Dependency check MCP

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Packagist name, vendor/package."
    },
    "version": {
      "type": "string",
      "description": "Optional release to select. Omit it for the latest stable."
    }
  }
}

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

{
  "type": "object",
  "required": [
    "name",
    "version"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name, for example guzzlehttp/guzzle or lodash."
    },
    "version": {
      "type": "string",
      "description": "The exact version to check, for example 6.5.0."
    },
    "ecosystem": {
      "enum": [
        "packagist",
        "npm",
        "pypi",
        "go",
        "crates.io",
        "maven",
        "rubygems",
        "nuget"
      ],
      "type": "string",
      "description": "OSV ecosystem. Omit it and a vendor/package name uses Packagist, otherwise npm."
    }
  }
}

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}