MCP server that gives coding agents structured breaking-change diffs for npm packages, so they stop writing code against removed or renamed APIs.
Two well-documented tools with clear verb-based names, comprehensive descriptions (194-280 chars), and proper input schemas using Zod. Both tools follow the read-only action pattern. However, output schemas are not formally documented in the code, and descriptions rely on narrative prose rather than structured WHAT/WHEN/HOW guidance. No parameter enums where they could tighten constraints. Error handling is present but generic (apiErrorMessage returns HTTP status + body without recovery guidance). Tool composition is sound, resolve_package → get_breaking_changes is a natural chain. The server is STDIO-only, which caps protocol readiness to 50 regardless of definition quality.
Structured breaking-change diff between two versions of an npm package, computed from its TypeScript type declarations: removed exports, changed signatures, removed/changed class or interface members, plus new exports. Each entry has before/after signatures and a short migration note. The response includes a confidence score: 0.9 when both versions ship bundled types, 0.8 when DefinitelyTyped @types/* declarations were used. Use this before writing or upgrading code that targets a dependency version you are not certain about — e.g. when the installed version is newer than the API surface you know. The first request for a version pair may take up to a couple of minutes while the diff is computed; results are cached after that.
Resolve an npm package to its latest published version and dist-tags. Use this when you only know the package name and need the current version, typically before calling get_breaking_changes.
Output schemas not documented. Tools return raw JSON via apiGet() with no formal schema declaration for response fields (e.g., resolve_package returns latest version and dist-tags, but no structured spec). LLMs cannot predict response structure for planning or extraction.
Error messages lack recovery guidance. apiErrorMessage() returns 'vdiff API error (HTTP 404): ...' but never suggests what the LLM should do next (e.g., 'Package not found. Try a different ecosystem or check the spelling.'). Stack traces or bare HTTP status codes force the agent to guess.
No pagination or result limiting for get_breaking_changes response. If a package has hundreds of breaking changes, the response could exceed context windows. Tool description mentions caching but not result caps.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 74 | 2026-07-28+ | v2 |
Parameter 'from' accepts any string; no semver validation shown. Description says 'ranges like "^3.0.0" are not accepted' but inputSchema does not enforce this with a regex or custom validator. LLMs may pass invalid semver and waste a round-trip.
No tool annotations (readOnlyHint, etc.) declared, though both tools are read-only and idempotent. Tool annotations would improve agent planning and safety.