packagetrackdev-mcp
OfficialProvides release history for npm packages, including available versions, prerelease and withdrawn flags, and changelog-style differences between version ranges.
Provides release history for NuGet packages, including available versions, prerelease and withdrawn flags, and changelog-style differences between version ranges.
Provides release history for Packagist packages, including available versions, prerelease and withdrawn flags, and changelog-style differences between version ranges.
Provides release history for PyPI packages, including available versions, prerelease and withdrawn flags, and changelog-style differences between version ranges.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@packagetrackdev-mcpUpgrade httpx to the newest release and tell me what changed since 0.24.1"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
packagetrackdev-mcp
Model Context Protocol server for PackageTrack. Gives coding agents the release history of packages on PyPI, npm, crates.io, Packagist, NuGet, pub.dev, Go and Maven Central: what changed between two versions, which versions exist, which have been withdrawn.
Install
curl -fsSL https://packagetrack.dev/install.sh | shInstalls uv if needed, then this server and the
packagetrackdev CLI
as uv tools. To install only the server:
uv tool install --find-links https://packagetrack.dev/cli/ packagetrackdev-mcpRequires Python 3.11+.
Related MCP server: package-version-check-mcp
Configuration
Claude Code:
claude mcp add -s user packagetrackdev -- packagetrackdev-mcpClaude Desktop (claude_desktop_config.json), Cursor, Windsurf and other
clients with an mcpServers map:
{
"mcpServers": {
"packagetrackdev": {
"command": "packagetrackdev-mcp"
}
}
}VS Code (mcp.json) uses servers instead of mcpServers.
Optional environment variables:
Variable | Description |
| Enables the project tools. Create a key at packagetrack.dev/app/keys. Also read from |
| Server URL. Default: |
Tools
Tool | Description | Key |
| Release notes for every version between | no |
| Summary, source repository, latest stable version and recent releases with prerelease and withdrawn flags. | no |
| Search the archive by name. | no |
| Projects pushed with | yes |
| Withdrawn versions and outdated dependencies in one project, with the notable release-note lines. | yes |
A package the archive does not hold yet is fetched on request; ask again after a minute.
Example prompt:
Upgrade httpx to the newest release and tell me what changed since 0.24.1Agents do not always reach for tools on their own. Adding one line to
CLAUDE.md or .cursorrules helps:
Before upgrading a dependency, call packagetrack's package_changes with the installed and target versions.Privacy
A tool call sends a package name and version strings. No code, file paths or repository names leave the machine. The server stores nothing and calls no model.
Debugging
Run the server under the MCP Inspector to call tools by hand:
npx @modelcontextprotocol/inspector packagetrackdev-mcpDevelopment
uv sync
uv run pytestLicense
MIT
Available Tools
5 toolslist_projectsA
The user's projects on PackageTrack (pushed with packagetrackdev push): how many dependencies each has, how many the archive could compare, and how many are behind or withdrawn. Needs a PackageTrack API key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the behavioral disclosure burden. It does add the prerequisite 'PackageTrack API key' and hints at read-only output, but it omits potential failure modes, network/auth behavior, and whether the operation mutates anything. Partial coverage, so a 3.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences deliver the resource, the metric breakdown, and the authentication requirement without any filler. Information is front-loaded and each clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema, the description is largely self-contained. It does not explain edge cases or error handling, but the mention of the API key and project provenance covers the main operational context an agent needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100% (vacuously), so per the rubric the baseline is 4. The description adds no parameter-specific meaning because there are no parameters, but it does clarify the data scope (user's pushed projects), which complements the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource ('the user's projects on PackageTrack') and the specific metrics returned (dependencies, comparable archive counts, behind/withdrawn status). It does not explicitly name or contrast sibling tools, so it earns a 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to choose this tool over siblings like project_report or search_packages. The description only states the tool's context and the API key requirement, but never gives usage decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_changesA
What the maintainers wrote about each release between two versions of a package, oldest first; a release with no notes is said to have none, and a withdrawn release is flagged. Call this before upgrading a dependency, with the installed version as since and the target as until (omit until for everything up to the newest release). Long ranges are paged and long notes are cut; the answer says how to get the rest, and max_chars raises the cut for one note.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| since | Yes | ||
| until | No | ||
| ecosystem | Yes | ||
| max_chars | No | ||
