whichlib

io.github.josifbPublished by GitHub account josifbv0.2.4Updated Oct 29, 2026

Dependency picker for coding agents: recommends, compares and scores GitHub repos with a verdict.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper ToolsData & Analytics

Overview

AI-generated overview

whichlib is a dependency picker MCP server that recommends, compares and scores GitHub open-source libraries using live GitHub, npm and PyPI data.

What you can do
  • Recommend libraries for a need described in plain words, ranked by fit with scores, downloads and a verdict
  • Compare 2-10 known repositories side by side with score, tier, stars, forks, issues, license, downloads and a verdict
  • Discover trending repositories by day, week, month or rising stars, optionally filtered by language
  • Return a transparent 0-100 score breakdown (momentum, maintenance, adoption, license) and the install name for each result
When to use it
Useful when a coding agent is about to add a dependency, when the user asks which library to use, or when it is unclear whether a package exists or is still maintained. Also handy for discovering new projects, though not for choosing a dependency.
Requirements
Runs as a hosted remote endpoint with no Node needed, or locally via npx whichlib with Node 22 or newer. No account or API key is required. Optional GITHUB_TOKEN (or X-GitHub-Token header for the hosted endpoint) raises GitHub search limits; optional WHICHLIB_TELEMETRY or DO_NOT_TRACK settings control anonymous call counting. Network access to GitHub, npm and PyPI is needed.
Before you install
The hosted endpoint allows 50 free calls per day without your own GitHub token; the local server makes GitHub searches per call and may hit rate limits without GITHUB_TOKEN. Anonymous call counting is on by default (tool name, random install id, version, platform, Node major, protocol version; never queries or results) and can be disabled with WHICHLIB_TELEMETRY=off or DO_NOT_TRACK=1. By default daily star counts are downloaded into a local folder unless WHICHLIB_HISTORY=off is set. Scores are…

Installation

In SourceWeft

  1. Open whichlib in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.josifb%2Fwhichlib/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "whichlib": {
      "type": "http",
      "url": "https://whichlib.com/mcp"
    }
  }
}

README

whichlib

The dependency picker for coding agents. Ask which library to use and get a scored, verified answer instead of a guess.

whichlib is an MCP server with three tools. It speaks MCP 2026-07-28; older clients keep working. Every repository it returns carries a transparent 0–100 score (momentum, maintenance, adoption including npm and PyPI downloads, license), a tier, a one-line verdict and the full breakdown, so the agent can justify the pick and you can read why.

For teams (waitlist): alerts when a dependency your repos use goes stale, and rules your team's coding agents must follow when they add one. Add a 👍 to the waitlist issue; at 20 signups it gets built. whichlib itself stays free.

Install

Claude Code:

claude mcp add whichlib -- npx -y whichlib

Cursor, Windsurf and other MCP clients:

json
{ "mcpServers": { "whichlib": { "command": "npx", "args": ["-y", "whichlib"] } } }

Requires Node 22 or newer. No account, no API key.

Use it without installing (hosted, no Node needed):

claude mcp add --transport http whichlib https://whichlib.com/mcp

Limits and the web API: https://whichlib.com/docs/

Tools

ToolAskYou get
recommend_reposneed in plain words, optional language, limit 1–10The best repositories for the need, ranked by fit (score × relevance), with downloads and a verdict each
compare_reposrepos: 2–10 names as owner/repoThe repositories side by side, best first, same breakdown
trending_reposperiod day / week / month / rising, optional language, limitMost-starred repositories created in the period, scored; rising: repositories of any age by stars gained this week

Example, in Claude Code: "which Python PDF parser should I use?" → MinerU, pdfplumber, pypdf with scores, weekly downloads and verdicts like "Rising fast, 26k downloads/wk, pushed 3 days ago, Apache-2.0".

Score

PartWeightSignal
Momentum40%Stars gained over 7 days (from daily star counts when available), else stars per day since creation, scaled by the npm/PyPI download trend when known (0.5–2x). Log scale.
Maintenance25%Days since last push, full marks to 30 days, zero at a year. Widely used repos (10k+ stars or 100k+ weekly downloads) never drop below half.
Adoption25%Stars, forks and npm / PyPI weekly downloads, log scale.
License10%Permissive 1.0, weak copyleft 0.75, strong copyleft 0.5, none 0.

