A TypeScript MCP server that lets AI coding agents check whether a package is safe to recommend before suggesting an install: live health verdicts, alternative comparisons, bundle size, deprecation and CVE checks across npm and PyPI, with no API keys required.
Claude · buildproduction build
Context
AI coding agents constantly recommend outdated or deprecated packages like request, moment, and tslint, because their training data is frozen in time. Any MCP client (Claude Desktop, Claude Code, Cursor) needed a live way to check package health before suggesting an install.
Approach
Built with Claude Code as a spec-first MCP server exposing five tools: package_health, compare_packages, bundle_size, deprecation_check, and vulnerability_check. Everything runs against public endpoints (the npm registry, PyPI and pypistats, bundlephobia, and OSV.dev for CVEs) behind a 15-minute in-memory cache. Ships with a fully mocked Vitest suite and both stdio and stateless HTTP transports, so it runs per developer or shared behind a plain load balancer.
Architecture
MCP client (Claude Desktop / Claude Code / Cursor)
