LabscoMCP early access ↗
appcreationscaMCP SERVER

BumpGuard

Tells your agent which lines of your code break when you upgrade a dependency — and whether an API it just wrote actually exists.

by appcreationsca ↗Package Registries & Dependency Supply ChainCommunity

LABSCO SUMMARY

Ground truth from your environment, not the model's memory.

The value is the filter: a changelog listing thousands of breaking changes is useless, a list of the three that touch your code is actionable. Equally useful is the second job — checking that the API an assistant just wrote exists in the version you have installed, rather than the version it remembers. The author states the limit clearly and repeats it in the tool output: "no findings" means nothing was proven to break, not that nothing will. Dynamically generated APIs, runtime-created members and star re-exports are named as blind spots.

What it is

An MCP server that reads a package's real public API straight from its source and matches it against your code. It never imports or executes third-party code: the API surface is extracted by parsing, and the target version is downloaded as a wheel and unpacked rather than installed. Python is supported now, along with .NET via NuGet assembly metadata and Java by reading .jar bytecode in pure Python.

What you get

  • check_upgrade — the headline: diff the installed (or a named from_version) API against the target and report only the changes your code actually hits, with line numbers, severity and fix hints. In the worked example, one of 2,015 breaking API changes in a pydantic upgrade was the one that touched the code, with a suggested replacement
  • diff_versions — the raw breaking-change list between two versions with no code scan, for planning a migration
  • verify_snippet — checks whether the imports and API calls in a piece of code really exist here, catching hallucinated or typo'd package names and attributes that are not on the installed package
  • check_import — is this package installed, and if not, what is the closest real name
  • list_symbols — the real public API of a package, functions and classes and signatures, for the installed version or any fetched one
  • list_languages — which ecosystem providers are available
  • Findings grounded in evidence: the installed version and source location come back with each one

Requirements

No account and no key. pip install bumpguard-mcp, Python 3.10 or newer, stdio transport, and clients configured to run the bumpguard-mcp command. Install it into the same environment as the project you are working on, so it sees the packages you actually have. The .NET provider additionally needs the .NET SDK (dotnet) on PATH; the Java provider needs neither a JDK nor Maven, since jars are parsed directly. For both, prefer passing from_version explicitly — the "installed" baseline comes from the NuGet global cache or your local ~/.m2, which may not match your project's pinned version. verify_snippet is Python-only in v1. MIT licensed.

Setup effort

One command — pip install bumpguard-mcp

See installation options