| include_prereleases | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full behavioral burden and does so well: it discloses ordering, handling of releases without notes, withdrawn-release flags, pagination, truncation, and how to retrieve truncated content. It does not mention side effects, auth, or rate limits, but for a read-only query tool the disclosed behaviors are sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, opening with the core purpose before adding behavioral details. Every clause earns its place: ordering, empty-notes behavior, withdrawn flags, paging, truncation, and parameter usage all appear without redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 6 parameters, a rich behavior set, and the presence of an output schema, the description covers everything needed to decide when to call the tool and how to invoke it correctly. Return-value structure is reasonably delegated to the output schema, and the usage guidance plus behavioral notes make the description complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for the key parameters: `since` and `until` are explained in context, and `max_chars` is explicitly tied to raising the note-length cut. `include_prereleases` is not described, but its name and default are self-explanatory; overall the description adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (returns maintainer notes) and a precise resource (release notes between two package versions), and adds distinctive behaviors (oldest-first, withdrawn-release flagging, no-notes handling). This makes it clearly distinguishable from sibling tools like package_versions or search_packages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit usage context: call before upgrading a dependency, with the installed version as `since` and the target as `until`. It also explains when to omit `until`. It does not explicitly name alternatives or exclusions, but the guidance is clear enough for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_versionsA
What a package is and which versions of it exist: summary, source repository, latest stable release, and the newest releases with their dates, prerelease and withdrawn flags. Use it to pick an upgrade target or to check that a version has not been withdrawn.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| ecosystem | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It usefully discloses the returned fields, including prerelease and withdrawn flags, and implies a read-only query. However, it doesn't mention version list limits, ordering, pagination, or data-source caveats, which could matter for an agent relying on 'newest releases.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and well structured. The first sentence front-loads the resource and returned data in a compact list; the second gives concrete usage guidance. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter schema and the presence of an output schema, the description covers the tool's core purpose and output contents sufficiently. The only notable gap is not clarifying whether 'newest releases' is a limited list or all versions, though the output schema may resolve this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no specific meaning to 'name' or 'ecosystem' beyond what the schema already shows. The enum values are self-explanatory, but the description doesn't explain the relationship between the package name and ecosystem, nor any formatting or required registry context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource ('package') and the information returned (summary, source repository, latest stable release, newest releases with flags). This clearly differentiates it from siblings like package_changes and search_packages by focusing on what a package is and its existing versions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete use cases: 'pick an upgrade target' and 'check that a version has not been withdrawn.' This is clear contextual guidance, though it does not explicitly name sibling tools or say when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_reportA
What PackageTrack tells the user about one of their projects: withdrawn versions in the build, each dependency that is behind with the notable lines from the newest releases it is missing, and where the full notes are. Needs a PackageTrack API key; list_projects gives the names.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the disclosure burden. It discloses the API-key requirement and the nature of the returned content, and 'tells the user' implies a non-mutating read operation. It does not mention behavior like error conditions, rate limits, or whether the report is generated from live or cached data, which prevents a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact: one sentence enumerating the report contents and a second sentence for prerequisites. It is front-loaded with the report's purpose and avoids filler. The dependency clause is slightly convoluted, but the overall length and structure are appropriate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single parameter, an existing output schema, and no annotations, the description covers the essential invocation details: what the report contains, the API-key prerequisite, and where to get the project name. It does not discuss error cases or alternative tools in depth, but an agent has enough information to call and interpret this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only a `name` string with no description, so the description must compensate. It does so by indicating that the name comes from `list_projects` and represents one of the user's projects, giving semantic grounding the bare schema lacks. For a single parameter, this is meaningful and sufficient guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource ('one of their projects') and the core output categories: withdrawn versions, behind dependencies, notable missing release lines, and where full notes live. It also distinguishes itself from `list_projects` by implying that list_projects only supplies names. However, the wording 'What PackageTrack tells the user' is indirect rather than a strong verb phrase like 'returns a report'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides actionable guidance by stating that a PackageTrack API key is needed and that `list_projects` supplies the names, which tells the agent how to prepare the required input. It does not explicitly state when not to use this tool versus alternatives, but the context is clear enough for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_packagesB
