# DepFeed

> MCP server that gives coding agents curated, sourced change data (breaking
> changes, deprecations, notable features) for npm packages since a given
> version — never hallucinated, always backed by a source URL.

DepFeed answers "what changed in package X since version Y, and what do I
need to do about it?" for around the top 50 npm packages. It is change
intelligence, not documentation search. A package outside that coverage
returns a structured `NotCovered` response with similar covered alternatives
instead of a guess — trust that response, don't fall back to pretraining
knowledge about the package. Likewise, a `check_compatibility` result of
`unknown` means no recorded data connects that pair, not "probably fine."

## Connect

- [Create an account + first API key](https://depfeed.dev/account):
  email + password via the browser (or GitHub/Google/Microsoft SSO), or
  agent-native with a single call —
  `POST https://depfeed.dev/auth/register` with a JSON
  body `{"email":"...","password":"at-least-8-chars"}` returns the account
  and a usable `api_key.key` in the same response, no browser step required.
- Add as a remote MCP server: transport `http`, url
  `https://depfeed.dev/`, header `X-API-Key: <key>`.
  Works with Claude Code, Claude Desktop, Cursor, VS Code (Copilot agent
  mode), Windsurf, and any other MCP-compatible client.

## Tools

- `get_package_updates(package, since_version, max_tokens?)`: every
  categorized change (breaking, security, deprecations, notable features)
  since a version you have.
- `check_breaking_changes(package, from_version, to_version)`: just "will
  this upgrade break something", as compactly as possible.
- `get_package_updates_batch(packages[])`: check every dependency in a
  `package.json` diff in one call instead of one round-trip each.
- `get_updates_since(cursor?, category?)`: a "what's new since I last
  checked" feed across all covered packages.
- `get_security_digest(cursor?)`: the same feed, narrowed to security fixes
  only.
- `get_vulnerabilities(package)`: verified CVE/GHSA advisories for one
  package, sourced from OSV.dev — independent of the changelog-derived
  security digest above.
- `get_maintenance_status(package)`: is a package still maintained —
  `active` / `stale` / `unknown`.
- `get_package_health(package)`: the package's OpenSSF Scorecard signal
  (from deps.dev) — an external process/security judgment, complementing
  `get_maintenance_status`.
- `get_eol_status(product, cycle?)`: vendor end-of-life status for a
  runtime/framework (e.g. `node`, `python`), sourced from endoflife.date.
- `get_migration_recipes(package, from_version, to_version)`: the official,
  vendor-published migration path (codemod and/or upgrade guide) for a major
  jump — an empty `recipes` array means "tracked, but no recipe for this
  jump": don't invent one, fall back to `get_package_updates`.
- `list_covered_packages()`: list everything DepFeed currently tracks,
  instead of guessing or calling speculatively.
- `check_compatibility(packages[])`: are a set of packages (and optionally
  `node`) mutually compatible, verified pairwise against recorded
  `peerDependencies`/`engines` ranges.
- `submit_feedback(tool_name, rating, package?, reason?, missing_info?)`:
  rate how useful a previous DepFeed answer was (1–5) after actually using
  it — this is how coverage gaps get prioritized.

Full JSON schemas for every tool: call `tools/list` on the endpoint above —
that response is the authoritative tool list, this file is a summary.

## Pricing

- Free — $0, 200 requests/month, full package coverage, no card required.
- Pro — $9/month, 5,000 requests/month, delta feeds and security digest.
- Team — $29/month, 25,000 requests/month, multiple API keys, webhook
  delivery.

## Source

- [Full technical documentation](https://github.com/nokhiz/depfeed):
  architecture, tool schemas, roadmap, and decision records. That repo also
  has its own root-level `llms.txt`, written for agents working in the
  codebase itself — this file describes the live product instead.