Purpose
package-registry-mcp is a server based on the Model Context Protocol (MCP), designed to enable AI assistants and agents (such as Claude, Cursor, Copilot, etc.) to search package registries and obtain the latest package information. It is aimed at development and security scenarios that require real-time queries of package metadata and dependency information.
Main capabilities
This MCP server provides the following toolset:
- NPM: Search for packages in the NPM registry, obtain detailed information for a specified NPM package (package metadata, runtime/dev/peer dependencies, maintainer information, repository and homepage links, the latest 50 versions), and list all versions of a specified NPM package.
- crates.io (Rust): Search for Rust crates, obtain detailed crate information (metadata, keywords and categories, download statistics, features and crate size, repository/homepage/documentation links), and list all versions.
- NuGet (.NET): Search for NuGet packages, obtain detailed information (authors and project information, target frameworks and dependencies, download statistics and verification status, project/license/icon URLs), and list all versions.
- PyPI (Python): Obtain detailed PyPI package information (authors and maintainers, dependencies and Python version requirements, classifiers and keywords, project URLs and documentation links, download statistics, vulnerability information), and list all versions. Note: PyPI does not provide a JSON search API, so only package details and version lists are supported; for search, use directly https://pypi.org/search/ .
- Go module: Obtain detailed Go module/package information (module path and latest version, release date and repository information, VCS details, links to pkg.go.dev and the go get command), and list all versions. Note: pkg.go.dev does not provide a JSON search API, so only package details and version lists are supported; for search, use directly https://pkg.go.dev/search/ .
- GitHub Security Advisory: Search the GitHub Security Advisory database (filterable by ecosystem, severity, type, CVE ID), obtain details for a specified advisory (GHSA ID, CVE ID, summary, description, severity and CVSS score, affected packages and vulnerable version ranges, patched versions, CWE classification, references and acknowledgments), and obtain all security advisories affecting a specific package. The data comes directly from the respective package registries and is real-time.
How to use
Configure the MCP server in Cursor:
- Open Cursor settings (Cmd/Ctrl + ,)
- Search for "MCP" or go to Extensions > MCP
- Add a new server:
- Name: package-registry
- Command: npx
- Args: ["package-registry-mcp"]
For Claude Code, run the corresponding command in the terminal to configure it.
For Claude Desktop, add the server to claude_desktop_config.json:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json Restart Claude Desktop after adding the configuration.
Once configured, you can use the package search and information tools.
You can also install the package globally: Or use npx directly (no installation required):
Applicable scenarios
- During development, when you need to quickly check the latest version, dependencies, or license information of a package.
- During security audits, when retrieving security advisories and vulnerability impact ranges for a specific package or ecosystem.
- In AI assistant conversations, to directly obtain real-time data from package registries to assist coding decisions.
Limitations
- Requires Node.js 18+ or the Bun runtime.
- Requires an internet connection to access the package registries.
- PyPI and pkg.go.dev do not provide a JSON search API, so these two registries only support retrieving details and version lists by name, and do not support keyword search.
- Specific installation commands, development guides, license details, etc. are partlyThe content appears in the materials in placeholder form, and the complete text is not yet provided.
