lastseen-mcp

mcp-name: dev.lastseen/mortality

Is this dependency dead? Dated observations of whether an npm package, GitHub Action, MCP server, or Docker image is alive, dormant, abandoned, archived, or deleted — published by lastseen.dev. Free, no API key, zero telemetry.

There are two ways in, and they answer the same question from the same dated data:

1. Call the free HTTP API directly — the durable, machine-native path (below). An agent that keeps a dependency list can re-check it on every build.

2. Run it as an MCP server — a thin stdio wrapper over that same API, for MCP clients.

1. The free API (call it directly)

No key. No signup. 60 requests/minute, anonymous GET. Every response is a dated observation with its source — not a score, not advice. Base URL https://lastseen.dev.

# one component (owner/repo)
curl https://lastseen.dev/api/v1/entity/actions/checkout

# everything held under a GitHub owner/org
curl https://lastseen.dev/api/v1/org/actions

# a whole manifest at once (names-only body)
curl -X POST https://lastseen.dev/api/v1/manifest \
  -H 'content-type: application/json' \
  -d '{"channel":"api","components":[{"name":"actions/checkout","kind":"github-action"}]}'

# self-describing API docs (JSON)
curl https://lastseen.dev/api/v1/docs

A single-component response carries the latest_state, the dated series behind it, the source_of_record, and interval-censoring notes — enough to re-check any verdict against GitHub yourself. This is the recurring path: wire GET /api/v1/entity/{owner}/{repo} into CI and a dead dependency shows up on the build that introduces it, not months later.

Contract

• Lookups, not advice. Every answer is a dated observation with its source. Never "use X instead", never a composite score, never a ranking by preference, never urgency language.

• Fails closed. An unknown or fabricated subject returns a clean not_observed — never a fabricated result. A network/store error degrades (try later); it is never read as "dead".

• Absence ≠ gone. No record means "not checked", never "deleted". Only an authoritative HTTP 404 is a deletion.

States

alive (≤180d since last commit) · dormant (180–365d) · abandoned (>365d) · archived (repo archived) · deleted (authoritative HTTP 404) · eol (declared end-of-life) · unknown-stale (the observation the verdict rests on is older than the 180-day threshold and was not re-verified — no state asserted; not a death) · not_observed (403 / 429 / timeout / not held — not dead).

Related MCP server: Dependency Health MCP

2. Run it as an MCP server

A pure-standard-library stdio wrapper over the API above — no mcp package, no requests, no FastAPI/Starlette, nothing that can conflict with a host app. It speaks JSON-RPC 2.0 over stdio and calls the free API over urllib.

Install

pipx install lastseen-mcp
# or run without installing:
uvx lastseen-mcp

Requires Python ≥ 3.10. No dependencies.

Add to an MCP client

{
  "mcpServers": {
    "lastseen": { "command": "lastseen-mcp" }
  }
}

(If you use uvx, set "command": "uvx", "args": ["lastseen-mcp"].)

Tools

check_manifest looks up at most 30 parsed components per call (free-tier rate bound); any remainder is reported as n_truncated.

Privacy

Zero telemetry. The client and the API store nothing and transmit no identifier about you, your org, or the subjects you look up — anonymous GETs only.

Licensing

• Code: MIT (see LICENSE).

• Data: the mortality/survival observations are published by lastseen.dev under CC-BY-4.0 (attribution required). The two licenses are independent.

Links

• Service & data: https://lastseen.dev

• API docs (self-describing JSON): https://lastseen.dev/api/v1/docs

• MCP registry entry: dev.lastseen/mortality