Give it a requirements.txt. It flags malicious packages and known vulnerabilities, names the smallest safe version, and tells you what each upgrade removes or deprecates, read from the actual release notes.
claude mcp add --transport http wisco-labs https://api.wiscolabs.dev/mcp
flask==2.3.3 requests==2.31.0 urllib3==1.26.18 certifi==2023.7.22→ upgrade_check
A real response from the API, shortened for the page. Select a package to see why.
Each one is an MCP tool and an HTTP endpoint. Answers are JSON, built to be read by a model.
"Is this project safe, and what should I upgrade first?"
Takes a requirements.txt. Returns each package sorted into remove_now, fix_now, needs_care and more, with a suggested version and the risk of getting there.
POST /v1/package_changes/upgrade_check
"What breaks if I go from Flask 2.3.3 to 3.1.3?"
Every breaking change, removal, deprecation and security fix between two versions of one package, with the release note each came from.
GET /v1/package_changes/what_changed
"Does urllib3 1.26.18 have known vulnerabilities?"
Advisories that affect one exact version, their severity, and the smallest version that fixes all of them. Malicious-package reports included.
GET /v1/osv/vulnerabilities
"What's the latest version of pydantic, and where's its source?"
Latest version, release count, source repository and where the project keeps its changelog.
GET /v1/package_changes/package_info
Every source is checked on a schedule and saved whenever it changes, so the full history is there to answer from. Counts as of October 25, 2026.
PyPI metadata, refreshed every 6 hours, including yanked versions.
GitHub releases and changelog files, refreshed daily. Monorepos are split so each package only gets its own notes.
OSV advisories (osv.dev, CC-BY 4.0), refreshed hourly. Duplicate reports of one issue are merged.
Run this once in a terminal. Claude Code will offer the tools whenever you work on a Python project.
claude mcp add --transport http wisco-labs https://api.wiscolabs.dev/mcp
Add this to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project.
{
"mcpServers": {
"wisco-labs": { "url": "https://api.wiscolabs.dev/mcp" }
}
}Plain HTTP works too. Every tool accepts GET with query parameters or POST with JSON.
curl -X POST https://api.wiscolabs.dev/v1/package_changes/upgrade_check \
-H "content-type: application/json" \
-d '{"requirements": "flask==2.3.3\nrequests==2.31.0"}'Agents can discover everything on their own from these.
https://api.wiscolabs.dev/llms.txt what's here, in plain text https://api.wiscolabs.dev/v1/catalog every dataset, query and parameter https://api.wiscolabs.dev/openapi.json OpenAPI schema https://api.wiscolabs.dev/mcp MCP endpoint (streamable HTTP)
data_published_at, so an agent can tell old data from new.