@ecosyste-ms/mcp

MCP server for querying package ecosystem data from ecosyste.ms.

Queries a local SQLite database of critical packages for fast lookups, with API fallback for packages not in the database.

Installation

npm install -g @ecosyste-ms/mcp

Or run directly with npx:

npx @ecosyste-ms/mcp

The database is bundled via @ecosyste-ms/critical. No additional setup required.

To use a custom database, set ECOSYSTEMS_DB_PATH or place critical-packages.db in your working directory.

Usage with LLM Tools

Available Tools

Package Tools

• get_package - Get full package data by ecosystem and name
• lookup_package - Find package by PURL, ecosystem+name, or repository URL
• get_package_versions - Get all versions with publish dates
• get_package_advisories - Get security advisories (CVEs)
• get_package_repository - Get repository metadata (stars, forks, language)
• get_package_dependents - Get packages that depend on this package
• search_packages - Full-text search (requires local database)

Registry Tools

• list_registries - List all available package registries
• get_database_info - Get local database stats
• health_check - Check server health (database connectivity, API availability)

Examples

Ask your LLM:

• “What license does lodash use?”
• “Show me the CVEs for express”
• “How many stars does the react repository have?”
• “What packages depend on typescript?”
• “Search for packages related to authentication”
• “What’s the latest version of axios?”

Supported Ecosystems

npm, pypi, rubygems, cargo, go, maven, nuget, packagist, hex, pub, hackage, cocoapods, conda, clojars, puppet, homebrew, docker, bower, cpan, cran, julia, swiftpm, elm, deno, alpine, actions, openvsx, spack, adelie, vcpkg, racket, bioconductor, carthage, postmarketos, elpa

Development

git clone https://github.com/ecosyste-ms/mcp
cd mcp
npm install
npm test

Run locally:

node index.js

License

MIT