Skip to content

Package Intel MCP

by datakoot.com · remote · no sign-in to list tools · v2.1.0 · published by com.datakoot

Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.

Changes · 1
CompareRegistry entry

6 tools: 1 change things and 5 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http npm-pypi-crates-packages https://package.datakoot.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 1Claude Code: ask
  • package_healthA composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known security advisories (via deps.dev). Returns a summary an agent can act on. Ecosystems: npm, pypi, cargo.

    Annotations the server declares

    • title: Package Health
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 5Claude Code: allow
  • package_dependenciesList the direct dependencies of a specific package version (defaults to latest), via deps.dev.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the direct dependencies of a specific package version (defaults to latest), via deps.dev. Lets an agent understand what a package pulls in before adding it. Ecosystems: npm, pypi, cargo.

    Annotations the server declares

    • title: Package Dependencies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • package_downloadsGet popularity/download statistics for a package (recent download counts).No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get popularity/download statistics for a package (recent download counts). Useful for judging how widely used and battle-tested a dependency is. Ecosystems: npm, pypi, cargo.

    Annotations the server declares

    • title: Package Downloads
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • package_infoGet core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated. Use before an agent installs or recommends a dependency. Ecosystems: npm, pypi, cargo.

    Annotations the server declares

    • title: Package Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • package_versionsList recent released versions of a package with release dates (most recent first).No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List recent released versions of a package with release dates (most recent first). Helps an agent pick a version or check how actively it is maintained. Ecosystems: npm, pypi, cargo.

    Annotations the server declares

    • title: Package Versions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http npm-pypi-crates-packages https://package.datakoot.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__npm-pypi-crates-packages__package_info",
      "mcp__npm-pypi-crates-packages__package_versions",
      "mcp__npm-pypi-crates-packages__package_downloads",
      "mcp__npm-pypi-crates-packages__package_dependencies",
      "mcp__npm-pypi-crates-packages__package_search"
    ],
    "ask": [
      "mcp__npm-pypi-crates-packages__package_health"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as npm-pypi-crates-packages. Review it before you use it.