Package Intel MCP

com.datakootPublished by datakoot.comOfficial publisherv2.1.0Updated Oct 24, 2026

Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.

The publisher's own server: Base Intel MCP

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: com.datakoot/npm-pypi-crates-packages
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to datakoot.com, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/com.datakoot%2Fnpm-pypi-crates-packages.svg)](https://sourceweft.com/mcp/com.datakoot%2Fnpm-pypi-crates-packages?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A remote MCP server that gives an assistant package intelligence for npm, PyPI and crates.io, so it can vet a dependency before installing or recommending it.

What you can do: Look up package metadata: latest version, description, license, homepage, repository, maintainers and deprecation status, plus keyword search for npm and cargo packages and recent version history with release dates and download counts. Inspect dependencies and health: direct dependencies for a given version, and a composite trust check covering release recency, deprecation, license, maintainer count, dependency count and known security advisories. All tools take an ecosystem of npm, pypi or crates.
When to use it: Useful when an assistant is about to add, upgrade or recommend a third-party dependency and needs to check maintenance activity, popularity, licensing, deprecation or known advisories first, or when comparing candidate packages by keyword.
Requirements: A remote MCP endpoint reached over streamable HTTP; no API keys, signup or environment variables are declared. Network access to the endpoint is required, and the server in turn draws on public npm, PyPI, crates.io and deps.dev data.

Before you install

Read-only lookups; no writes, payments or credentials are involved. Package data is informational and comes from public registries and deps.dev, so health and advisory signals may lag behind the registries and should not replace a full security audit.

Installation

In SourceWeft

Open Package Intel MCP in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.datakoot%2Fnpm-pypi-crates-packages/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "package-intel": {
      "type": "http",
      "url": "https://package.datakoot.com/mcp"
    }
  }
}

README

Package Intel MCP — by Datakoot

Software supply-chain intelligence for AI agents — as MCP tools your agent can call mid-task, so it can vet a dependency before it installs it. Covers npm, PyPI and crates.io. No API keys.

Tools

Tool	What it does	Source
`package_info`	Metadata for a package: description, latest version, license, homepage & repo links	npm / PyPI / crates.io
`package_versions`	Full version history with release dates	npm / PyPI / crates.io
`package_downloads`	Download counts and popularity signal	npm / PyPI / crates.io
`package_dependencies`	Direct dependencies for a given version	deps.dev
`package_health`	Health signals: OpenSSF Scorecard, stars, dependents	deps.dev
`package_search`	Search for packages by keyword	npm / PyPI / crates.io

Every tool accepts an ecosystem of npm, pypi, or crates. No API keys required.

Quick start

Or point any MCP client at https://package.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

bash

curl -s https://package.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

curl -s https://package.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

You get a supply-chain health snapshot for the npm package express — versions, downloads, dependencies, maintenance signals — no API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

"How healthy is the npm package express?"
"Before I add left-pad, is it actively maintained and widely used?"

Data & attribution

Data comes from the public registry APIs for npm, PyPI and crates.io, plus deps.dev (Google Open Source Insights, CC-BY 4.0) for dependency graphs and OpenSSF Scorecard health signals. Package data is served from official public APIs and is informational.

Part of Datakoot — keyless intelligence APIs for AI agents.

Source: README.md at commit 02a68c5

Tools

package_info

Package Info

Get core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated. Use before an agent installs or recommends a dependency. Ecosystems: npm, pypi, cargo.

Parametersnamerequiredecosystemrequired

package_versions

Package Versions

List recent released versions of a package with release dates (most recent first). Helps an agent pick a version or check how actively it is maintained. Ecosystems: npm, pypi, cargo.

Parametersnamerequiredlimitecosystemrequired

package_downloads

Package Downloads

Get popularity/download statistics for a package (recent download counts). Useful for judging how widely used and battle-tested a dependency is. Ecosystems: npm, pypi, cargo.

Parametersnamerequiredecosystemrequired

package_dependencies

Package Dependencies

List the direct dependencies of a specific package version (defaults to latest), via deps.dev. Lets an agent understand what a package pulls in before adding it. Ecosystems: npm, pypi, cargo.

Parametersnamerequiredversionecosystemrequired

package_health

Package Health

A composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known security advisories (via deps.dev). Returns a summary an agent can act on. Ecosystems: npm, pypi, cargo.

Parametersnamerequiredecosystemrequired

package_search

Package Search

Search for packages by keyword and get the top matches with descriptions. Supported ecosystems: npm and cargo (PyPI has no public search API).

Parameterslimitqueryrequiredecosystemrequired

Version history

v2.1.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Finance5 toolsOct 24, 2026