Skip to main content
Glama
packagetrack-dev

packagetrackdev-mcp

Official

packagetrackdev-mcp

CI License: MIT

Model Context Protocol server for PackageTrack. Gives coding agents the release history of packages on PyPI, npm, crates.io, Packagist, NuGet, pub.dev, Go and Maven Central: what changed between two versions, which versions exist, which have been withdrawn.

Install

curl -fsSL https://packagetrack.dev/install.sh | sh

Installs uv if needed, then this server and the packagetrackdev CLI as uv tools. To install only the server:

uv tool install --find-links https://packagetrack.dev/cli/ packagetrackdev-mcp

Requires Python 3.11+.

Related MCP server: package-version-check-mcp

Configuration

Claude Code:

claude mcp add -s user packagetrackdev -- packagetrackdev-mcp

Claude Desktop (claude_desktop_config.json), Cursor, Windsurf and other clients with an mcpServers map:

{
  "mcpServers": {
    "packagetrackdev": {
      "command": "packagetrackdev-mcp"
    }
  }
}

VS Code (mcp.json) uses servers instead of mcpServers.

Optional environment variables:

Variable

Description

PACKAGETRACK_API_KEY

Enables the project tools. Create a key at packagetrack.dev/app/keys. Also read from ~/.packagetrack/config.toml, written by packagetrackdev login.

PACKAGETRACK_SERVER

Server URL. Default: https://packagetrack.dev.

Tools

Tool

Description

Key

package_changes

Release notes for every version between since and until, oldest first. Long ranges are paged.

no

package_versions

Summary, source repository, latest stable version and recent releases with prerelease and withdrawn flags.

no

search_packages

Search the archive by name.

no

list_projects

Projects pushed with packagetrackdev push and how far behind each is.

yes

project_report

Withdrawn versions and outdated dependencies in one project, with the notable release-note lines.

yes

A package the archive does not hold yet is fetched on request; ask again after a minute.

Example prompt:

Upgrade httpx to the newest release and tell me what changed since 0.24.1

Agents do not always reach for tools on their own. Adding one line to CLAUDE.md or .cursorrules helps:

Before upgrading a dependency, call packagetrack's package_changes with the installed and target versions.

Privacy

A tool call sends a package name and version strings. No code, file paths or repository names leave the machine. The server stores nothing and calls no model.

Debugging

Run the server under the MCP Inspector to call tools by hand:

npx @modelcontextprotocol/inspector packagetrackdev-mcp

Development

uv sync
uv run pytest

License

MIT

Available Tools

5 tools
list_projectsA

The user's projects on PackageTrack (pushed with packagetrackdev push): how many dependencies each has, how many the archive could compare, and how many are behind or withdrawn. Needs a PackageTrack API key.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the behavioral disclosure burden. It does add the prerequisite 'PackageTrack API key' and hints at read-only output, but it omits potential failure modes, network/auth behavior, and whether the operation mutates anything. Partial coverage, so a 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences deliver the resource, the metric breakdown, and the authentication requirement without any filler. Information is front-loaded and each clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with an output schema, the description is largely self-contained. It does not explain edge cases or error handling, but the mention of the API key and project provenance covers the main operational context an agent needs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is 100% (vacuously), so per the rubric the baseline is 4. The description adds no parameter-specific meaning because there are no parameters, but it does clarify the data scope (user's pushed projects), which complements the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource ('the user's projects on PackageTrack') and the specific metrics returned (dependencies, comparable archive counts, behind/withdrawn status). It does not explicitly name or contrast sibling tools, so it earns a 4 rather than a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to choose this tool over siblings like project_report or search_packages. The description only states the tool's context and the API key requirement, but never gives usage decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_changesA

What the maintainers wrote about each release between two versions of a package, oldest first; a release with no notes is said to have none, and a withdrawn release is flagged. Call this before upgrading a dependency, with the installed version as since and the target as until (omit until for everything up to the newest release). Long ranges are paged and long notes are cut; the answer says how to get the rest, and max_chars raises the cut for one note.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
sinceYes
untilNo
ecosystemYes
max_charsNo
include_prereleasesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full behavioral burden and does so well: it discloses ordering, handling of releases without notes, withdrawn-release flags, pagination, truncation, and how to retrieve truncated content. It does not mention side effects, auth, or rate limits, but for a read-only query tool the disclosed behaviors are sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, opening with the core purpose before adding behavioral details. Every clause earns its place: ordering, empty-notes behavior, withdrawn flags, paging, truncation, and parameter usage all appear without redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 6 parameters, a rich behavior set, and the presence of an output schema, the description covers everything needed to decide when to call the tool and how to invoke it correctly. Return-value structure is reasonably delegated to the output schema, and the usage guidance plus behavioral notes make the description complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does for the key parameters: `since` and `until` are explained in context, and `max_chars` is explicitly tied to raising the note-length cut. `include_prereleases` is not described, but its name and default are self-explanatory; overall the description adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (returns maintainer notes) and a precise resource (release notes between two package versions), and adds distinctive behaviors (oldest-first, withdrawn-release flagging, no-notes handling). This makes it clearly distinguishable from sibling tools like package_versions or search_packages.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit usage context: call before upgrading a dependency, with the installed version as `since` and the target as `until`. It also explains when to omit `until`. It does not explicitly name alternatives or exclusions, but the guidance is clear enough for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

package_versionsA

What a package is and which versions of it exist: summary, source repository, latest stable release, and the newest releases with their dates, prerelease and withdrawn flags. Use it to pick an upgrade target or to check that a version has not been withdrawn.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
ecosystemYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It usefully discloses the returned fields, including prerelease and withdrawn flags, and implies a read-only query. However, it doesn't mention version list limits, ordering, pagination, or data-source caveats, which could matter for an agent relying on 'newest releases.'

