"A guide to Python dependency resolution and package management" matching MCP tools:

• get_pypi_packageA

  developer-tools-mcp-serverA

  Retrieve Python package information from PyPI (Python Package Index). Returns current version, download counts, dependencies, release history, package homepage, and PyPI page URL. Use for Python library evaluation, dependency analysis, or checking package quality metrics.

  ConnectorNo auth

• get_pypi_packageA

  Developer Tools MCP ServerA

  Retrieve Python package information from PyPI (Python Package Index). Returns current version, download counts, dependencies, release history, package homepage, and PyPI page URL. Use for Python library evaluation, dependency analysis, or checking package quality metrics.

  ConnectorNo auth

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• get_productA

  Tolstoy ShopperA

  Load full details for one product by its `productRef` (from search_products or browse_products): description, price, media, the brand's real product videos, size guide, per-variant stock, and buy links. Returns each variant's id and options (size/color). Use it to resolve the exact `variantId` the shopper wants before calling build_cart, and to answer fit/sizing questions from the size guide. The response includes the product image so it can be seen directly.

  ConnectorNo auth

• update_taskdependenciesA

  ProWoDoA

  Full update (PUT) of a task dependency: predecessor, successor, dependency_type and lag_days must all be supplied. Re-runs the same propagation and validation as create (self-link, cross-project, ancestor/descendant and cycle checks). Prefer the partial-update tool for small edits. Each dependency carries app_url, a deep link to the drawer of the successor (the blocked task), where the dependency is managed.

  ConnectorOAuth

• get_component_updatesA

  TsehaA

  Returns per-component breaking changes and a migration guide between an installed version of the project's active component package and the latest published version. Read-only: it reports an upgrade, it never performs one. Use it when planning or reviewing a component-library upgrade, or before bumping the package version in a manifest. current_version is the exact semver currently installed, e.g. "1.0.0" - not a range, so no leading "v", "^", or "~"; read it from list_packages when unsure. Passing the latest version returns an empty change set. It is not a per-component changelog and not a current spec - use get_component for one component today, and list_packages for what is installed. Requires update tracking, a Team plan feature; on lower plans it returns an upgrade-required error instead of data.

  ConnectorNo auth

• audit_dependency_treeA

  Commit — Supply Chain Risk ScoringA

  Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: single npm publisher + >10M weekly downloads — sole point of failure for a massive attack surface - HIGH: sole publisher + >1M/wk, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) depth=1 (default): root package + all direct dependencies depth=2: also traverses one more level for any CRITICAL/HIGH direct deps (reveals hidden exposure) Examples: - audit_dependency_tree("express") — see all of Express's deps and their risk scores - audit_dependency_tree("langchain", 2) — reveal transitive CRITICAL deps 2 levels deep - audit_dependency_tree("@anthropic-ai/sdk") — audit Anthropic SDK full tree Use this when someone asks: - "What am I really depending on?" - "Are my dependencies' dependencies safe?" - "Show me the full supply chain risk for package X"

  ConnectorNo auth

• check-packageA

  Jeevesus — DugganUSA Threat Intelligence MCPA

  Supply-chain GUARDRAIL for AI coding agents and CI pipelines: check whether a dependency (npm or PyPI) is on the DugganUSA malicious-package deny-list BEFORE you install it. This is the runtime defense against slopsquatting / HalluSquatting / hijacked-package attacks — an AI agent about to run `npm install` or `pip install`, or a CI pre-install hook, calls this FIRST and blocks on a hit. Returns a crisp, machine-actionable verdict: {ecosystem, package, version, malicious, verdict:"block"|"allow"|"review", reason, advice, source}. `malicious:true` = the exact package is on our OSV-curated deny-list (215k+ named-not-heuristic entries across npm + PyPI). `malicious:false` = not on our known-bad list — absence is NOT proof of safety, so still pin and review new deps. If a `version` is supplied and the entry is version-scoped, the check is version-aware; all-versions-malicious packages block on any version. Designed to be the easiest AI-supply-chain guardrail to wire in: one MCP tool call, no auth, in the agent's pre-install step. Same data is available for CI at /api/v1/stix-feed/packages.json. Examples: {"ecosystem":"npm","name":"cxp-jquery"} → malicious:true, verdict:block. {"ecosystem":"pypi","name":"requests"} → malicious:false, verdict:allow.

