Skip to main content
Glama
698,861 tools. Updated 2026-10-24 16:27

"A guide to Python dependency resolution and package management" matching MCP tools:

  • PyPI breaking changes between two versions of a Python package, from its CHANGELOG/HISTORY/CHANGES file and GitHub releases: breaking items per version, Requires-Python and dependency changes, yanked versions, migration guide links and a verdict. Paid: $0.005 USDC per call via x402.
    ConnectorNo auth
  • A Python package on PyPI: latest version, summary, license, required Python, dependencies, release date, project links and daily/weekly/monthly downloads. Use to choose or audit a Python dependency.
    ConnectorNo auth
  • Mint a PROJECT-scoped management token (`er_mcp_`) for MCP and REST; it cannot authenticate relay traffic. Use it after create_project to configure a fresh project, or for any project you already own. Attenuated by design: the scopes must be a subset of THIS management token's own grant (`read` is always included), expiry is mandatory (1–90 days, default 30, never "never"), and the minted management token (being project-scoped) can never mint management tokens itself. `spend` is human-granted only: no management token, of any scope, can mint one carrying it. Mint a spend-scoped token from the project's panel instead. Requires an ACCOUNT-scoped management token and the `config` scope. Returns the plaintext exactly once; only its hash is stored.
    ConnectorNo auth
  • Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: single npm publisher + >10M weekly downloads — sole point of failure for a massive attack surface - HIGH: sole publisher + >1M/wk, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) depth=1 (default): root package + all direct dependencies depth=2: also traverses one more level for any CRITICAL/HIGH direct deps (reveals hidden exposure) Examples: - audit_dependency_tree("express") — see all of Express's deps and their risk scores - audit_dependency_tree("langchain", 2) — reveal transitive CRITICAL deps 2 levels deep - audit_dependency_tree("@anthropic-ai/sdk") — audit Anthropic SDK full tree Use this when someone asks: - "What am I really depending on?" - "Are my dependencies' dependencies safe?" - "Show me the full supply chain risk for package X"
    ConnectorNo auth
  • Create new guides Create one or more new guides based on provided queries. Each guide targets exactly ONE engine and ONE analysis mode, chosen with the optional `source` field (default `google`). How to request each guide type: 1. Google SERP guide (1 credit per guide): omit `source`, or pass `source: "google"`. Example payload: {"queries": ["best crm"], "lang": "en-us"} 1bis. Google AI Overview guide (1 credit per guide). Two modes, like AI engines: `source: "google_ai_overview"` builds the guide from the TEXT of Google's AI answers (AI Overview, completed with AI Mode answers) ; `source: "google_ai_overview_citations"` builds it from the content of the web SOURCES those answers cite (recommended for GEO). Same language/country parameters as a Google SERP guide, 1 credit per guide in both modes. Example payload: {"queries": ["best crm"], "lang": "en-us", "source": "google_ai_overview_citations"} 2. LLM ANSWER guide (4 credits per guide): pass the engine name alone, e.g. `source: "chatgpt"`. The guide is built from the answer text the AI generates for the query. Example payload: {"queries": ["best crm"], "lang": "en-us", "source": "chatgpt"} 3. LLM CITATIONS guide (4 credits per guide) [RECOMMENDED AI mode]: pass the engine name with the `_citations` suffix, e.g. `source: "chatgpt_citations"`. The guide is built from the content of the web pages the AI cites in its answer. Example payload: {"queries": ["best crm"], "lang": "en-us", "source": "chatgpt_citations"} Which AI mode to pick? For GEO (getting a page visible in AI answers), prefer `<engine>_citations`: AI engines send traffic by CITING pages as sources, so the winning move is to look like the pages they cite. The answer-text mode (`<engine>` alone) is mostly useful to analyze how the AI phrases its own answer. When in doubt, pick `<engine>_citations`. The same two modes exist for every AI engine (chatgpt, perplexity, claude, gemini, grok, mistral, deepseek). To optimize the same page for several engines or modes (e.g. Google AND ChatGPT answers AND ChatGPT sources), create one guide per source value on the same query. IMPORTANT, HOW TO READ THE RESPONSE OF THIS ENDPOINT, WHICH SPENDS CREDITS. Queries listed in `guidesFailed` are PROVEN not to have produced a guide and their credit was given back (unless the account has unlimited credits, where nothing was reserved): re-sending them is free and correct. Queries listed in `guidesUnknown` have an UNDECIDABLE outcome and their credit is deliberately KEPT, because the guide was most likely written: DO NOT re-send them, you would pay for the same guide twice. Look them up in `GET /api/v1/guides` after a few minutes instead, and contact support if nothing shows up. Finally, a `200` is NOT a promise that every query produced a guide: compare `guides.length` with the number of queries you sent, never read `success` alone, and never re-send a query just because it is missing from `guides`.
    ConnectorNo auth
  • Free preview of breaking changes / new releases for a software dependency. Pass an npm/PyPI `package` (resolved and fetched live if not already tracked) or a GitHub `repo` (owner/repo). Returns up to 5 recent changes plus the package's current version. Full history, significance filtering, and the LLM brief are paid via x402.
    ConnectorNo auth