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences and well structured. The first sentence front-loads the resource and returned data in a compact list; the second gives concrete usage guidance. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple two-parameter schema and the presence of an output schema, the description covers the tool's core purpose and output contents sufficiently. The only notable gap is not clarifying whether 'newest releases' is a limited list or all versions, though the output schema may resolve this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no specific meaning to 'name' or 'ecosystem' beyond what the schema already shows. The enum values are self-explanatory, but the description doesn't explain the relationship between the package name and ecosystem, nor any formatting or required registry context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific resource ('package') and the information returned (summary, source repository, latest stable release, newest releases with flags). This clearly differentiates it from siblings like package_changes and search_packages by focusing on what a package is and its existing versions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete use cases: 'pick an upgrade target' and 'check that a version has not been withdrawn.' This is clear contextual guidance, though it does not explicitly name sibling tools or say when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_reportA

What PackageTrack tells the user about one of their projects: withdrawn versions in the build, each dependency that is behind with the notable lines from the newest releases it is missing, and where the full notes are. Needs a PackageTrack API key; list_projects gives the names.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the disclosure burden. It discloses the API-key requirement and the nature of the returned content, and 'tells the user' implies a non-mutating read operation. It does not mention behavior like error conditions, rate limits, or whether the report is generated from live or cached data, which prevents a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact: one sentence enumerating the report contents and a second sentence for prerequisites. It is front-loaded with the report's purpose and avoids filler. The dependency clause is slightly convoluted, but the overall length and structure are appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a single parameter, an existing output schema, and no annotations, the description covers the essential invocation details: what the report contains, the API-key prerequisite, and where to get the project name. It does not discuss error cases or alternative tools in depth, but an agent has enough information to call and interpret this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a `name` string with no description, so the description must compensate. It does so by indicating that the name comes from `list_projects` and represents one of the user's projects, giving semantic grounding the bare schema lacks. For a single parameter, this is meaningful and sufficient guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource ('one of their projects') and the core output categories: withdrawn versions, behind dependencies, notable missing release lines, and where full notes live. It also distinguishes itself from `list_projects` by implying that list_projects only supplies names. However, the wording 'What PackageTrack tells the user' is indirect rather than a strong verb phrase like 'returns a report'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides actionable guidance by stating that a PackageTrack API key is needed and that `list_projects` supplies the names, which tells the agent how to prepare the required input. It does not explicitly state when not to use this tool versus alternatives, but the context is clear enough for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_packagesB

Find packages in the archive by name. Returns the matches across every registry with a one-line summary each.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does add behavioral context beyond a bare statement: it discloses that the search spans 'every registry' and that results are returned as one-line summaries — a helpful non-obvious trait. But it omits other behavioral details such as read-only nature, auth requirements, pagination, result limits, or no-match behavior. For a search tool these gaps are moderate, not severe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core action, with no filler or repetition. The second sentence about return format is slightly redundant given an output schema exists, but it adds the useful cross-registry scope detail. Appropriately sized for a simple one-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool (one parameter, output schema present), the description covers the essential purpose, scope, and result format. Gaps remain: no guidance on when this tool is the right choice versus sibling tools, no query matching details, and with no annotations, the safety profile of the operation is left implied. Adequate but not fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the bare 'query' string property. It partially does by establishing that the query is a package name ('Find packages in the archive by name'), which gives the parameter real meaning. However, it doesn't clarify matching semantics such as exact vs. substring, case sensitivity, or wildcard support, leaving room for misinterpretation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Find packages in the archive') with a clear method ('by name') and scope ('across every registry'). The purpose is clearly distinguishable from siblings like package_changes, package_versions, and list_projects by name and function, though it does not explicitly name a sibling to disambiguate against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: an agent can infer this tool is for locating packages by name, and the sibling names (package_changes, package_versions, project_report) suggest alternative tools for other intents. However, there is no explicit when-to-use versus alternatives, no exclusions, and no guidance such as 'use package_versions to inspect a known package's versions.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.1
    • First observedlist_projects
    • First observedpackage_changes
    • First observedpackage_versions
    • First observedproject_report
    • First observedsearch_packages

TDQS

A3.8/5.0

Scored across 5 tools

Disambiguation4/5

Each tool maps to a distinct step in the workflow: searching, inspecting versions, reading release changes, listing projects, and generating a project report. package_changes and package_versions share the same prefix and both relate to versions, so they could be confused at first glance, but the descriptions clearly separate change notes from version metadata.

Naming Consistency3/5

The names are uniformly snake_case and readable, but the naming pattern is mixed: search_packages and list_projects follow verb_noun, while package_changes, package_versions, and project_report are noun phrases. A consistent verb_noun style such as list_package_changes and get_project_report would improve predictability.

Tool Count5/5

Five tools is well within the ideal scope for a focused server, and each tool earns its place in the dependency-tracking and upgrade workflow. Nothing feels redundant or tacked on.

Completeness5/5

The toolset covers a complete workflow: find packages, inspect version status, read release notes, list the user's projects, and pull an upgrade-oriented project report. There are no obvious dead ends for the server's apparent purpose of supporting dependency review and upgrades.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Enables AI coding agents to retrieve the latest stable versions of packages and tools across multiple ecosystems, preventing outdated dependency versions in generated code.
    4
    216 PyPI
    8
    Apache 2.0
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to search and retrieve detailed package information from multiple package registries (NPM, crates.io, NuGet, PyPI, Go).
    1,047 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Provides software supply-chain intelligence for AI agents, enabling them to query package metadata, versions, downloads, dependencies, and health signals for npm, PyPI, and crates.io packages without API keys.
    MIT