Package Intel MCP

com.datakoot由 datakoot.com 发布官方发布者v2.1.0更新于 Oct 24, 2026

Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.

发布方自己的服务:Base Intel MCP

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

一个远程 MCP 服务器,为助手提供 npm、PyPI 和 crates.io 的包情报,便于在安装或推荐依赖前先做评估。

可以做什么
查询包元数据:最新版本、描述、许可证、主页、代码仓库、维护者与弃用状态,并可按关键词搜索 npm 和 cargo 包、查看带发布日期的近期版本历史与下载量。检查依赖与健康度:获取指定版本的直接依赖,以及综合可信度检查,涵盖最近发布、弃用、许可证、维护者数量、依赖数量和已知安全公告。所有工具都接受 npm、pypi 或 crates 生态参数。
适用场景
适合在助手准备添加、升级或推荐第三方依赖前,先核查维护活跃度、流行度、许可证、弃用情况和已知安全公告;也适合按关键词比较候选包。
运行要求
通过 streamable HTTP 访问的远程 MCP 端点;未声明需要 API 密钥、注册或环境变量。需要能访问该端点的网络,服务器本身依赖 npm、PyPI、crates.io 和 deps.dev 的公开数据。
安装前请注意
仅做只读查询,不涉及写入、付款或凭据。包数据仅供参考,来自公开注册表和 deps.dev,健康度与安全公告信号可能滞后于注册表,不能替代完整的安全审计。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Package Intel MCP,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.datakoot%2Fnpm-pypi-crates-packages/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "package-intel": {
      "type": "http",
      "url": "https://package.datakoot.com/mcp"
    }
  }
}

README

Package Intel MCP — by Datakoot

Software supply-chain intelligence for AI agents — as MCP tools your agent can call mid-task, so it can vet a dependency before it installs it. Covers npm, PyPI and crates.io. No API keys.

Tools

ToolWhat it doesSource
package_infoMetadata for a package: description, latest version, license, homepage & repo linksnpm / PyPI / crates.io
package_versionsFull version history with release datesnpm / PyPI / crates.io
package_downloadsDownload counts and popularity signalnpm / PyPI / crates.io
package_dependenciesDirect dependencies for a given versiondeps.dev
package_healthHealth signals: OpenSSF Scorecard, stars, dependentsdeps.dev
package_searchSearch for packages by keywordnpm / PyPI / crates.io

Every tool accepts an ecosystem of npm, pypi, or crates. No API keys required.

Quick start

claude mcp add --transport http package-intel https://package.datakoot.com/mcp

Or point any MCP client at https://package.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

bash
curl -s https://package.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

You get a supply-chain health snapshot for the npm package express — versions, downloads, dependencies, maintenance signals — no API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

  • "How healthy is the npm package express?"
  • "Before I add left-pad, is it actively maintained and widely used?"

Data & attribution

Data comes from the public registry APIs for npm, PyPI and crates.io, plus deps.dev (Google Open Source Insights, CC-BY 4.0) for dependency graphs and OpenSSF Scorecard health signals. Package data is served from official public APIs and is informational.

Part of Datakoot — keyless intelligence APIs for AI agents.

来源:README.md,提交 02a68c5

工具

6

package_info

Package Info

Get core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated. Use before an agent installs or recommends a dependency. Ecosystems: npm, pypi, cargo.

输入参数name必填ecosystem必填

package_versions

Package Versions

List recent released versions of a package with release dates (most recent first). Helps an agent pick a version or check how actively it is maintained. Ecosystems: npm, pypi, cargo.

输入参数name必填limitecosystem必填

package_downloads

Package Downloads

Get popularity/download statistics for a package (recent download counts). Useful for judging how widely used and battle-tested a dependency is. Ecosystems: npm, pypi, cargo.

输入参数name必填ecosystem必填

package_dependencies

Package Dependencies

List the direct dependencies of a specific package version (defaults to latest), via deps.dev. Lets an agent understand what a package pulls in before adding it. Ecosystems: npm, pypi, cargo.

输入参数name必填versionecosystem必填

package_health

Package Health

A composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known security advisories (via deps.dev). Returns a summary an agent can act on. Ecosystems: npm, pypi, cargo.

输入参数name必填ecosystem必填

版本历史

1
  1. v2.1.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Datakoot 集成