Provides tools for checking npm package health (downloads, last publish, deprecation, license), comparing alternatives, estimating bundle size via bundlephobia, detecting deprecations, and checking vulnerabilities via OSV.dev.
Provides tools for checking PyPI package health (downloads, last publish, yanked status, license), comparing alternatives, detecting yanked packages, and checking vulnerabilities via OSV.dev.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@pkg-intel-mcp Is 'request' deprecated?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Package intelligence for AI coding agents. An MCP server that answers: is this npm package safe to recommend?
AI coding agents constantly recommend outdated or deprecated packages — request, moment, tslint — because their training data is frozen in time. pkg-intel-mcp gives any MCP client (Claude Desktop, Claude Code, Cursor, Windsurf, ...) live tools to check package health before suggesting an install.
Tool | What it answers | Registries |
| Is this package alive? Downloads, last publish, deprecation, license, and a healthy / caution / avoid verdict. | npm, PyPI |
| Which of these 2–5 alternatives should I pick? Side-by-side with a recommendation. | npm, PyPI |
| What does this cost my frontend bundle? Minified + gzip via bundlephobia. | npm |
| Is this deprecated (npm) or yanked (PyPI), and what should I use instead? | npm, PyPI |
| Any known CVEs in this package/version, and which version fixes them? Via OSV.dev. | npm, PyPI |
All registry-aware tools take an optional registry parameter ("npm" default, or "pypi"). No API keys required — everything runs against public endpoints (npm registry, PyPI, pypistats, bundlephobia, OSV.dev) with a 15-minute in-memory cache.
Related MCP server: @4da/mcp-server
Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"pkg-intel": {
"command": "npx",
"args": ["-y", "pkg-intel-mcp"]
}
}
}Restart Claude Desktop fully (quit from the menu bar), then ask: "Is request still okay to use? What should I use instead?"
Same JSON shape in ~/.cursor/mcp.json — see examples/ for copy-paste configs, including local development setup.
npm install
npm run dev # run with tsx
npm test # vitest, fully mocked, no network
npm run inspect # MCP Inspector against the built serverRules of the road: never console.log (stdout is the JSON-RPC channel — use console.error), keep module: Node16 in tsconfig, and verify tools in the Inspector before blaming a client config. See CLAUDE.md for full conventions.
stdio is the default and right for personal use. For a shared server:
pkg-intel-mcp --http 3000
# MCP endpoint: POST http://host:3000/mcp
# Liveness: GET http://host:3000/healthzThe HTTP mode is fully stateless — no sessions, no sticky routing — so it scales behind any plain load balancer.
v1: core tools, stdio, npm publish
v1.1: vulnerability_check via OSV.dev (also key-free)
v2: PyPI support, stateless Streamable HTTP transport
v2.1: migrate to MCP SDK v2 / 2026-07-28 spec once stable
Later: Rust crates.io support, SBOM audit tool
MIT
Get the minified and gzipped bundle size of an npm package (via bundlephobia), plus its dependency count. npm only — bundle size has no PyPI equivalent. Use when frontend bundle weight matters.
Inputs: name (required), version.
Compare 2-5 packages from the same registry (npm or PyPI) side by side on adoption, maintenance freshness, deprecation status, and bundle size (npm only). Returns a structured comparison and a recommendation. Use when choosing between alternative libraries.
Inputs: names (required), registry.
Check whether an npm package is deprecated or a PyPI package is yanked, including the message which often names the recommended replacement.
Inputs: name (required), registry.
Get a health report for an npm or PyPI package: weekly downloads, last publish date, deprecation/yank status, license, and a healthy/caution/avoid verdict with reasons. Use this before recommending or installing a package.
Inputs: name (required), registry.
Check a package for known security vulnerabilities via OSV.dev. Give a version to check that exact version, or omit it to check the latest release. Returns advisory IDs, CVEs, severity, and fixed versions. Use before recommending a package or when auditing dependencies.
Inputs: name (required), version, registry.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 5 tools
Tools are mostly distinct, but deprecation_check overlaps with package_health since the latter already includes deprecation status. The other tools—compare_packages, bundle_size, and vulnerability_check—target clearly separate concerns, so an agent can usually pick correctly.
Naming mixes patterns: compare_packages is verb_noun while the rest are noun_noun or adjective_noun (package_health, bundle_size, deprecation_check, vulnerability_check). The convention is readable but not consistently verb-first.
Five tools is well within the ideal range for a focused package-intelligence server. Each tool serves a concrete evaluation need without bloating the surface.
Covers key evaluation aspects: health, security, deprecation, bundle size, and comparison. Minor gaps like raw metadata (description, homepage) or version history are absent, but they are not critical for the server's stated purpose.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package verdicts for AI coding agents: check npm, PyPI, Go and NuGet installs before they run.
Live npm and UNPKG data for AI agents: resolution, audits, import maps, malware/CVE checks.