion": {
+      "description": "Version being upgraded from",
+      "type": "string"
+    },
+    "migrationLinks": {
+      "description": "Migration or upgrade guide URLs found in release notes",
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "package": {
+      "description": "Package name that was analyzed",
+      "type": "string"
+    },
+    "recommendation": {
+      "description": "Single-line verdict explaining the recommendation level",
+      "type": "string"
+    },
+    "recommendationLevel": {
+      "description": "Risk classification, used to rank packages in bulk results",
+      "enum": [
+        "safe",
+        "likely-safe",
+        "review",
+        "caution",
+        "security"
+      ],
+      "type": "string"
+    },
+    "releaseCount": {
+      "description": "Number of GitHub releases found strictly between the two versions",
+      "type": "number"
+    },
+    "releaseExcerpts": {
+      "description": "Raw release-note excerpts, present only as a fallback when a major/minor bump yielded no breaking changes",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "excerpt": {
+            "description": "Short excerpt of the release notes",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Release tag the excerpt came from",
+            "type": "string"
+          }
+        },
+        "required": [
+          "tag",
+          "excerpt"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "repoUrl": {
+      "description": "Source repository URL, or null when none could be resolved",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "securityFixes": {
+      "description": "Advisories affecting fromVersion that are resolved at toVersion",
+      "items": {
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "description": "Advisory identifier (e.g. 'GHSA-29mw-wpgm-hmr9' or a CVE)",
+            "type": "string"
+          },
+          "severity": {
+            "description": "Severity as reported by OSV (e.g. 'LOW', 'MODERATE', 'HIGH', 'CRITICAL')",
+            "type": "string"
+          },
+          "summary": {
+            "description": "One-line description of the advisory",
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "summary",
+          "severity"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "semverClass": {
+      "description": "Semver relationship between the two versions",
+      "enum": [
+        "major",
+        "minor",
+        "patch",
+        "downgrade",
+        "unknown"
+      ],
+      "type": "string"
+    },
+    "toVersion": {
+      "description": "Version being upgraded to",
+      "type": "string"
+    }
+  },
+  "required": [
+    "package",
+    "ecosystem",
+    "fromVersion",
+    "toVersion",
+    "semverClass",
+    "repoUrl",
+    "releaseCount",
+    "breakingChanges",
+    "securityFixes",
+    "migrationLinks",
+    "recommendation",
+    "recommendationLevel"
+  ],
+  "type": "object"
+}

First observedv0.1.1Apr 23, 2026

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, openWorldHint, idempotentHint, destructiveHint=false). The description adds non-redundant behavioral context: it specifies the structured analysis contents, including semver classification, breaking-change detection, security advisories, and migration links. It also discloses ecosystem-specific naming behavior for github-actions, which is useful behavioral nuance beyond what annotations express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary behavior, then moves through triggers, supported ecosystems, and alternative routing. Every sentence earns its place: the output list sets expectations, the example queries illustrate intent, the ecosystem note prevents mis-use, and the sibling reference prevents mis-routing. The only minor redundancy is repeating 'single package' already in the title, but it reinforces scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and safety annotations covering side effects, the description leaves no critical gap. It explains what the tool returns, exactly when to invoke it, which ecosystems are supported, how to write the name for github-actions, and when to prefer the bulk sibling. An agent has everything necessary to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all four parameters have clear descriptions with examples, so the schema carries most of the burden. The description adds one genuinely useful parameter nuance beyond the schema: for github-actions, the name parameter should use the action reference like 'actions/checkout'. No other parameter semantics are added, so a 4 rather than 5 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pairing: 'Given one package and two versions... returns a structured upgrade analysis' and enumerates the concrete outputs (semver classification, release notes, breaking changes, advisories, migration links, recommendation). It also explicitly distinguishes itself from the sibling by describing what analyze_packages_bulk is for, so an agent can tell them apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage criteria: 'Use when the user asks about a specific package upgrade' followed by three concrete example queries. It also states the exclusion condition: 'For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.' This gives clear when-to-use and when-not-to-use guidance with an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/DigiCatalyst-Systems/dep-diff-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server