"Packagist" matching MCP servers:

MCP server for searching and retrieving PHP/Composer package metadata from the Packagist registry, including download statistics and version details.

Enables coding agents to query package release histories, version lists, and change summaries across PyPI, npm, crates.io, Packagist, NuGet, pub.dev, Go, and Maven Central to inform dependency upgrades and detect withdrawn versions.

Enables AI assistants to fetch README content, package metadata, dependencies, and search Composer/PHP packages from Packagist with smart caching and GitHub integration.

deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.

Verified, dated facts for AI coding agents: what breaks between npm package versions (diffed from TypeScript types), per-version vulnerabilities, the newest version compatible with a given Node/Python/Rust/PHP, end-of-life dates of ~480 runtimes and frameworks, and AI model prices. Covers npm, PyPI, crates.io and Packagist.