Skip to main content
Glama
Sign In
package-intel-mcp

package-intel-mcp

by datakoot
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

Package Intel MCP — by Datakoot

Software supply-chain intelligence for AI agents — as MCP tools your agent can call mid-task, so it can vet a dependency before it installs it. Covers npm, PyPI and crates.io. No API keys.

Tools

Tool

What it does

Source

package_info

Metadata for a package: description, latest version, license, homepage & repo links

npm / PyPI / crates.io

package_versions

Full version history with release dates

npm / PyPI / crates.io

package_downloads

Download counts and popularity signal

npm / PyPI / crates.io

package_dependencies

Direct dependencies for a given version

deps.dev

package_health

Health signals: OpenSSF Scorecard, stars, dependents

deps.dev

package_search

Search for packages by keyword

npm / PyPI / crates.io

Every tool accepts an ecosystem of npm, pypi, or crates. No API keys required.

Related MCP server: DepHealth MCP

Quick start

claude mcp add --transport http package-intel https://package.datakoot.com/mcp

Or point any MCP client at https://package.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

curl -s https://package.datakoot.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

You get a supply-chain health snapshot for the npm package express — versions, downloads, dependencies, maintenance signals — no API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

  • "How healthy is the npm package express?"

  • "Before I add left-pad, is it actively maintained and widely used?"

Data & attribution

Data comes from the public registry APIs for npm, PyPI and crates.io, plus deps.dev (Google Open Source Insights, CC-BY 4.0) for dependency graphs and OpenSSF Scorecard health signals. Package data is served from official public APIs and is informational.

Part of Datakoot — keyless intelligence APIs for AI agents.

Available Tools

6 tools
package_dependenciesPackage DependenciesA
Read-onlyIdempotent
Inspect

List the direct dependencies of a specific package version (defaults to latest), via deps.dev. Lets an agent understand what a package pulls in before adding it. Ecosystems: npm, pypi, cargo.

Inputs: name (required), ecosystem (required), version. Returns: name, source, version, ecosystem, +6 more

package_downloadsPackage DownloadsA
Read-onlyIdempotent
Inspect

Get popularity/download statistics for a package (recent download counts). Useful for judging how widely used and battle-tested a dependency is. Ecosystems: npm, pypi, cargo.

Inputs: name (required), ecosystem (required). Returns: ecosystem, last_month, provenance

package_healthPackage HealthA
Read-onlyIdempotent
Inspect

A composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known security advisories (via deps.dev). Returns a summary an agent can act on. Ecosystems: npm, pypi, cargo.

Inputs: name (required), ecosystem (required). Returns: license, verdict, concerns, deprecated, +10 more

package_infoPackage InfoA
Read-onlyIdempotent
Inspect

Get core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated. Use before an agent installs or recommends a dependency. Ecosystems: npm, pypi, cargo.

Inputs: name (required), ecosystem (required). Returns: name, license, version, homepage, +9 more

package_searchPackage SearchA
Read-onlyIdempotent
Inspect

Search for packages by keyword and get the top matches with descriptions. Supported ecosystems: npm and cargo (PyPI has no public search API).

Inputs: query (required), ecosystem (required), limit. Returns: query, results, ecosystem, provenance, +1 more

package_versionsPackage VersionsA
Read-onlyIdempotent
Inspect

List recent released versions of a package with release dates (most recent first). Helps an agent pick a version or check how actively it is maintained. Ecosystems: npm, pypi, cargo.

Inputs: name (required), ecosystem (required), limit. Returns: name, latest, versions, ecosystem, +1 more

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    TDQS

    A3.9/5.0

    Scored across 6 tools

    Disambiguation4/5

    Each tool targets a distinct aspect of package intelligence (downloads, metadata, versions, dependencies, health, search), so selection is generally clear. There is mild overlap between package_info and package_health, since health reports a superset of info fields like license and deprecation, but the composite/actionable framing of health distinguishes it.

    Naming Consistency5/5

    All six tools use a uniform package_<noun> snake_case pattern (package_info, package_versions, package_dependencies, etc.), making names highly predictable. No mixing of conventions or verb styles.

    Tool Count5/5

    Six tools is well-scoped for a package-intelligence server, with each tool earning its place across popularity, metadata, versions, dependencies, health, and search. Nothing feels redundant or missing in size.

    Completeness4/5

    The surface covers a full evaluation lifecycle: discover (search), inspect (info, versions), assess risk (downloads, dependencies, health). Minor gap: package_search only works for npm and cargo, and there is no reverse-dependency or license-compatibility operation, but core workflows are covered.

    Maintenance

    ActivityMaintained
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • oss-intel-mcp

      FoundryNet
      A
      license
      Not graded
      quality
      F
      maintenance
      Open source intelligence for AI agents — GitHub project-health scoring, package dependency-risk analysis, trending repositories, license checks, and side-by-side package comparison.
      MIT

    • pkg-intel-mcp

      JanMaa
      A
      license
      A
      quality
      D
      maintenance
      Package intelligence for AI coding agents that checks npm and PyPI package health, deprecation, vulnerabilities, bundle size, and compares alternatives.
      5
      MIT

    • Security Intel MCP

      datakoot
      A
      license
      A
      quality
      B
      maintenance
      Vulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.
      5
      MIT