Package Intel MCP — by Datakoot

This MCP server provides package intelligence for AI agents across npm, PyPI, crates.io, and deps.dev, exposing functionality as MCP tools callable mid-task. It supports vetting dependencies before installation and does not require API keys. The server includes tools for package metadata, version history, and download/popularity signals.

🛠️ Key Features

Package intelligence spanning npm, PyPI, crates.io (and deps.dev as stated)
No API keys
Tools: package_info, package_versions, package_downloads

🚀 Use Cases

Check package metadata (description, latest version, license, homepage, repo links)
Review full version history with release dates
Use download counts as a popularity signal before installing

⚡ Developer Benefits

Integrates via Model Context Protocol (MCP) as callable tools (toolCount: 6)
Source-based coverage across npm, PyPI, crates.io for dependency evaluation
Package vetting can occur before installation

⚠️ Limitations

Tool details in the provided excerpt are limited to package_info, package_versions, and package_downloads
Coverage is described for npm/PyPI/crates.io; additional behavior beyond the excerpt is not specified

Package Intel MCP — by Datakoot

Software supply-chain intelligence for AI agents — as MCP tools your agent can call mid-task, so it can vet a dependency before it installs it. Covers npm, PyPI and crates.io. No API keys.

Tools

Tool	What it does	Source
`package_info`	Metadata for a package: description, latest version, license, homepage & repo links	npm / PyPI / crates.io
`package_versions`	Full version history with release dates	npm / PyPI / crates.io
`package_downloads`	Download counts and popularity signal	npm / PyPI / crates.io
`package_dependencies`	Direct dependencies for a given version	deps.dev
`package_health`	Health signals: OpenSSF Scorecard, stars, dependents	deps.dev
`package_search`	Search for packages by keyword	npm / PyPI / crates.io

Every tool accepts an ecosystem of npm, pypi, or crates. No API keys required.

Quick start

code

claude mcp add --transport http package-intel https://package.datakoot.com/mcp

Or point any MCP client at https://package.datakoot.com/mcp.

Paste this into a terminal:

bash

curl -s https://package.datakoot.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

You get a supply-chain health snapshot for the npm package express — versions, downloads, dependencies, maintenance signals — no API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

"How healthy is the npm package express?"
"Before I add left-pad, is it actively maintained and widely used?"

Data & attribution

Data comes from the public registry APIs for npm, PyPI and crates.io, plus deps.dev (Google Open Source Insights, CC-BY 4.0) for dependency graphs and OpenSSF Scorecard health signals. Package data is served from official public APIs and is informational.

Part of Datakoot — keyless intelligence APIs for AI agents.

ecosystem	string	required	Package registry to look in. One of: npm, pypi, cargo.
name	string	required	Exact package name as published in that registry, e.g. express for npm, requests for pypi, serde for cargo.
limit	integer	optional	Maximum number of results to return.

ecosystem	string	required	Package registry to look in. One of: npm, pypi, cargo.
name	string	required	Exact package name as published in that registry, e.g. express for npm, requests for pypi, serde for cargo.
version	string	optional	Optional; defaults to the latest/default version

ecosystem	string	required	Package registry to look in. One of: npm, pypi, cargo.
query	string	required	Free-text search terms, matched against package names and descriptions.
limit	integer	optional	Maximum number of results to return.

Package Intel MCP