whichlib

io.github.josifb由 GitHub 帳號 josifb 發布v0.2.4更新於 Oct 29, 2026

Dependency picker for coding agents: recommends, compares and scores GitHub repos with a verdict.

已驗證Streamable HTTP可網頁執行網頁搜尋與抓取開發者工具資料與分析

概覽

AI 產生的概覽

whichlib 是一個依賴選擇 MCP 伺服器,根據 GitHub、npm 與 PyPI 即時資料推薦、比較並評分開源函式庫。

可以做什麼
  • 用自然語言描述需求,取得依契合度排序的函式庫推薦,附評分、下載量與一句話結論
  • 並排比較 2-10 個已知儲存庫,列出評分、等級、星標、分支、議題、授權、下載量與結論
  • 依日、週、月或本週漲星探索熱門儲存庫,可依語言篩選
  • 為每筆結果提供透明的 0-100 評分明細(動能、維護、採用度、授權)與安裝名稱
適用情境
適合在編碼助理準備新增依賴、使用者詢問該用哪個函式庫,或不確定某個套件是否存在、是否仍在維護時使用。也適合探索新專案,但不適合用來挑選依賴。
執行需求
可作為託管遠端端點使用,不需 Node;也可透過 npx whichlib 在本機執行,需要 Node 22 或更新版本。不需帳號或 API 金鑰。選用的 GITHUB_TOKEN(託管端點用 X-GitHub-Token 標頭)可提高 GitHub 搜尋額度;選用的 WHICHLIB_TELEMETRY 或 DO_NOT_TRACK 設定可控制匿名呼叫統計。需要連線至 GitHub、npm 與 PyPI 的網路。
安裝前請注意
託管端點在未使用自己的 GitHub 權杖時每天限 50 次免費呼叫;本機伺服器每次呼叫會發出多次 GitHub 搜尋,沒有 GITHUB_TOKEN 時可能觸發速率限制。匿名呼叫統計預設開啟(工具名稱、隨機安裝 ID、版本、平台、Node 主版本、協定版本,絕不含查詢或結果),可用 WHICHLIB_TELEMETRY=off 或 DO_NOT_TRACK=1 關閉。預設會把每日星標資料下載到本機資料夾,除非設定 WHICHLIB_HISTORY=off。評分屬啟發式指標,不保證品質。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 whichlib,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.josifb%2Fwhichlib/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "whichlib": {
      "type": "http",
      "url": "https://whichlib.com/mcp"
    }
  }
}

README

whichlib

The dependency picker for coding agents. Ask which library to use and get a scored, verified answer instead of a guess.

whichlib is an MCP server with three tools. It speaks MCP 2026-07-28; older clients keep working. Every repository it returns carries a transparent 0–100 score (momentum, maintenance, adoption including npm and PyPI downloads, license), a tier, a one-line verdict and the full breakdown, so the agent can justify the pick and you can read why.

For teams (waitlist): alerts when a dependency your repos use goes stale, and rules your team's coding agents must follow when they add one. Add a 👍 to the waitlist issue; at 20 signups it gets built. whichlib itself stays free.

Install

Claude Code:

claude mcp add whichlib -- npx -y whichlib

Cursor, Windsurf and other MCP clients:

json
{ "mcpServers": { "whichlib": { "command": "npx", "args": ["-y", "whichlib"] } } }

Requires Node 22 or newer. No account, no API key.

Use it without installing (hosted, no Node needed):

claude mcp add --transport http whichlib https://whichlib.com/mcp

Limits and the web API: https://whichlib.com/docs/

Tools

ToolAskYou get
recommend_reposneed in plain words, optional language, limit 1–10The best repositories for the need, ranked by fit (score × relevance), with downloads and a verdict each
compare_reposrepos: 2–10 names as owner/repoThe repositories side by side, best first, same breakdown
trending_reposperiod day / week / month / rising, optional language, limitMost-starred repositories created in the period, scored; rising: repositories of any age by stars gained this week

Example, in Claude Code: "which Python PDF parser should I use?" → MinerU, pdfplumber, pypdf with scores, weekly downloads and verdicts like "Rising fast, 26k downloads/wk, pushed 3 days ago, Apache-2.0".

Score

PartWeightSignal
Momentum40%Stars gained over 7 days (from daily star counts when available), else stars per day since creation, scaled by the npm/PyPI download trend when known (0.5–2x). Log scale.
Maintenance25%Days since last push, full marks to 30 days, zero at a year. Widely used repos (10k+ stars or 100k+ weekly downloads) never drop below half.
Adoption25%Stars, forks and npm / PyPI weekly downloads, log scale.
License10%Permissive 1.0, weak copyleft 0.75, strong copyleft 0.5, none 0.