  ConnectorNo auth

• render_diagramA

  Diagrams MCPA

  Render a mingrammer/diagrams Python snippet to PNG and return the image. The code must be a complete Python script using `from diagrams import ...` imports and a `with Diagram(...)` context manager block. Use search_nodes to verify node names and get correct import paths before writing code. Read the diagrams://reference/diagram, diagrams://reference/edge, and diagrams://reference/cluster resources for constructor options and usage examples. Args: code: Full Python code using the diagrams library. filename: Output filename without extension. format: Output format — ``"png"`` (default), ``"svg"``, or ``"pdf"``. download_link: If True, return a temporary download URL path (/images/{token}) that expires after 15 minutes; if False, return inline image bytes. Defaults to True (URL) — set ``DIAGRAMS_INLINE_DEFAULT=true`` on the server to flip the default. SVG/PDF and PNGs larger than the inline limit always use a download link.

  ConnectorNo auth

• security_fetch_dependency_graphA

  DataNexus MCPA

  Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_dependency_graph", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• security_fetch_package_licenceA

  DataNexus MCPA

  Fetch the SPDX licence identifier for an open source package version. Read-only. No side effects. Idempotent. package: Package name e.g. flask. Required. version: Exact version string e.g. 2.3.0. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns the SPDX licence identifier e.g. MIT, Apache-2.0, GPL-3.0. Use this to verify licence compatibility before including a dependency. Use security_fetch_package_vulnerabilities instead when checking for security issues not licences. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_licence", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth

• get_access_patternA

  dynamical.org Weather & Climate CatalogA

  Get the storage URI and working code for opening a dynamical.org dataset's data. dynamical.org publishes a Python package, `dynamical-catalog`, that reads the STAC catalog itself to resolve and open a dataset -- it's the recommended access pattern because it can't go stale even if the underlying storage format or location changes. This tool also returns the dataset's low-level storage details (from the STAC asset, fetched live) and a lower-level xarray/fsspec snippet for callers who need direct access instead of the wrapper package. Args: collection_id: A STAC collection id, e.g. "noaa-gfs-forecast". Use search_catalog to discover ids. Returns: A dict with the recommended `dynamical_catalog.open(...)` snippet, a `worked_example` pulled from the collection's own STAC metadata when one is published, the raw asset URI/type/storage options, and a generated low-level open snippet (icechunk/zarr/geoparquet, chosen from the asset's declared type). Raises ValueError (listing valid ids) if collection_id is unknown.

  ConnectorNo auth

• depwatch_previewA

  Signal OracleA

  Free preview of breaking changes / new releases for a software dependency. Pass an npm/PyPI `package` (resolved and fetched live if not already tracked) or a GitHub `repo` (owner/repo). Returns up to 5 recent changes plus the package's current version. Full history, significance filtering, and the LLM brief are paid via x402.

  ConnectorNo auth

• evaluate_dependency_changeA

  RepoPilotA

  CALL immediately before adding or upgrading an npm dependency. Answers "is this exact version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. Example: {"dependency":"lodash","to_version":"4.17.21"} — every field is top-level, never nested under a "change" key. Only `dependency` is required — omit to_version to evaluate the latest published version, exactly as `npm install <pkg>` would. to_version also accepts a dist-tag ("latest") or a SemVer range ("^4.17.0"); it resolves to one exact version, reported back in change.to_version. Everything RepoPilot can infer is inferred, and every default, repair, and resolution is listed in input_adjustments. Evaluates only; never installs or edits anything.

