Koskamo

Release Alert MCP

An official MCP server that allows agents to search for software projects across multiple registries, retrieve release history and notes, and look up associated CVEs and security advisories without requiring authentication.

Visit Release Alert

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Release Alert MCP logo, by Release AlertVendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-01Operated by Release Alert
MCP endpoint (Streamable HTTP)
https://releasealert.dev/mcp
Vendor documentation

What you can do with it

  • Search for a project by name or URL
  • List CVEs affecting a specific project
  • Check manifest files for outdated dependencies and vulnerabilities
  • Retrieve release notes between two versions

Source and maintenance

Vendor evidenceRegistry 1.0.0
mcp-registry: dev.releasealert/mcp@1.0.0Project website

Protocol and capabilities

Server
releasealert 1.0.0
MCP protocol
2025-06-18
Tools
8 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "logging": {}
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Release Alert tracks releases and CVEs for packages across many registries. Find a project with search, then pass its registry and name to the other project tools. To check a project's dependencies, pass its manifest or lockfile to check_manifest. To see what changed between two versions of a project, pass them to list_project_release_notes.

Tools

8 advertised

check_manifest
Advertised by the server during the last successful anonymous check.
Advertised read-only

Check the dependencies a manifest or lockfile names, such as a package.json, go.mod, requirements.txt, or Cargo.lock. For each one, it reports how the version asked for compares with the latest release, and the advisories that affect that version, with the versions that fix them. A range is checked at the version it names, as ^1.2.0 is at 1.2.0. Dependencies that couldn't be checked are listed under skipped, with the reason. A project new to Release Alert is added; until it has been checked, releases_checked or advisories_checked is false, and checking again in a few minutes fills in the rest.

check_manifest input schema
{
  "type": "object",
  "required": [
    "filename",
    "content"
  ],
  "properties": {
    "content": {
      "type": "string",
      "description": "the file's contents"
    },
    "filename": {
      "type": "string",
      "description": "the file's name, such as package.json or go.mod, which tells its format"
    }
  },
  "additionalProperties": false
}
check_manifest annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
get_cve
Advertised by the server during the last successful anonymous check.
Advertised read-only

Get a CVE by its id.

get_cve input schema
{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "the CVE id, such as CVE-2024-3094"
    }
  },
  "additionalProperties": false
}
get_cve annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
get_project
Advertised by the server during the last successful anonymous check.
Advertised read-only

Get a project by its registry and name.

get_project input schema
{
  "type": "object",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "the project's name in that registry, from a search result's name"
    },
    "registry": {
      "type": "string",
      "description": "the registry id, from list_registries or a search result's registry"
    }
  },
  "additionalProperties": false
}
get_project annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
list_project_cves
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the CVEs that affect a project, newest first.

list_project_cves input schema
{
  "type": "object",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "the project's name in that registry, from a search result's name"
    },
    "page": {
      "type": "integer",
      "description": "the page to return, starting at 1"
    },
    "registry": {
      "type": "string",
      "description": "the registry id, from list_registries or a search result's registry"
    }
  },
  "additionalProperties": false
}
list_project_cves annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
list_project_release_notes
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the release notes of every release of a project after one version and up to another, oldest first. A release without notes is still listed, with notes null and a link to the release. Pre-releases are left out unless the last version is one.

list_project_release_notes input schema
{
  "type": "object",
  "required": [
    "registry",
    "name",
    "from"
  ],
  "properties": {
    "to": {
      "type": "string",
      "description": "list the releases up to and including this version; the latest stable release when empty"
    },
    "from": {
      "type": "string",
      "description": "list the releases after this version, written as a version or as a manifest names it (4.19.2 or ^4.19.2)"
    },
    "name": {
      "type": "string",
      "description": "the project's name in that registry, from a search result's name"
    },
    "page": {
      "type": "integer",
      "description": "the page to return, starting at 1"
    },
    "registry": {
      "type": "string",
      "description": "the registry id, from list_registries or a search result's registry"
    }
  },
  "additionalProperties": false
}
list_project_release_notes annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
list_project_releases
Advertised by the server during the last successful anonymous check.
Advertised read-only

List a project's releases, newest first.

list_project_releases input schema
{
  "type": "object",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "the project's name in that registry, from a search result's name"
    },
    "page": {
      "type": "integer",
      "description": "the page to return, starting at 1"
    },
    "version": {
      "type": "string",
      "description": "only releases whose version contains this"
    },
    "registry": {
      "type": "string",
      "description": "the registry id, from list_registries or a search result's registry"
    }
  },
  "additionalProperties": false
}
list_project_releases annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
list_registries
Advertised by the server during the last successful anonymous check.
Advertised read-only

List the registries Release Alert tracks. A registry's id is what search and the project tools take.

list_registries input schema
{
  "type": "object",
  "additionalProperties": false
}
list_registries annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}
search
Advertised by the server during the last successful anonymous check.
Advertised read-only

Search for a project by its name, optionally followed by a version, or by its URL, or for a CVE by its id. Each project found carries the registry and name the project tools take.

search input schema
{
  "type": "object",
  "required": [
    "query"
  ],
  "properties": {
    "query": {
      "type": "string",
      "description": "a project name, optionally followed by a version (redis 7.2), a CVE id, or a project's URL"
    },
    "registry": {
      "type": "string",
      "description": "limit the search to this registry id, from list_registries"
    }
  },
  "additionalProperties": false
}
search annotations
{
  "readOnlyHint": true,
  "idempotentHint": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
465 ms
95th percentile latency
465 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 465 ms · metadata changed · 8 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http release-alert-mcp https://releasealert.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add release-alert-mcp --url https://releasealert.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable release-alert-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "release-alert-mcp": {
      "url": "https://releasealert.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "release-alert-mcp": {
      "type": "streamableHttp",
      "url": "https://releasealert.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start release-alert-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "release-alert-mcp": {
      "type": "http",
      "url": "https://releasealert.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http release-alert-mcp https://releasealert.dev/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "release-alert-mcp": {
      "url": "https://releasealert.dev/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "release-alert-mcp": {
      "serverUrl": "https://releasealert.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Release Alert MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 6,813

Do you run Release Alert MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing