packagecloud MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.3.3 · published by io.usefulapi

Read packagecloud repos, packages, versions and download stats; create repos, promote and delete.

Deletes · 2Changes · 3

Compare Registry entry

18 tools: 2 can delete or cancel things, 3 change things and 13 only read.

Scanned Oct 21, 2026

Deletes or cancels2Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things3Claude Code: ask: see these tools
Only reads13Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http packagecloud https://packagecloud.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnpackagecloud_list_repositories
The description contains "every other tool", wording about other tools or servers.
Matched text
description: "...count: name, fqname (user/repo, used by every other tool), privacy, package count and last push...."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

packagecloud_delete_packageWRITE, DESTRUCTIVE AND IRREVERSIBLE: delete one package file from its repository (a gem is yanked).No findings
Why it is in this group
- The name "packagecloud_delete_package" says "delete": a word for removing or ending something.
- The description says "IRREVERSIBLE".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE, DESTRUCTIVE AND IRREVERSIBLE: delete one package file from its repository (a gem is yanked). Clients that depend on it will break. Pass the destroy_url of the package object and repeat its file name (the last path segment, for example jake-1.0-2.el6.x86_64.rpm) as confirm_filename. DELETE {destroy_url}.
Annotations the server declares
- title: Delete (yank) package
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
packagecloud_promote_packageWRITE, DESTRUCTIVE: MOVE a package file to another repository (for example staging -> production).No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE, DESTRUCTIVE: MOVE a package file to another repository (for example staging -> production). It no longer exists in the source repository afterwards, and its download statistics are cleared. Pass the promote_url of the package object and the destination as user/repo. POST {promote_url}.
Annotations the server declares
- title: Promote (move) package
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Changes things 3Creates or changes something that can be changed back.Claude Code: ask

packagecloud_append_readmeWRITE: append Markdown to the existing README of a repository (existing text is kept).No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
Description, as the server wrote it
WRITE: append Markdown to the existing README of a repository (existing text is kept). Not idempotent: calling it twice appends twice. PATCH /repos/{user}/{repo}/readme.json.
Annotations the server declares
- title: Append to repository README
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
packagecloud_create_readmeWRITE: create the Markdown README of a repository.No findings
Why it is in this group
- The name "packagecloud_create_readme" says "create": a word for a change.
Description, as the server wrote it
WRITE: create the Markdown README of a repository. Use append_readme to add to an existing one. POST /repos/{user}/{repo}/readme.json.
Annotations the server declares
- title: Create repository README
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
packagecloud_create_repositoryWRITE: create a new, empty package repository in this account (the plan limits how many private ones).No findings
Why it is in this group
- The name "packagecloud_create_repository" says "create": a word for a change.
Description, as the server wrote it
WRITE: create a new, empty package repository in this account (the plan limits how many private ones). Returns the URL of the new repository. POST /repos.
Annotations the server declares
- title: Create repository
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 13Looks things up and changes nothing.Claude Code: allow

