Safe Upgrade

io.github.white-hat-labPublished by GitHub account white-hat-labv0.2.0Updated Oct 24, 2026

Evidence-backed npm upgrade preflight and dependency audits for coding agents, paid via x402.

VerifiedSTDIODesktop onlyFinance Developer Tools

Server details

Identifier: io.github.white-hat-lab/safe-upgrade
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account white-hat-lab for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.white-hat-lab%2Fsafe-upgrade.svg)](https://sourceweft.com/mcp/io.github.white-hat-lab%2Fsafe-upgrade?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A local MCP server that runs evidence-backed npm upgrade preflights and dependency audits for coding agents, paid per call via x402.

What you can do: Run npm upgrade preflight checks before changing dependency versions, with supporting evidence gathered for the decision. Perform dependency audits on a project's npm packages. Report findings back to the coding agent so it can judge whether an upgrade is safe. Charge each call through x402 using a configured wallet.
When to use it: Useful when a coding agent is about to bump npm dependency versions and you want a preflight check or audit before committing the change, rather than upgrading blind.
Requirements: Runs as a local stdio process installed from the npm package safe-upgrade-mcp, so Node.js and npm are needed. Requires the PAYER_PRIVATE_KEY environment variable: the private key of a wallet holding USDC on Base, used to sign x402 payments per call. Network access is needed for npm data and payment signing.

Before you install

The server needs PAYER_PRIVATE_KEY, a wallet private key, and each call spends USDC on Base through x402 payments, so costs accrue per use. The provider advises a dedicated low-balance wallet. Treat the key as highly sensitive and keep it out of shared configs and logs.

Installation

In SourceWeft

Open Safe Upgrade in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.2.0LatestSep 16, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
License10 pts
Declare a license in the repository or the registry entry.