Skip to main content
The package inspection tools give your agent immediate access to structured metadata about any dependency without leaving the coding session. Instead of switching to a browser or running registry lookups manually, your agent can call these tools directly to triage a package, check documentation context, review vulnerabilities, understand dependencies, and inspect upgrade changes. All five tools are available as MCP tools and as subcommands under npx githits@latest pkg.
Package inspection supports 12 registries: npm, PyPI, Hex, Crates, vcpkg, Zig, NuGet, Maven, Packagist, RubyGems, Go, and Swift. Vulnerability data is unavailable for vcpkg and Zig. Dependency data supports npm, PyPI, Hex, Crates, Zig, vcpkg, RubyGems, Go, and Swift.
pkg_info returns a quick triage summary for any package: the latest version, license, repository popularity, download volume, publish age, and vulnerability status. Pass verbose: true to add GitHub language breakdown, topics, last-pushed date, recent advisories, and recent changes.CLI usage
Parameters
​
string
required
The package registry. One of: npm, pypi, hex, crates, vcpkg, zig, nuget, maven, packagist, rubygems, go, or swift.
​
string
required
The package name. Scoped names are supported (e.g., @types/node).
​
boolean
When true, adds GitHub language/topics/last-pushed, recent advisories, and recent changes to the text output. Has no effect when format: "json" is set.
Example
Returns: version, license (MIT), description, GitHub stars/forks/open issues, weekly downloads, publish age, and a compact vulnerability status line.
pkg_vulns fetches CVE and OSV security advisories for a package or a specific pinned version. It returns a count summary, each advisory with its OSV ID, severity, affected version ranges, and fix versions. Malicious-package advisories appear in a separate bucket.CLI usage
Parameters
​
string
required
Package registry. Vulnerability data is unavailable for vcpkg and Zig.
​
string
required
Package name (scoped names supported).
​
string
Specific version to check. Defaults to latest when omitted.
​
string
Filter to advisories at or above this level: low, medium, high, or critical. Omit to include all advisories, including those with no assigned severity.
​
boolean
When true, includes retracted advisories. Defaults to false.
​
string
Which advisories to return: affected (default, only advisories that affect the inspected version), non_affecting (historical advisories that do not affect this version), or all (both affected and historical). Counts always include affected/non-affecting/all totals.
​
boolean
When true, shows every advisory with full detail rows in text output. format: "json" always returns the complete structured envelope regardless of this setting.
Example
Returns: a severity-filtered advisory list with OSV IDs, affected ranges, and recommended fix versions or upgrade paths when available.
Default text output caps advisory rows for readability. Use --verbose to see every advisory or --json for the complete structured envelope.
pkg_deps lists a package’s direct runtime dependencies with resolved versions. Use the lifecycle parameter to include non-runtime groups (development, peer, optional, build), or pass lifecycle: "all" to see every available group. Pass max_depth to add a bounded transitive dependency footprint with conflict detection and circular-dependency flags.CLI usage
Parameters
​
string
required
Package registry. Dependency data is available on npm, PyPI, Hex, Crates, Zig, vcpkg, RubyGems, Go, and Swift.
​
string
required
Package name (scoped names supported).
​
string
Specific version to inspect. Defaults to latest. Tag-style inputs with a leading v (e.g., v4.18.0) are rejected — pass the canonical version number (4.18.0).
​
string
Dependency group breadth. Omit for runtime-only. Use runtime for explicit runtime-only, a concrete non-runtime lifecycle (development, build, peer, optional) to add matching groups, or all for every available group. Accepts a single value, a comma-separated string, or an array. all cannot be combined with other values.
​
boolean
When true, each entry in transitive.packages[] also carries an importers array showing every upstream package that pulls it in. If max_depth is omitted, this also requests the full transitive block. Off by default because enabling it roughly quadruples envelope size on heavy graphs.
​
number
Add a transitive block and cap traversal at this depth (1-10). Omit for direct dependencies only. In the CLI, use --depth.
Example
Returns: runtime, development, and peer dependency groups with resolved versions for each direct dependency.
pkg_changelog retrieves release notes for a package or GitHub repository, newest-first. By default it returns the ten most recent entries. Use from_version and to_version to fetch every entry in a version range without a count cap.You can address by registry + package name, or directly by a GitHub repository URL when you have the URL but no registry mapping.CLI usage
Parameters
​
string
Package registry (used with package_name). Mutually exclusive with repo_url.
​
string
Package name (used with registry). Mutually exclusive with repo_url.
​
string
GitHub repository URL (e.g., https://github.com/expressjs/express). Mutually exclusive with registry + package_name. Use when you have a repo URL without a registry mapping.
​
number
Maximum number of entries to return in latest mode (1–50, default 10). Cannot be combined with from_version.
​
string
Start of a version range. When set, returns every entry between from_version and to_version (or latest) with no count cap. Tag-style v-prefixed inputs are rejected.
​
string
End of the version range or latest-mode cap. Defaults to latest.
​
boolean
When true, omits body content from each entry — useful when you only need the version / date / URL timeline. Defaults to false. In the CLI, use --no-body.
​
boolean
Text output only. Shows full body content for every entry. Mutually exclusive with body_lines.
​
number
Text output only. Number of body lines to preview per entry (1–50, default 10). Mutually exclusive with verbose: true.
Example
Returns: the three most recent release entries with version, date, source URL, and a 10-line body preview.
pkg_upgrade_review compares the version you use today with a target version. It checks direct vulnerability changes, changelog range evidence, target deprecation metadata, peer dependency changes, dependency changes, and optional transitive evidence.Use it when your agent needs upgrade facts instead of guessing from semver. The tool reports evidence only; it does not decide whether an upgrade is safe.CLI usage
Parameters
​
string
Package registry for single-package mode. Supported registries: npm, pypi, hex, crates, nuget, maven, zig, vcpkg, packagist, rubygems, go, and swift.
​
string
Package name for single-package mode. Scoped names are supported.
​
string
The version you currently use. Tag-style inputs with a leading v are rejected.
​
string
The version you want to review. Tag-style inputs with a leading v are rejected.
​
array
Batch mode. Each entry includes registry, package_name, current_version, and target_version. Mutually exclusive with the single-package fields.
​
boolean
When true, skips current-vs-target transitive vulnerability summary diffs. Defaults to false, so transitive security evidence is included unless explicitly skipped. In the CLI, use --no-transitive-security.
​
boolean
When true, diffs current vs target transitive deprecated, outdated, duplicate, and conflict summaries. Defaults to false.
​
string
Minimum direct-advisory severity: low, medium, high, or critical.
​
boolean
Text output only. Includes dependency change examples, including transitive version changes.
Example
Returns: a current-vs-target evidence report with direct vulnerability changes, changelog entries, target deprecation status, peer dependency changes, and transitive security summaries.
Do not treat semver alone, including patch updates, as enough upgrade evidence. Use pkg_upgrade_review to collect facts, then make the final risk call in your review.

​
MCP tool reference