dep-diff-mcp
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
What it can do
- Analyze Package Change: Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security
- Analyze Packages Bulk: Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe)
What data it sees
Do you need an account
No: the server works without sign-in
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions. Point this MCP at a Dependabot PR, lockfile diff, or any pair of package versions and get back a ranked upgrade plan. For every dependency bump it returns semver classification, breaking changes extracted from GitHub release notes, CVEs fixed in the range (via OSV.dev), migration guide links, and a per-package recommendation. Bulk tool analyzes up to 50 package changes in parallel and ranks by risk level (security > caution > review > likely-safe > safe). Supports npm, PyPI, and GitHub Actions (pass the action reference as the name, e.g. actions/checkout).
Server tool list (2)
Raw names from tools/list. Only developers need these.
| analyze_package_change | Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade. Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once, use analyze_packages_bulk instead. |
| analyze_packages_bulk | Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lockfile diff, or batch upgrade. Returns: total count, breakdown by semver class, total security fixes found, packages with breaking changes, and per-package details. Limit 50 packages per call. |