Tiers: Strong ≥ 75, Solid ≥ 50, Watch ≥ 25, Avoid; repos younger than 30 days are New ("Too new to judge"), whatever their score. Archived repos are capped at 20. On a 20-need eval the top recommendation is an accepted answer 75% of the time and the top five contain one 100% of the time; the eval and its reports live in the repository.

Environment variables, all optional

  • GITHUB_TOKEN: raises GitHub's search limit from 10 to 30 per minute. A fine-grained token with no permissions is enough. Recommend makes three searches per call.
  • WHICHLIB_HISTORY=off: do not download daily star counts. By default the server keeps the last 10 days in ~/.whichlib/stars/, refreshed in the background at most every 12 hours from raw.githubusercontent.com, so momentum uses real stars gained per week for the top 1,000 repos per language and new trending repos. Nothing is sent with that download.
  • FRESH_REPOS_DATA_DIR: a folder of daily snapshots or star counts to use instead (see the repository's data branch).
  • WHICHLIB_TELEMETRY=off or DO_NOT_TRACK=1: disables anonymous call counting. What is counted: tool name, a random install id, version, platform, Node major version, the MCP protocol version of the call. Never queries, repository names or results. The aggregate numbers are public at https://whichlib-telemetry.todorovskijosif.workers.dev/stats.

Source, dashboard, data

Repository: https://github.com/josifb/whichlib (MIT). It also holds the Fresh Repos dashboard (most-starred new repositories, day / week / month, sortable, one HTML file), the nightly snapshot and enrichment jobs, the recommendation eval, and 80+ unit tests.

Development, from the whichlib/ folder of the repository:

npm test           # unit tests, no networknpm run mcp:smoke  # start the server over stdio and call every tool livenpm run eval       # 20-need recommendation eval (set GITHUB_TOKEN)npm run snapshot   # today's top repos per period and language -> data/snapshots/npm run enrich     # add npm / PyPI packages and weekly downloads to the latest snapshotnpm run score      # top repos from the latest snapshot with score and verdictnpm run pull-data  # copy snapshots from the data branch

Layout:

mcp/server.mjs         MCP entry (stdio)        mcp/tools.mjs       tool logicmcp/expand.mjs         query expansion          mcp/telemetry.mjs   anonymous call countingmcp/github-api.mjs     GitHub client + cache    mcp/data.mjs        snapshot history providermcp/eval/              needs, metrics, runner, inspect, results/lib/score.js           the score, shared by browser and Nodesnapshot/src/          query, normalize, github, registry, enrich, history, run, score-report, pull-datadashboard/index.html   redirect to whichlib.com/repos (Fresh Repos)

Source: whichlib/README.md at commit a4d1c68

Tools

3

recommend_repos

Recommend repositories

Find the best open-source library for a need before adding a dependency. Give the need in plain words and get up to `limit` GitHub repositories ranked by fit = score x relevance to the need. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this when you do not yet have candidates; use compare_repos when you already have names. Makes 3 GitHub searches plus npm/PyPI lookups for the shortlist. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

Parametersneedrequiredlimitlanguage

compare_repos

Compare repositories

Compare 2-10 known GitHub repositories side by side, best score first: score and tier, stars, forks, open issues, last push, license, npm/PyPI weekly downloads (only when the registry links back to the repository) and a verdict. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this to choose between candidates you already have (for example zod vs valibot) or to check a dependency the project already uses; use recommend_repos to find candidates. One GitHub API call per repository plus npm/PyPI lookups. A repository that does not exist is listed under notFound and the rest are still compared; the call fails only if none can be fetched, or when GitHub's rate limit is reached or the token is rejected. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

Parametersreposrequired

Version history

10
  1. v0.2.4LatestOct 29, 2026
  2. v0.2.3Oct 15, 2026
  3. v0.2.2Oct 15, 2026
  4. v0.2.1Oct 14, 2026
  5. v0.2.0Oct 7, 2026
  6. v0.1.5Oct 3, 2026
  7. v0.1.4Oct 2, 2026
  8. v0.1.2Sep 29, 2026
  9. v0.1.1Sep 28, 2026
  10. v0.1.0Sep 27, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts