Search and metadata are the easy part. What earns the connection are the derived tools: a health report spanning maturity, maintenance and dependency weight, a side-by-side comparison, alternatives found from keywords and recent activity, and a release timeline that surfaces MSRV bumps and yanked versions. Running the OSV audit in the same place means the security question and the choice happen in one sitting, and since it reads only public data there is nothing to authorise.
A Rust server over crates.io and docs.rs. It searches crates, reads their metadata, features and documentation, walks dependencies in both directions, audits them against OSV.dev, and compares candidates side by side.
- search_crates by name or keyword, then get_crate_info, get_crate_versions with release dates and download counts, get_crate_version, get_crate_readme, and get_crate_features showing which sub-features each flag activates
- docs.rs without leaving the conversation: get_crate_docs for the structure, search_docs to find an item by name, get_doc_item for the full documentation on one function, struct or trait
- get_dependencies for a version, get_reverse_dependencies for what depends on it, and get_dependency_tree for the full transitive tree with configurable depth and deduplication markers
- audit_dependencies checks the dependencies against the OSV.dev vulnerability database
- get_crate_health reports across maturity, adoption, maintenance, security and dependency weight; compare_crates puts several crates side by side on downloads, versions, dependencies and freshness; get_alternatives finds candidates from keywords, downloads and recent activity
- get_crate_changelog pulls the changelog out of the crate's GitHub repository, optionally filtered to one version, and get_release_timeline diffs registry metadata version over version — feature changes, MSRV bumps, yanked status and release cadence
- Download statistics overall and day by day for a version, plus owners, authors, user profiles and totals, categories, keywords and the crates.io global summary
- Every successful call returns readable Markdown in content and typed JSON in structuredContent, with the matching JSON Schema advertised as outputSchema at discovery
- Six prompts ship with it — analyze_crate, compare_crates_analysis, stack_review, evaluate_dependencies, recommend_crates and migration_guide — and three resources expose a crate's info, README and docs structure
Nothing, if you use the public instance: point an HTTP client at https://cratesio-mcp.fly.dev/. To run your own, cargo install cratesio-mcp and launch it over stdio, or use the ghcr.io/joshrotenberg/cratesio-mcp image; --transport http --port 3000 serves Streamable HTTP instead, behind a middleware stack with timeouts, rate limiting, concurrency control and optional response caching. No credentials of any kind — it reads only public crates.io and docs.rs data.
One command — cargo install cratesio-mcp