  ConnectorNo auth

• request_accounting_integrationA

  ExpenseBotA

  Request support for an accounting package only after checking ExpenseBot's reviewed direct and import-file destinations and finding no matching package. Do not use this for a listed or Beta destination, a general compatibility question, or without the exact package name. This is a confirmation-gated write: after the user approves, it creates one deduplicated request bound to the authenticated ExpenseBot account and emails ExpenseBot's internal team. It does not create an integration or make the requested package immediately available. On accepted or previously recorded requests, tell the user ExpenseBot will email them within one week with an update.

  ConnectorNo auth

• enrich_npm_auditA

  NPMScanA

  Given the raw output of `npm audit --json` (npm 7+'s `{vulnerabilities: {...}}` format, or legacy npm 6's `{advisories: {...}}`), parses it directly — no need to re-paste package.json/lockfile content — and runs it through the same patch-now/patch-soon/scheduled/monitor ranking prioritize_remediation exposes for hand-built finding lists. npm audit's JSON almost never includes a CVE id (only a GHSA advisory URL), so this resolves each GHSA to its CVE alias via OSV.dev when one exists (ghsaResolvedToCveCount reports how many) before doing the same CISA KEV + FIRST.org EPSS + severity scoring — skipping this step would silently degrade most findings to severity-only ranking despite prioritize_remediation being built around CVE-keyed KEV/EPSS data. Also carries through npm-audit-specific context prioritize_remediation itself has no field for: isDirect (direct vs. transitive dependency) and fixAvailable/fixTarget (npm's own computed fix — note fixTarget can name a different package than the vulnerable one, e.g. bumping a parent to pull in a patched transitive dependency). A package with more than one distinct advisory in the source report only has its first advisory used for ranking; a warning names the package so query_vulnerabilities can be called on it directly for the rest. `yarn audit --json` and `pnpm audit --json` use different report shapes and are not supported — use batch_query_vulnerabilities with the project's manifest/lockfile for those instead.

  ConnectorNo auth

• axint.upgradeA

  AxintA

  Check the latest Axint package and optionally apply the upgrade while preserving the current agent thread. Use: call when axint.status shows a stale server; not for app dependency upgrades. Inputs: apply defaults false; targetVersion selects the install, while reinstallXcode and writeReport matter only when applying. Effects: destructive when apply=true: can run package installs, refresh Xcode wiring, and write .axint/upgrade; may use npm.

  Connector

  Destructive

  No auth

• search_docsA

  Devdocs IoB

  Find which documentation SETS exist whose NAME matches a substring (e.g. "python" → Python 3.x, "react" → React). Returns doc SETS, NOT their content — this does NOT look up a function/method/API name. To search inside a doc for an entry like "Array.map" or "fetch", use search_index (slug + query).

  ConnectorNo auth

• versionA

  Deps DevA

  Security advisories, license and dependency metadata for ONE specific published release of a package. Requires an exact version that this package actually shipped — if you do not already have one, call `package` first to list them; a version guessed or carried over from a different package will not resolve.

  ConnectorNo auth

• get_eeoc_processA

  Workers' RightsA

  Plain-English guide to the 9 stages of an EEOC discrimination/retaliation charge, from pre-filing through resolution. Call with no arguments for an overview of all stages with typical durations; call with a stage number (1-9) for a deep-dive on that stage: what to expect, how long it takes, the key tip, and do/don't guidance. Use this whenever someone asks what happens after filing with the EEOC, how long the process takes, what a position statement or rebuttal is, or what to do at the stage they are currently in. Covers private-sector and state/local government workers; federal employees follow a separate EEO process with a much shorter deadline (45 days to contact their agency's EEO counselor).

  ConnectorNo auth

• security_audit_licence_compatibilityA

  DataNexus MCPA

  Audit the licence compatibility of your entire dependency list. Input package names (with ecosystem) or SPDX IDs; get a COMPATIBLE/CONFLICT verdict with specific conflicting pairs and recommended action. Uses static SPDX compatibility table — no network call for spdx_ids path. Package path resolves licences from deps.dev (max 10 concurrent). Max 50 items. Rate limit: 60/minute. No auth required. For developers and compliance teams auditing open source licence risk before shipping. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_audit_licence_compatibility", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

  ConnectorNo auth