Find packages in the archive by name. Returns the matches across every registry with a one-line summary each.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does add behavioral context beyond a bare statement: it discloses that the search spans 'every registry' and that results are returned as one-line summaries — a helpful non-obvious trait. But it omits other behavioral details such as read-only nature, auth requirements, pagination, result limits, or no-match behavior. For a search tool these gaps are moderate, not severe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action, with no filler or repetition. The second sentence about return format is slightly redundant given an output schema exists, but it adds the useful cross-registry scope detail. Appropriately sized for a simple one-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool (one parameter, output schema present), the description covers the essential purpose, scope, and result format. Gaps remain: no guidance on when this tool is the right choice versus sibling tools, no query matching details, and with no annotations, the safety profile of the operation is left implied. Adequate but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the bare 'query' string property. It partially does by establishing that the query is a package name ('Find packages in the archive by name'), which gives the parameter real meaning. However, it doesn't clarify matching semantics such as exact vs. substring, case sensitivity, or wildcard support, leaving room for misinterpretation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Find packages in the archive') with a clear method ('by name') and scope ('across every registry'). The purpose is clearly distinguishable from siblings like package_changes, package_versions, and list_projects by name and function, though it does not explicitly name a sibling to disambiguate against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied rather than stated: an agent can infer this tool is for locating packages by name, and the sibling names (package_changes, package_versions, project_report) suggest alternative tools for other intents. However, there is no explicit when-to-use versus alternatives, no exclusions, and no guidance such as 'use package_versions to inspect a known package's versions.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.1- First observed
list_projects - First observed
package_changes - First observed
package_versions - First observed
project_report - First observed
search_packages
TDQS
Scored across 5 tools
Each tool maps to a distinct step in the workflow: searching, inspecting versions, reading release changes, listing projects, and generating a project report. package_changes and package_versions share the same prefix and both relate to versions, so they could be confused at first glance, but the descriptions clearly separate change notes from version metadata.
The names are uniformly snake_case and readable, but the naming pattern is mixed: search_packages and list_projects follow verb_noun, while package_changes, package_versions, and project_report are noun phrases. A consistent verb_noun style such as list_package_changes and get_project_report would improve predictability.
Five tools is well within the ideal scope for a focused server, and each tool earns its place in the dependency-tracking and upgrade workflow. Nothing feels redundant or tacked on.
The toolset covers a complete workflow: find packages, inspect version status, read release notes, list the user's projects, and pull an upgrade-oriented project report. There are no obvious dead ends for the server's apparent purpose of supporting dependency review and upgrades.
Maintenance
Related MCP Connectors
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Change intelligence for coding agents: sourced breaking changes for npm, PyPI, and Rust packages.
Real-time Python package and vulnerability data for AI coding agents.
Related MCP Servers
- AlicenseAqualityCmaintenanceChecks npm and PyPI packages for outdated versions, deprecation status, and breaking changes with cited sources, enabling AI agents to verify dependency freshness.13 npmISC
- AlicenseAqualityAmaintenanceEnables AI coding agents to retrieve the latest stable versions of packages and tools across multiple ecosystems, preventing outdated dependency versions in generated code.4216 PyPI8Apache 2.0
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to search and retrieve detailed package information from multiple package registries (NPM, crates.io, NuGet, PyPI, Go).1,047 npmMIT
- AlicenseNot gradedqualityBmaintenanceProvides software supply-chain intelligence for AI agents, enabling them to query package metadata, versions, downloads, dependencies, and health signals for npm, PyPI, and crates.io packages without API keys.MIT