packagecloud_get_gpg_keyOne GPG key of a repository by its key name (as returned by list_gpg_keys, for example user-repo-85D7FBF915DFCBC6.pub.gpg).No findings
Why it is in this group
- The name "packagecloud_get_gpg_key" says "get": a word for reading.
Description, as the server wrote it
One GPG key of a repository by its key name (as returned by list_gpg_keys, for example user-repo-85D7FBF915DFCBC6.pub.gpg). GET /repos/{user}/{repo}/gpg_keys/{keyname}.json.
Annotations the server declares
- title: Get GPG key
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_get_packageDetails of one package file (size, checksums, dependencies, licenses, download counts and its other URLs).No findings
Why it is in this group
- The name "packagecloud_get_package" says "get": a word for reading.
Description, as the server wrote it
Details of one package file (size, checksums, dependencies, licenses, download counts and its other URLs). Pass the package_url of an item from list_packages, search_packages or list_package_versions. GET {package_url}.
Annotations the server declares
- title: Get package
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_get_package_downloadsDownload statistics of one package version: a count, a time series, or (repository owners only) the detail of each download.No findings
Why it is in this group
- The name "packagecloud_get_package_downloads" says "get": a word for reading.
Description, as the server wrote it
Download statistics of one package version: a count, a time series, or (repository owners only) the detail of each download. Default range is the last 7 days; pass start_date=19700101Z for all time. Pass the package_url of the package; Java and generic files have no download stats. GET {package_url minus .json}/stats/downloads/{count|detail|series/<interval>}.json.
Annotations the server declares
- title: Get package download stats
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_get_readmeThe Markdown README of a repository.No findings
Why it is in this group
- The name "packagecloud_get_readme" says "get": a word for reading.
Description, as the server wrote it
The Markdown README of a repository. GET /repos/{user}/{repo}/readme.json.
Annotations the server declares
- title: Get repository README
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_get_repositoryOne repository: name, fqname, url, privacy, package count and last push.No findings
Why it is in this group
- The name "packagecloud_get_repository" says "get": a word for reading.
Description, as the server wrote it
One repository: name, fqname, url, privacy, package count and last push. GET /repos/{user}/{repo}.
Annotations the server declares
- title: Get repository
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_get_repository_installsHow often a repository was installed (set up on a machine): a count, a time series, or (owners only) the detail of each install, optionally for one distro or distro+version.No findings
Why it is in this group
- The name "packagecloud_get_repository_installs" says "get": a word for reading.
Description, as the server wrote it
How often a repository was installed (set up on a machine): a count, a time series, or (owners only) the detail of each install, optionally for one distro or distro+version. Default range is the last 7 days; pass start_date=19700101Z for all time. GET /repos/{user}/{repo}/stats/installs[/{distro}[/{version}]]/{count|detail|series/<interval>}.json.
Annotations the server declares
- title: Get repository install stats
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_distributionsThe Linux distributions and versions packagecloud supports for deb, dsc and rpm packages, with their index_name (for example ubuntu / jammy) and numeric version ids.No findings
Why it is in this group
- The name "packagecloud_list_distributions" says "list": a word for reading.
Description, as the server wrote it
The Linux distributions and versions packagecloud supports for deb, dsc and rpm packages, with their index_name (for example ubuntu / jammy) and numeric version ids. GET /distributions.
Annotations the server declares
- title: List distributions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_gpg_keysThe GPG keys of a repository (repository signing keys and package signing keys): name, fingerprint, type and the public key download URL.No findings
Why it is in this group
- The name "packagecloud_list_gpg_keys" says "list": a word for reading.
Description, as the server wrote it
The GPG keys of a repository (repository signing keys and package signing keys): name, fingerprint, type and the public key download URL. GET /repos/{user}/{repo}/gpg_keys.json.
Annotations the server declares
- title: List GPG keys
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_package_groupsList the packages of one type, grouped by name with a versions_count and a versions_url (pass that to packagecloud_list_package_versions).No findings
Why it is in this group
- The name "packagecloud_list_package_groups" says "list": a word for reading.
Description, as the server wrote it
List the packages of one type, grouped by name with a versions_count and a versions_url (pass that to packagecloud_list_package_versions). Narrow by distro, then version, then arch (each needs the previous one; '*' matches any). Examples: type rpm; type deb + distro ubuntu + version jammy + arch amd64; type gem. GET /repos/{user}/{repo}/packages/{type}[/{distro}[/{version}[/{arch}]]].json.
Annotations the server declares
- title: List package names by type
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_package_versionsAll versions of one package name (for deb/rpm: per distro, version and architecture).No findings
Why it is in this group
- The name "packagecloud_list_package_versions" says "list": a word for reading.
Description, as the server wrote it
All versions of one package name (for deb/rpm: per distro, version and architecture). Pass the versions_url of an item from list_package_groups, or derive it from a package object. Paged. GET {versions_url}.
Annotations the server declares
- title: List package versions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_packagesList every package file in a repository (not grouped), newest data first as the server orders it.No findings
Why it is in this group
- The name "packagecloud_list_packages" says "list": a word for reading.
Description, as the server wrote it
List every package file in a repository (not grouped), newest data first as the server orders it. Each item carries ready-made URLs: package_url, versions_url, downloads_*_url, promote_url, destroy_url and download_url; pass those to the other package tools. Paged. GET /repos/{user}/{repo}/packages.json.
Annotations the server declares
- title: List packages
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_list_repositoriesList the package repositories of this account: name, fqname (user/repo, used by every other tool), privacy, package count and last push.1 finding
Why it is in this group
- The name "packagecloud_list_repositories" says "list": a word for reading.
Findings
- Warn
  The description contains "every other tool", wording about other tools or servers.
  Matched text
  description: "...count: name, fqname (user/repo, used by every other tool), privacy, package count and last push...."
  What this check looks for
Description, as the server wrote it
List the package repositories of this account: name, fqname (user/repo, used by every other tool), privacy, package count and last push. include_collaborations adds repositories you collaborate on. GET /repos.
Annotations the server declares
- title: List repositories
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
packagecloud_search_packagesSearch a repository by package file name.No findings
Why it is in this group
- The name "packagecloud_search_packages" says "search": a word for reading.
Description, as the server wrote it
Search a repository by package file name. An empty q returns every package. filter limits by type (rpms, debs, dscs, gem, python, node); dist (for example ubuntu or el/6) overrides filter; arch applies to Alpine/RPM/Debian only. Items carry the same ready-made URLs as list_packages. Paged. GET /repos/{user}/{repo}/search.json.
Annotations the server declares
- title: Search packages
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http packagecloud https://packagecloud.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__packagecloud__packagecloud_list_repositories",
      "mcp__packagecloud__packagecloud_get_repository",
      "mcp__packagecloud__packagecloud_list_distributions",
      "mcp__packagecloud__packagecloud_list_packages",
      "mcp__packagecloud__packagecloud_search_packages",
      "mcp__packagecloud__packagecloud_list_package_groups",
      "mcp__packagecloud__packagecloud_get_package",
      "mcp__packagecloud__packagecloud_list_package_versions",
      "mcp__packagecloud__packagecloud_get_package_downloads",
      "mcp__packagecloud__packagecloud_get_repository_installs",
      "mcp__packagecloud__packagecloud_list_gpg_keys",
      "mcp__packagecloud__packagecloud_get_gpg_key",
      "mcp__packagecloud__packagecloud_get_readme"
    ],
    "ask": [
      "mcp__packagecloud__packagecloud_create_repository",
      "mcp__packagecloud__packagecloud_create_readme",
      "mcp__packagecloud__packagecloud_append_readme"
    ],
    "deny": [
      "mcp__packagecloud__packagecloud_promote_package",
      "mcp__packagecloud__packagecloud_delete_package"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as packagecloud. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/packagecloud/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing