UpgradeLens

io.github.mattpiconePublished by GitHub account mattpiconev0.4.8Updated Nov 8, 2026

npm/PyPI package dependency upgrade reviews: security, runtime compatibility, cited migration.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that reviews npm and PyPI dependency upgrades, returning cited security, compatibility and migration guidance for exact versions.

What you can do
  • Review a dependency upgrade with a cited result covering security delta, runtime compatibility, breaking changes, go/no-go risk and ordered migration actions
  • Get a go/no-go risk decision for moving an existing npm or PyPI dependency between two exact versions, with vulnerability, compatibility, EOL and breaking-change evidence
  • Rank candidate target versions when only the current version is known
  • Produce a migration checklist with refactor actions, ordered review steps, changelog links and test steps
When to use it
Useful when a coding agent reviews Dependabot, Renovate, npm or PyPI version bumps before merge, or needs evidence-backed guidance on whether and how to move an existing dependency to a specific version.
Requirements
Remote streamable HTTP endpoint; no authentication, environment variables or headers declared. The assistant must supply exact current and target versions for the review and check tools.
Before you install
Results are advisory: candidate targets from the ranking tool are not declared safe and must be checked separately. The tools do not install packages, edit files or authorize changes, so any actual upgrade still needs its own review. Dependency names and versions are sent to a third-party hosted service.

Installation

In SourceWeft

  1. Open UpgradeLens in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.mattpicone%2Fupgradelens/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "upgradelens": {
      "type": "http",
      "url": "https://upgradelens.mattpicone.workers.dev/mcp"
    }
  }
}

README

This repository has no README.

Tools

4

review_dependency_upgrade

Review a dependency update before merging

Use when an agent reviews a Dependabot, Renovate, npm, or PyPI version change before merge. One cited result combines security delta, runtime compatibility, breaking changes, go/no-go risk, and ordered migration actions for exact current and target versions. Do not use for new installs, unknown versions, general documentation, or other ecosystems. Read-only and safe to retry.

Parametersdetailpackagerequiredruntimeecosystemrequiredtarget_versionrequiredcurrent_versionrequired

check_dependency_upgrade

Assess a known dependency upgrade target (go/no-go)

Use when a coding agent needs a cited go/no-go risk decision without steps before changing an existing npm or PyPI dependency between two exact versions. Returns action_allowed, vulnerability delta, compatibility, EOL, and breaking-change evidence. Use plan_dependency_upgrade instead for ordered migration work. Do not use to choose a target, install a new package, search general docs, or analyze another ecosystem. Read-only and safe to retry.

Parameterspackagerequiredruntimeecosystemrequiredtarget_versionrequiredcurrent_versionrequired

find_safe_upgrade_target

Rank upgrade candidates (not a safety verdict; full check required)

Use only when an existing npm or PyPI dependency has an exact current version but no chosen target. Ranks candidates; candidates are not declared safe and require check_dependency_upgrade or plan_dependency_upgrade. Do not use when a target is stated, for a new install, or as authorization to edit files. Read-only and safe to retry.

Parameterspackagerequiredecosystemrequiredmax_major_jumpcurrent_versionrequiredallow_prerelease

plan_dependency_upgrade

Plan a known dependency upgrade (migration/review checklist)

Use when a coding agent needs a migration checklist, refactor actions, ordered review actions, changelog links, or test steps for exact current and target npm/PyPI versions. Use check_dependency_upgrade instead for a go/no-go without steps. Do not use to choose a target, install a package, or provide a general tutorial. Read-only and safe to retry.

Parameterspackagerequiredruntimeecosystemrequiredtarget_versionrequiredcurrent_versionrequired

Version history

4
  1. v0.4.8LatestOct 14, 2026
  2. v0.4.7Oct 12, 2026
  3. v0.4.5Oct 1, 2026
  4. v0.4.4Sep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.