Tiers: Strong ≥ 75, Solid ≥ 50, Watch ≥ 25, Avoid; repos younger than 30 days are New ("Too new to judge"), whatever their score. Archived repos are capped at 20. On a 20-need eval the top recommendation is an accepted answer 75% of the time and the top five contain one 100% of the time; the eval and its reports live in the repository.

Environment variables, all optional

  • GITHUB_TOKEN: raises GitHub's search limit from 10 to 30 per minute. A fine-grained token with no permissions is enough. Recommend makes three searches per call.
  • WHICHLIB_HISTORY=off: do not download daily star counts. By default the server keeps the last 10 days in ~/.whichlib/stars/, refreshed in the background at most every 12 hours from raw.githubusercontent.com, so momentum uses real stars gained per week for the top 1,000 repos per language and new trending repos. Nothing is sent with that download.
  • FRESH_REPOS_DATA_DIR: a folder of daily snapshots or star counts to use instead (see the repository's data branch).
  • WHICHLIB_TELEMETRY=off or DO_NOT_TRACK=1: disables anonymous call counting. What is counted: tool name, a random install id, version, platform, Node major version, the MCP protocol version of the call. Never queries, repository names or results. The aggregate numbers are public at https://whichlib-telemetry.todorovskijosif.workers.dev/stats.

Source, dashboard, data

Repository: https://github.com/josifb/whichlib (MIT). It also holds the Fresh Repos dashboard (most-starred new repositories, day / week / month, sortable, one HTML file), the nightly snapshot and enrichment jobs, the recommendation eval, and 80+ unit tests.

Development, from the whichlib/ folder of the repository:

npm test           # unit tests, no networknpm run mcp:smoke  # start the server over stdio and call every tool livenpm run eval       # 20-need recommendation eval (set GITHUB_TOKEN)npm run snapshot   # today's top repos per period and language -> data/snapshots/npm run enrich     # add npm / PyPI packages and weekly downloads to the latest snapshotnpm run score      # top repos from the latest snapshot with score and verdictnpm run pull-data  # copy snapshots from the data branch

Layout:

mcp/server.mjs         MCP entry (stdio)        mcp/tools.mjs       tool logicmcp/expand.mjs         query expansion          mcp/telemetry.mjs   anonymous call countingmcp/github-api.mjs     GitHub client + cache    mcp/data.mjs        snapshot history providermcp/eval/              needs, metrics, runner, inspect, results/lib/score.js           the score, shared by browser and Nodesnapshot/src/          query, normalize, github, registry, enrich, history, run, score-report, pull-datadashboard/index.html   redirect to whichlib.com/repos (Fresh Repos)

來源:whichlib/README.md,提交 a4d1c68

工具

3

recommend_repos

Recommend repositories

Find the best open-source library for a need before adding a dependency. Give the need in plain words and get up to `limit` GitHub repositories ranked by fit = score x relevance to the need. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this when you do not yet have candidates; use compare_repos when you already have names. Makes 3 GitHub searches plus npm/PyPI lookups for the shortlist. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

輸入參數need必填limitlanguage

compare_repos

Compare repositories

Compare 2-10 known GitHub repositories side by side, best score first: score and tier, stars, forks, open issues, last push, license, npm/PyPI weekly downloads (only when the registry links back to the repository) and a verdict. Each result has a 0-100 score (momentum 40% (stars gained per week; without history, lifetime stars per week scaled by the npm/PyPI download trend), maintenance 25%, adoption incl. npm/PyPI weekly downloads 25%, license 10%), a tier (Strong >=75, Solid >=50, Watch >=25, Avoid <25; New for repos under 30 days old, too new to judge), a one-line verdict and the full breakdown. Use this to choose between candidates you already have (for example zod vs valibot) or to check a dependency the project already uses; use recommend_repos to find candidates. One GitHub API call per repository plus npm/PyPI lookups. A repository that does not exist is listed under notFound and the rest are still compared; the call fails only if none can be fetched, or when GitHub's rate limit is reached or the token is rejected. Hosted: 50 free tool calls per day per user; send header X-GitHub-Token with your own GitHub token for unlimited use, or run the npm package locally (npx -y whichlib).

輸入參數repos必填

版本歷史

10
  1. v0.2.4最新Oct 29, 2026
  2. v0.2.3Oct 15, 2026
  3. v0.2.2Oct 15, 2026
  4. v0.2.1Oct 14, 2026
  5. v0.2.0Oct 7, 2026
  6. v0.1.5Oct 3, 2026
  7. v0.1.4Oct 2, 2026
  8. v0.1.2Sep 29, 2026
  9. v0.1.1Sep 28, 2026
  10. v0.1.0Sep 27, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分