PackageTrack MCP server: what a dependency changed since you locked it, for your coding agent
PackageTrack MCP has three tools with clear, domain-specific purposes (package_changes, package_versions, project_report). All three have descriptions and input schemas with enums for ecosystem selection. However, critical gaps limit production readiness: (1) descriptions are functional but lack LLM-optimized guidance on WHEN to use each tool vs alternatives; (2) parameter descriptions are minimal (ecosystem, name, project lack context on expected formats or constraints); (3) no output schemas documented, LLMs cannot predict response structure for downstream planning; (4) error handling is absent from tool definitions, no guidance on retryability or recovery paths; (5) no tool annotations (readOnlyHint, idempotentHint) despite all three being read-only operations. The code shows thoughtful error messages in http_failure() and _unheld(), but these are not surfaced in tool contracts. Baseline: 194 chars avg description (these are ~100-150 chars), 72 chars avg param annotation (these are ~30-50 chars).
Before upgrading a dependency, call package_changes with the installed version as `since` (and the target as `until`, if there is one). It returns what the maintainers wrote about each release in between, oldest first.
Lists what exists, including withdrawn releases that must not be installed.
Describes a project the user has pushed with `packagetrackdev push`. Requires a PackageTrack API key.
No output schemas documented. LLMs cannot predict response structure (fields, types, pagination) for downstream tool chaining or data extraction.
Parameter descriptions are minimal. 'ecosystem' and 'name' lack format/constraint guidance; 'max_chars' and 'until' lack range or default hints. LLMs cannot infer valid inputs.
No tool annotations. All three tools are read-only and idempotent, but lack readOnlyHint/idempotentHint annotations. Agents cannot distinguish safe tools from destructive ones.
project_report requires API key but no guidance on how to provide it. Description says 'Requires a PackageTrack API key' but does not explain server-side injection or configuration.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Tool descriptions lack WHEN/WHY guidance. 'Lists what exists' (package_versions) does not explain when to call it vs package_changes, or what 'withdrawn releases' means to an agent.