Npm Pypi Crates Packages MCP server
{
"mcpServers": {
"datakoot-npm-pypi-crates-packages": {
"type": "http",
"url": "https://package.datakoot.com/mcp"
}
}
}{
"mcpServers": {
"datakoot-npm-pypi-crates-packages": {
"type": "http",
"url": "https://package.datakoot.com/mcp"
}
}
}{
"mcpServers": {
"datakoot-npm-pypi-crates-packages": {
"type": "http",
"url": "https://package.datakoot.com/mcp"
}
}
}{
"servers": {
"datakoot-npm-pypi-crates-packages": {
"type": "http",
"url": "https://package.datakoot.com/mcp"
}
}
}{
"mcpServers": {
"datakoot-npm-pypi-crates-packages": {
"type": "http",
"url": "https://package.datakoot.com/mcp"
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsonversion 2.1.0
What it does
This server provides package intelligence for npm, PyPI, and crates.io packages, allowing AI agents to query metadata, version history, dependencies, and health signals before installing them. It requires no API keys and pulls data from official public registries and deps.dev.
- Check a package's license, homepage, and repository before adding it as a dependency.
- Review version history and download popularity to assess if a package is actively maintained.
- Inspect direct dependencies and OpenSSF Scorecard health signals to evaluate supply-chain risk.
Tools this server exposes
| Tool | Does |
|---|---|
| package_info | Retrieve metadata for a package including description, latest version, license, homepage and repository links. |
| package_versions | Get full version history with release dates for a package. |
| package_downloads | Fetch download counts and popularity signals for a package. |
| package_dependencies | List direct dependencies for a specific package version. |
| package_health | Retrieve health signals including OpenSSF Scorecard, stars, and dependents count. |
| package_search | Search for packages by keyword across the registry. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.