Package Intel MCP

com.datakoot由 datakoot.com 發布官方發布者v2.1.0更新於 Oct 24, 2026

Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.

發布方自己的服務:Base Intel MCP

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

一個遠端 MCP 伺服器,為助理提供 npm、PyPI 與 crates.io 的套件情報,方便在安裝或推薦相依套件前先做評估。

可以做什麼
查詢套件中繼資料:最新版本、說明、授權、首頁、程式碼儲存庫、維護者與棄用狀態,並可依關鍵字搜尋 npm 與 cargo 套件、查看含發行日期的近期版本歷史與下載量。檢查相依與健康度:取得指定版本的直接相依套件,以及綜合可信度檢查,涵蓋最近發行、棄用、授權、維護者數量、相依套件數量與已知安全公告。所有工具都接受 npm、pypi 或 crates 生態系參數。
適用情境
適合在助理準備加入、升級或推薦第三方相依套件前,先確認維護活躍度、普及度、授權、棄用情況與已知安全公告;也適合依關鍵字比較候選套件。
執行需求
透過 streamable HTTP 存取的遠端 MCP 端點;未宣告需要 API 金鑰、註冊或環境變數。需要能連線至該端點的網路,伺服器本身依賴 npm、PyPI、crates.io 與 deps.dev 的公開資料。
安裝前請注意
僅提供唯讀查詢,不涉及寫入、付款或憑證。套件資料僅供參考,來自公開註冊表與 deps.dev,健康度與安全公告訊號可能落後於註冊表,不能取代完整的安全稽核。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Package Intel MCP,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.datakoot%2Fnpm-pypi-crates-packages/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "package-intel": {
      "type": "http",
      "url": "https://package.datakoot.com/mcp"
    }
  }
}

README

Package Intel MCP — by Datakoot

Software supply-chain intelligence for AI agents — as MCP tools your agent can call mid-task, so it can vet a dependency before it installs it. Covers npm, PyPI and crates.io. No API keys.

Tools

ToolWhat it doesSource
package_infoMetadata for a package: description, latest version, license, homepage & repo linksnpm / PyPI / crates.io
package_versionsFull version history with release datesnpm / PyPI / crates.io
package_downloadsDownload counts and popularity signalnpm / PyPI / crates.io
package_dependenciesDirect dependencies for a given versiondeps.dev
package_healthHealth signals: OpenSSF Scorecard, stars, dependentsdeps.dev
package_searchSearch for packages by keywordnpm / PyPI / crates.io

Every tool accepts an ecosystem of npm, pypi, or crates. No API keys required.

Quick start

claude mcp add --transport http package-intel https://package.datakoot.com/mcp

Or point any MCP client at https://package.datakoot.com/mcp.

Try it in 10 seconds — no key, no signup

Paste this into a terminal:

bash
curl -s https://package.datakoot.com/mcp \  -H 'content-type: application/json' \  -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "package_health", "arguments": {"ecosystem": "npm", "name": "express"}}}'

You get a supply-chain health snapshot for the npm package express — versions, downloads, dependencies, maintenance signals — no API key, nothing to sign up for.

Or point any MCP client at the URL and just ask your agent, in plain language:

  • "How healthy is the npm package express?"
  • "Before I add left-pad, is it actively maintained and widely used?"

Data & attribution

Data comes from the public registry APIs for npm, PyPI and crates.io, plus deps.dev (Google Open Source Insights, CC-BY 4.0) for dependency graphs and OpenSSF Scorecard health signals. Package data is served from official public APIs and is informational.

Part of Datakoot — keyless intelligence APIs for AI agents.

來源:README.md,提交 02a68c5

工具

6

package_info

Package Info

Get core metadata for a package: latest version, description, license, homepage, source repository, maintainers, and whether it is deprecated. Use before an agent installs or recommends a dependency. Ecosystems: npm, pypi, cargo.

輸入參數name必填ecosystem必填

package_versions

Package Versions

List recent released versions of a package with release dates (most recent first). Helps an agent pick a version or check how actively it is maintained. Ecosystems: npm, pypi, cargo.

輸入參數name必填limitecosystem必填

package_downloads

Package Downloads

Get popularity/download statistics for a package (recent download counts). Useful for judging how widely used and battle-tested a dependency is. Ecosystems: npm, pypi, cargo.

輸入參數name必填ecosystem必填

package_dependencies

Package Dependencies

List the direct dependencies of a specific package version (defaults to latest), via deps.dev. Lets an agent understand what a package pulls in before adding it. Ecosystems: npm, pypi, cargo.

輸入參數name必填versionecosystem必填

package_health

Package Health

A composite trust/health check for a package an agent is considering: latest-release recency, deprecation status, license present, maintainer count, dependency count, and any known security advisories (via deps.dev). Returns a summary an agent can act on. Ecosystems: npm, pypi, cargo.

輸入參數name必填ecosystem必填

版本歷史

1
  1. v2.1.0最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Datakoot 整合