pkg-intel-mcp

Package intelligence for AI coding agents. An MCP server that answers: is this npm package safe to recommend?

AI coding agents constantly recommend outdated or deprecated packages — request, moment, tslint — because their training data is frozen in time. pkg-intel-mcp gives any MCP client (Claude Desktop, Claude Code, Cursor, Windsurf, ...) live tools to check package health before suggesting an install.

Tools

All registry-aware tools take an optional registry parameter ("npm" default, or "pypi"). No API keys required — everything runs against public endpoints (npm registry, PyPI, pypistats, bundlephobia, OSV.dev) with a 15-minute in-memory cache.

Related MCP server: DepScope

Quick start

Claude Desktop

Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "pkg-intel": {
      "command": "npx",
      "args": ["-y", "pkg-intel-mcp"]
    }
  }
}

Restart Claude Desktop fully (quit from the menu bar), then ask: "Is request still okay to use? What should I use instead?"

Cursor

Same JSON shape in ~/.cursor/mcp.json — see examples/ for copy-paste configs, including local development setup.

Development

npm install
npm run dev        # run with tsx
npm test           # vitest, fully mocked, no network
npm run inspect    # MCP Inspector against the built server

Rules of the road: never console.log (stdout is the JSON-RPC channel — use console.error), keep module: Node16 in tsconfig, and verify tools in the Inspector before blaming a client config. See CLAUDE.md for full conventions.

Remote / team use (HTTP transport)

stdio is the default and right for personal use. For a shared server:

pkg-intel-mcp --http 3000
# MCP endpoint:  POST http://host:3000/mcp
# Liveness:      GET  http://host:3000/healthz

The HTTP mode is fully stateless — no sessions, no sticky routing — so it scales behind any plain load balancer.

Roadmap

• v1: core tools, stdio, npm publish

• v1.1: vulnerability_check via OSV.dev (also key-free)

• v2: PyPI support, stateless Streamable HTTP transport

• v2.1: migrate to MCP SDK v2 / 2026-07-28 spec once stable

• Later: Rust crates.io support, SBOM audit tool

License

MIT