Check what breaks in YOUR code when you upgrade a dependency.

Call this BEFORE bumping a dependency version. It extracts the real public API of the currently-installed (or from_version) package and the target to_version, diffs them, then scans the provided code to report exactly which of your usages break — with line numbers, severity, and fix hints.

Args: package: Distribution name to upgrade (e.g. "pandas"). to_version: The version you want to move to (e.g. "2.2.0"). code: The source code that uses the package (a file or snippet). from_version: Optional baseline version; defaults to what is installed. language: Ecosystem provider id. Default "python".

Returns a report with safe_to_upgrade, a severity summary, and per-line findings. Note: analysis is static, so "no findings" means "nothing proven to break", not a guarantee.

List the API changes between two versions of a package (no code scan).

Use this to understand a library's breaking changes in the abstract — e.g. when planning a migration. For "what breaks in my code", use check_upgrade instead. Defaults the baseline to the installed version.

Verify code against the ACTUALLY-INSTALLED packages to catch hallucinations.

Call this after generating code to check that the imports and API calls it uses really exist in this environment. Flags: imported packages that aren't installed (with typo/slopsquat suggestions) and attributes/methods that can't be found on installed modules/classes. Static analysis only — treat 'medium' findings as "verify", not "definitely wrong".

Check whether a package is installed; if not, suggest close real names.

Use this before writing an import to avoid hallucinated or typo'd package names (a common source of slopsquatting risk).

List the REAL public API (functions/classes/methods + signatures) of a package.

Use this to discover the correct API instead of guessing — for the installed version, or a specific version (fetched without installing). Optionally filter symbols by a substring of their dotted path.

List the ecosystem providers BumpGuard currently supports.