Skip to main content
Glama
factreason

factreason

Official
by factreason
OverviewSchemaRelated ServersScoreDiscussions
JavaScript
Remote

Stop an agent shipping a broken dependency upgrade

Your agent wants to bump chalk from 4.1.2 to 5.0.0. Before it edits package.json, it asks what breaks:

GET /api/v1/packages/npm/chalk/advisory?from=4.1.2&to=5.0.0
Authorization: Bearer <key>
{
  "found": true,
  "packageName": "chalk",
  "fromVersion": "4.1.2",
  "toVersion": "5.0.0",
  "breakingCount": 2,
  "advisories": [
    {
      "severity": "breaking",
      "changeType": "MODULE_FORMAT_CHANGED",
      "description": "chalk 5.0.0 changed module format from \"commonjs (undeclared)\" to \"module\". CommonJS require() of this package will now fail.",
      "evidenceField": "type",
      "evidenceBefore": null,
      "evidenceAfter": "module",
      "migrationHint": "Convert the call site to import(), or pin to the last CommonJS release."
    },
    {
      "severity": "breaking",
      "changeType": "RUNTIME_REQUIREMENT_RAISED",
      "description": "chalk 5.0.0 raised its runtime requirement from \">=10\" to \"^12.17.0 || ^14.13 || >=16.0.0\". Older runtimes are no longer supported.",
      "evidenceField": "engines.node",
      "evidenceBefore": ">=10",
      "evidenceAfter": "^12.17.0 || ^14.13 || >=16.0.0",
      "migrationHint": "Confirm the deployment runtime satisfies the new floor before upgrading."
    }
  ]
}

Via MCP, the same question is one tool call:

{
  "name": "factreason_package_upgrade_advisory",
  "arguments": { "registry": "npm", "name": "chalk", "from": "4.1.2", "to": "5.0.0" }
}

Every finding carries evidenceField, evidenceBefore and evidenceAfter — the exact registry metadata field and its values either side of the change. An agent can verify the claim against npm or PyPI directly rather than taking our word for it.

Related MCP server: depsonar

Connect

Streamable HTTP. No install, no package to pull.

{
  "mcpServers": {
    "factreason": {
      "type": "http",
      "url": "https://factreason.com/mcp"
    }
  }
}

Manifest: /.well-known/mcp.json

The container/stdio bridge accepts an optional FACTREASON_API_KEY environment variable and forwards it as a Bearer credential to the same live endpoint. Tool discovery works without a key; metered lookups return HTTP 402 when neither a key nor a valid x402 payment is supplied.

Get a key — no signup, no card:

curl -X POST https://factreason.com/api/v1/keys/create \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@example.com"}'

Tools

Tool

What it answers

factreason_package_upgrade_advisory

What breaks between two published npm/PyPI versions

factreason_api_schema

Exact request/response shape of an API endpoint at a version

factreason_integration_brief

Everything needed to write one working call to an API

factreason_discover_api

Which of 1,097 services can do X

factreason_deprecation_scan

Which endpoints are deprecated, sunset dates, replacements

factreason_auth_playbook

Auth schemes, scopes, rate-limit headers, error-code table

factreason_component_spec

Electronics component pinouts, voltages, packages

factreason_subscribe_spec_changes

Webhook or polling callback when a spec changes

factreason_create_topup_link

Stripe checkout link when credit runs out

Proof-of-Fact Signatures

Every response is signed by our Ed25519 private key:

  • X-FactReason-Signature: Ed25519 signature of the raw response payload

  • X-FactReason-Key-Id: Stable signing key identifier

  • X-FactReason-Signature-Alg: ed25519

Public keys are published and rotated via JWKS at https://factreason.com/.well-known/jwks.json.

Licence & Contact

MIT. Attribution requirement for APIs.guru source data: CC-BY 4.0. Questions, support, or data reports: hello@factreason.com.

Install Server
A
license - permissive license
B
quality
A
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
0dRelease cycle
2Releases (12mo)
Commit activity

Resources

Tools

View all tools

Related MCP Servers

  • versionator-mcp

    trianglegrrl
    A
    license
    A
    quality
    C
    maintenance
    An MCP server that queries 19 package registries (npm, PyPI, crates.io, etc.) to retrieve the latest version of packages and their metadata.
    21
    1
    MIT

  • depsonar

    Soflutionltd
    A
    license
    A
    quality
    D
    maintenance
    Comprehensive dependency audit MCP server supporting 9 languages and 23 tools for scanning, updating, security auditing, and migration detection.
    25
    7
    MIT

  • supply-chain-mcp-server

    badchars
    A
    license
    B
    quality
    A
    maintenance
    Unifies 21 supply chain security data sources into a single MCP server, enabling AI agents to perform comprehensive package audits, vulnerability checks, provenance verification, and risk assessment across multiple ecosystems.
    90
    27
    3
    MIT

View all related MCP servers

Related MCP Connectors

  • devstack-mcp

    Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.

  • a2adependencyinspector-mcp

    Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi

  • Deps Dev

    deps.dev — Google's package metadata + dependency graph API

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/factreason/factreason'

If you have feedback or need assistance with the MCP directory API, please join our Discord server