An MCP server for tracking package dependencies across multiple package managers (pub, npm, crates, pypi, go, github, rss) with watch management, release tracking, and refresh capabilities.
Solid foundation with well-structured schemas and clear naming conventions. All 10 tools have explicit input schemas with proper type definitions and enums. Descriptions are present and actionable (avg ~120 chars). However, parameter descriptions are largely absent, the code shows parameters like 'filter', 'kind', 'limit', 'id', 'name', 'until' with no inline documentation of what they control or their constraints. Output schemas are not documented. Error handling is present but generic. The codebase demonstrates thoughtful design (e.g., _idOrNameNote DRY principle, canonicalize() for package identity), but LLM-facing documentation is incomplete.
Add a new RSS feed watch. Requires a feed URL. Returns the created watch with its id.
Add a new watch for a package or feed. Requires kind and name. Returns the created watch with its id.
Get release notes for a watch, newest first. Accepts id, name, or both; if both are given they must identify the same watch or the call fails.
Get one watch with every project that uses it and the version each one pins. This is the cross-repo view: a package used in five repos is one watch with five usages. Accepts id, name, or both; if both are given they must identify the same watch or the call fails.
List watched packages and feeds. filter: all (default), unread (has a release nobody has looked at), or outdated (some project pins a version below the newest release). Snoozed watches are excluded unless filter is all.
Mark a watch as read, clearing its unread release count. Accepts id, name, or both; if both are given they must identify the same watch or the call fails.
Parameter descriptions missing. Schema defines 'filter', 'kind', 'limit', 'id', 'name', 'until', 'url', 'query' but none have descriptions explaining what they control, valid ranges, or constraints. LLMs cannot infer parameter semantics from names alone.
Output schemas not documented. Tools return structured data (watch objects, release notes, counts) but no schema is visible in tool definitions. LLMs cannot plan downstream calls or extract fields without knowing response structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Refresh a watch immediately, fetching the latest releases. Optionally refresh a specific watch by id or name, or refresh all watches if no id/name is provided.
Remove a watch by id or name. Accepts id, name, or both; if both are given they must identify the same watch or the call fails.
Search for watches by name or kind. Returns matching watches with usage counts.
Snooze a watch until a specified time. Accepts id, name, or both; if both are given they must identify the same watch or the call fails.
Error handling lacks recovery guidance. Code throws ArgumentError for invalid inputs (e.g., 'no such watch', 'must be an integer') but tool descriptions do not explain what to do on failure or how to recover. Agents receive raw errors with no next-step guidance.
Destructive operations lack confirmation step. remove_watch is marked DESTRUCTIVE but has no dry-run or confirmation mechanism. Agents can delete watches without a safety gate.
Tool annotations present but incomplete. Risk field (READ_ONLY, WRITE, DESTRUCTIVE) is declared in metadata but not exposed in MCP tool definition. Clients cannot see which tools are safe to retry or have side effects.