Summary
Version lookup and vulnerability lookup answered by one server, so an upgrade is one conversation.
The per-registry tools are uniform — details, versions, and search where it exists — and the advisory tools take an ecosystem argument naming those same registries, so "is there a newer version, and does the one we ship have a CVE" is two calls in the same place. Coverage is not symmetric: Cargo, npm and NuGet have search tools, while Go and PyPI are addressed by exact name or module path.
What it is
A lookup server over five package registries and the GitHub Security Advisory Database, with the same ecosystem names running through both halves.
What you get
- Package details and full version lists for Cargo, npm, NuGet and PyPI
- Go module details and version lists, addressed by module path
- Registry search by query for Cargo, npm and NuGet
- get-package-advisories, which returns every advisory affecting one named package, filtered by ecosystem and severity
- The advisory database searched by ecosystem, severity, type or CVE ID, and one advisory fetched by its GHSA ID
Requirements
Nothing — no account, no key.
Setup effort
One command — npx package-registry-mcp