Matching MCP Servers

Matching MCP Connectors

  • Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.
    ConnectorNo auth
  • Look up a known bug before you read the library's source or search the web: when a command fails with an error raised inside a dependency (a package you did not write), call this at the first failure with the exact error text (paste it whole; up to 2000 characters), and the package and version when you know them. Search public threads (title, body and replies; every word must appear somewhere in the thread, in any order) before proposing a new WANDER question. Results show evidence_level, outcome, reply_evidence and matching replies. Read closest results; an empty lexical match does not prove semantic novelty. The first page can also list matching open calls from the keeper (open_calls): public questions with no deadline that you may answer with cairn_a2a_respond. When you hit an error in a known package, pass package (the registry name or the name you import; case and - _ . are ignored) and your version: results are then only that package and each one carries version_match (same, other or unknown), because a bug found on one version may be in yours too; package_versions lists the versions Cairn has notes on, and query becomes optional. Results are compact by default (title, package, version, a one-line glance of what is affected and what goes wrong, evidence level, URLs): read the one that applies with cairn_read_thread, or set compact to false for the full records.
    ConnectorNo auth
  • Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.
    ConnectorNo auth
  • Reports package existence, latest version and release, age, version count, npm weekly downloads, licenses, deprecation and known advisory severity. ok means no listed flags, not a safety guarantee. Supports npm, PyPI, Cargo, Go, Maven and NuGet. Optional exact version adds pinned-version metadata and uses deps.dev advisories; use /package-audit for OSV affected ranges and dated FIRST EPSS CVE estimates. Use before adding a dependency. Example: ecosystem=npm, name=lodash. Price $0.002/call via x402 USDC or a card key (/credits), first 25 free; failed calls free. Reads or computes only and changes nothing; each call is charged, so repeats are not free.
    ConnectorNo auth
  • Check the latest Axint package and optionally apply the upgrade while preserving the current agent thread. Use: call when axint.status shows a stale server; not for app dependency upgrades. Inputs: apply defaults false; targetVersion selects the install, while reinstallXcode and writeReport matter only when applying. Effects: destructive when apply=true: can run package installs, refresh Xcode wiring, and write .axint/upgrade; may use npm.
    Connector
    Destructive
    No auth
  • Mamanida's editorial buying guides for one storefront, in that storefront's own language. Called without `guide` it lists the published guides (metadata only: title, deck, meta description, pillar, topics, dates and the canonical Mamanida URL), optionally filtered by `topic`. Called with `guide` (the guide slug from the listing) it returns that one localized edition plus its structured body: paragraphs, headings, lists, comparison tables, callouts, links to other guides and category calls-to-action. A `category_cta` gives a `category_slug` you can pass straight to search_products, which is the intended guide → category → product path. Retailer and affiliate URLs are never returned.
    ConnectorNo auth
  • Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.
    ConnectorNo auth
  • Get end-of-life status. Use this when the user asks whether a software version is still supported or when it reaches end of life, such as "is Node.js 20 still supported?" or "which Python versions get security fixes?". Pass the product (nodejs, python, ubuntu, postgresql and so on) and optionally a version or release cycle. With a version it returns that cycle's end-of-life date, whether it has passed, LTS dates and the latest patch. Without one it returns the release cycles that are still supported. Data comes from endoflife.date, maintained by volunteers: confirm with the vendor for contract or compliance decisions. Not for package vulnerabilities.
    ConnectorNo auth
  • Check exact npm, PyPI or Go package versions against a local snapshot of the GitHub Reviewed Advisory Database. Returns matching advisories with affected ranges, fixed versions and source links. When to use: Use when reviewing a lockfile, dependency upgrade or security question about specific versions. No match does not prove a package is safe. Notes: No account or token needed. Example arguments: {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}]}
    ConnectorNo auth
  • <summary>Replace the user's writing style guide for one channel, the voice Sliq writes in there. A set guide overrides the communication style in memory, so when the user wants to sound different in a channel that has a guide, change the guide. It replaces text the user wrote or approved: keep everything they didn't ask to change, and tell them what you changed. To edit a guide, read it with get_writing_style_guide and pass back the whole new guide, without the notes that tool appends after it. The other channels keep their guides.</summary> <returns> <description>The writing style settings after the change.</description> </returns>
    ConnectorOAuth
  • Security advisories, license and dependency metadata for ONE specific published release of a package. Requires an exact version that this package actually shipped — if you do not already have one, call `package` first to list them; a version guessed or carried over from a different package will not resolve.
    ConnectorNo auth
  • Check if a package is allowed by a hextrap firewall and verify it is not a suspected typosquat. Call this BEFORE suggesting any npm, PyPI, or Go dependency to ensure it meets security policy.
    ConnectorAPI key
  • Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_dependency_graph", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".
    ConnectorNo auth
  • Bulk-import a CSV file into a D365 F&O entity through the Data Management package REST API. Builds the package (Manifest + header + CSV) in memory, uploads it to Azure blob, then calls ImportFromPackage which AUTO-CREATES the data project from the manifest. Runs in batch; the tool polls until completion and returns the final status plus an error-keys file URL when rows fail. Provide either filePath (a .csv on disk) or inline csvContent. Resolve the entity name from the KB (find_entity_for_table) -- do not invent it.
    Connector
    Destructive
    No auth
  • Dependency approval decision for coding agents: decide whether an npm dependency or package is safe to install or adopt and return GO, WARN, or BLOCK using vulnerabilities, security, license, maintenance, deprecation, and package metadata. Price: $0.25 via x402. Generate one _salt19_operation_id per intended purchase, preserve it across retries, and add _x402_payment_signature after satisfying the challenge. A stable _salt19_operation_id is required and makes semantic retries at-most-once. _salt19_operation_id is recommended but optional for standard x402 compatibility.
    ConnectorNo auth