# packagetrackdev

What your build's dependencies changed since you locked them.

`packagetrackdev` reads the lock file in your project (`package-lock.json`,
`uv.lock`, `poetry.lock`, `Cargo.lock`, `composer.lock`, `go.mod`, or the
manifest when there is no lock) and asks
[packagetrack.dev](https://packagetrack.dev) what is waiting: withdrawn
versions in your build, how far behind your own dependencies are, and the
release notes that explain the gap.

```
packagetrackdev check                 # answer here, store nothing, no account
packagetrackdev push --name my-app    # send the dependency set to your dashboard
packagetrackdev login --api-key pkgt_...
```

What it sends is a list of package names and versions, and for `push`, who
required them. No code, no file paths, no repository name. `--dry-run` prints
the exact payload and sends nothing, for either command.

## Use it from your coding agent

Your coding agent reads the release notes before it upgrades. `packagetrackdev mcp`
serves the archive to Claude Code, Cursor and other Model Context Protocol
clients: what changed between the version you run and the one the agent is
about to install, in the maintainers' own words.

```
claude mcp add packagetrackdev -- packagetrackdev mcp
```

For Cursor, Windsurf and other clients that read an `mcpServers` map:

```json
{ "mcpServers": { "packagetrack": { "command": "packagetrackdev", "args": ["mcp"] } } }
```

VS Code's `mcp.json` uses `servers` in place of `mcpServers`, same entry.

Tool descriptions alone do not always make an agent reach for a tool. One
line in your `CLAUDE.md` or `.cursorrules` does:

```
Before upgrading a dependency, call packagetrack's package_changes with the installed and target versions.
```

Five tools: `package_changes`, `package_versions` and `search_packages`
need no account; `list_projects` and `project_report` describe the projects
you pushed and need an API key. The key comes from `packagetrackdev login` or the
`PACKAGETRACK_API_KEY` environment variable; do not put it in the agent's
config file, those files get committed. The server reads the archive and
never sees your code: what leaves your machine is a package name and one or
two version strings.

## Install

```
curl -fsSL https://packagetrack.dev/install.sh | sh
```

No sudo; everything lands in your home directory. The script installs
[uv](https://docs.astral.sh/uv/) if you do not have it, then installs
packagetrackdev from a wheel served by packagetrack.dev. If you already use uv:

```
uv tool install "packagetrackdev[mcp] @ https://packagetrack.dev/cli/packagetrackdev-latest.whl"
```

The `[mcp]` extra is the agent server above; without it you get `check`,
`push` and `login` and nothing else is pulled in.

## License

MIT.