packagetrackdev

What your build's dependencies changed since you locked them.

packagetrackdev reads the lock file in your project (package-lock.json, uv.lock, poetry.lock, Cargo.lock, composer.lock, go.mod, or the manifest when there is no lock) and asks packagetrack.dev what is waiting: withdrawn versions in your build, how far behind your own dependencies are, and the release notes that explain the gap.

packagetrackdev check                 # answer here, store nothing, no account
packagetrackdev push --name my-app    # send the dependency set to your dashboard
packagetrackdev login --api-key pkgt_...

What it sends is a list of package names and versions, and for push, who required them. No code, no file paths, no repository name. --dry-run prints the exact payload and sends nothing, for either command.

Use it from your coding agent

Your coding agent reads the release notes before it upgrades. packagetrackdev mcp serves the archive to Claude Code, Cursor and other Model Context Protocol clients: what changed between the version you run and the one the agent is about to install, in the maintainers' own words.

claude mcp add packagetrackdev -- packagetrackdev mcp

For Cursor, Windsurf and other clients that read an mcpServers map:

{ "mcpServers": { "packagetrack": { "command": "packagetrackdev", "args": ["mcp"] } } }

VS Code's mcp.json uses servers in place of mcpServers, same entry.

Tool descriptions alone do not always make an agent reach for a tool. One line in your CLAUDE.md or .cursorrules does:

Before upgrading a dependency, call packagetrack's package_changes with the installed and target versions.

Five tools: package_changes, package_versions and search_packages need no account; list_projects and project_report describe the projects you pushed and need an API key. The key comes from packagetrackdev login or the PACKAGETRACK_API_KEY environment variable; do not put it in the agent's config file, those files get committed. The server reads the archive and never sees your code: what leaves your machine is a package name and one or two version strings.

Related MCP server: pkg-intel-mcp

Install

curl -fsSL https://packagetrack.dev/install.sh | sh

No sudo; everything lands in your home directory. The script installs uv if you do not have it, then installs packagetrackdev from a wheel served by packagetrack.dev. If you already use uv:

uv tool install "packagetrackdev[mcp] @ https://packagetrack.dev/cli/packagetrackdev-latest.whl"

The [mcp] extra is the agent server above; without it you get check, push and login and nothing else is pulled in.

License

MIT.