mcp-package-health

An MCP (Model Context Protocol) server that gives AI agents real-time package health data, vulnerability reports, and dependency graphs — directly inside Claude, Cursor, and any MCP-compatible client.

---

Why this exists

Every developer has asked Claude something like "is this package still maintained?" or "does this version have any CVEs?" — and Claude has to say "I don't have real-time data."

mcp-package-health fixes that. It exposes three tools that any MCP-compatible AI agent can call live:

Tool	What it does
get_package_health	Latest version, release date, license, summary from PyPI
check_vulnerabilities	CVE/vulnerability scan via OSV.dev
get_dependency_graph	Direct + transitive dependency list

---

Install

pip install mcp-package-health

Or from source:

git clone https://github.com/fse08877-netizen/mcp-package-health.git
cd mcp-package-health
pip install -e ".[dev]"

---

Usage with Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "package-health": {
      "command": "mcp-package-health"
    }
  }
}

Then ask Claude:

• "Is numpy safe to use at version 1.24.0?"
• "What are the dependencies of fastapi?"
• "When was the last release of httpx?"

---

Tool Reference

get_package_health(package_name, ecosystem="pypi")

{
  "name": "requests",
  "version": "2.32.3",
  "summary": "Python HTTP for Humans.",
  "last_release": "2024-05-29T17:05:40",
  "license": "Apache-2.0",
  "project_url": "https://requests.readthedocs.io"
}

check_vulnerabilities(package_name, version)

{
  "package": "Pillow",
  "version": "9.0.0",
  "vulnerability_count": 3,
  "vulnerabilities": [
    {
      "id": "GHSA-56pw-mpj4-fxww",
      "summary": "Pillow uninitialized memory",
      "severity": "HIGH"
    }
  ]
}

get_dependency_graph(package_name)

{
  "package": "fastapi",
  "direct_dependencies": ["starlette", "pydantic", "typing-extensions"],
  "count": 3
}

---

Development

pytest tests/ -v

---

License

MIT © fse08877-netizen