Give it a requirements.txt or a package-lock.json. It flags malicious packages and known vulnerabilities, names the smallest safe version, and tells you what each upgrade removes or deprecates, read from the actual release notes.
Pythonnpmcrates.io and Go next
claude mcp add --transport http wisco-labs https://api.wiscolabs.dev/mcp
flask==2.3.3 requests==2.31.0 urllib3==1.26.18 certifi==2023.7.22→ upgrade_check
A real response from the API, shortened for the page. Select a package to see why.
Each one is an MCP tool and an HTTP endpoint. Answers are JSON, built to be read by a model.
"Is this project safe, and what should I upgrade first?"
Takes a requirements.txt, package-lock.json or package.json. Returns each package sorted into remove_now, fix_now, needs_care and more, with a suggested version and the risk of getting there.
POST /v1/package_changes/upgrade_check
"What breaks if I go from Flask 2.3.3 to 3.1.3?"
Every breaking change, removal, deprecation and security fix between two versions of one package, with the release note each came from.
GET /v1/package_changes/what_changed
"Does urllib3 1.26.18 have known vulnerabilities?"
Advisories that affect one exact version, their severity, and the smallest version that fixes all of them. Malicious-package reports included.
GET /v1/osv/vulnerabilities
"What's the latest version of pydantic, and where's its source?"
Latest version, release count, source repository and where the project keeps its changelog.
GET /v1/package_changes/package_info
New releases, release notes and advisories are picked up automatically as they're published, and every version is kept, so the full history is there to answer from.
Every version on PyPI and npm, including ones that were pulled or deprecated.
GitHub releases and changelogs, sorted into what breaks, what's removed, what's deprecated and what's fixed.
Known vulnerabilities and malicious packages from OSV, with duplicate reports merged.
Run this once in a terminal. Claude Code will offer the tools whenever you work on a Python or JavaScript project.
claude mcp add --transport http wisco-labs https://api.wiscolabs.dev/mcp
Add this to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project.
{
"mcpServers": {
"wisco-labs": { "url": "https://api.wiscolabs.dev/mcp" }
}
}Plain HTTP works too. Every tool accepts GET with query parameters or POST with JSON.
curl -X POST https://api.wiscolabs.dev/v1/package_changes/upgrade_check \
-H "content-type: application/json" \
-d '{"requirements": "flask==2.3.3\nrequests==2.31.0"}'
# npm: send package-lock.json as the requirements text
curl -X POST https://api.wiscolabs.dev/v1/package_changes/upgrade_check \
-H "content-type: application/json" \
-d "{\"requirements\": $(jq -Rs . package-lock.json)}"Agents can discover everything on their own from these.
https://api.wiscolabs.dev/llms.txt what's here, in plain text https://api.wiscolabs.dev/v1/catalog every dataset, query and parameter https://api.wiscolabs.dev/openapi.json OpenAPI schema https://api.wiscolabs.dev/mcp MCP endpoint (streamable HTTP)
data_published_at so an agent knows exactly how fresh it is.