How do I install Vigía?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Vigía need an API key?

No required environment variable is listed on this record.

When was Vigía last checked?

Last checked 2026-10-21. What breaks between versions, vulnerabilities, compatible versions, EOL dates: npm, PyPI, Rust, PHP.

Vigía MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://vigia.coredls.cloud/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http cloud.coredls.vigia-vigia https://vigia.coredls.cloud/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "cloud.coredls.vigia-vigia": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://vigia.coredls.cloud/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 0.6.0
Last checked

12 tools

Tools

tools/listVoice mode preview

Tool	What it does
package_status	Returns the current state of one package: latest stable version and its publish date, status (active / deprecated / yanked / not_found_in_registry), the deprecation message if any, runtime requirements (npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version, PHP require.php), lice
list_versions	Lists the published versions of one package, newest first, each with its publish date, a prerelease flag and whether it is withdrawn (npm: deprecated; PyPI and crates.io: yanked; Packagist: abandoned), plus a maintenance summary: last release date, releases in the last 12 months and an activity labe
upgrade_impact	Reports what changes between two versions of an npm package by diffing the public TypeScript API of both releases (only the type declarations are analyzed; package code is never executed): removed exports and import paths, changed function signatures and class or interface members, newly deprecated
symbol_status	Checks whether an exported function, class, type or constant (or a Class.member) exists in a specific version of an npm package, using the package's TypeScript declarations. Returns whether it was found, its kind, its exact signature, the module path to import it from, whether it is deprecated (with
find_compatible_version	Finds the newest stable, non-withdrawn version of a package whose own declared requirements admit the runtimes you give it: npm engines and peerDependencies, PyPI Requires-Python, Rust rust-version (minimum Rust), PHP require.php and required packages. Returns the best version with the per-constrain
version_status	Reports on one exact version of an npm, PyPI, crates.io or Packagist package: whether that version exists, when it was published, whether it is withdrawn (npm deprecated, PyPI and crates.io yanked, Packagist abandoned), how many stable releases and major versions it is behind the latest, and its kno
check_dependencies	Audits a whole manifest in one call. For every dependency in a package.json (dependencies and devDependencies) or a requirements.txt it returns the latest version, whether the declared range includes it (up_to_date / outdated / outdated_major / unpinned / unsupported_spec), how many major versions b
recent_changes	Lists the changes Vigia detected recently, newest first: new package releases (with old and new version), deprecations, yanks and removals, runtime-requirement changes, AI model price changes and model retirement announcements. Each item has the entity, the kind of change, the old and new values and
model_status	Looks up AI models in the OpenRouter catalog: price per million input and output tokens in USD, context window, maximum output tokens, knowledge cutoff, supported modalities and announced retirement date, with a status of available / retiring / removed_from_catalog. With model_id it returns that one
eol_status	Tells whether a language, runtime, framework, database or operating-system version is still supported and when it reaches end of life. Covers about 480 products (Python, Node.js, PHP, Java, Ruby, Go, Rust, Django, Laravel, Rails, React, Angular, PostgreSQL, MySQL, Ubuntu, Debian, Kubernetes and more
changes_since_cutoff	Returns what happened in software after a given date, so an agent can patch the gap between its training data and today: packages among the most popular on npm, PyPI, crates.io and Packagist that shipped a NEW MAJOR VERSION after the date (with the version that existed at that date, the new majors a
find_package	Searches the catalog of tracked packages and AI models by case-insensitive name prefix and returns up to 15 matches ordered by popularity, each with its ecosystem, name and popularity rank. Read-only and requires no authentication. It matches only the beginning of the name (not descriptions or keywo

Vigia — what breaks when you upgrade, before your agent writes the code

Vigia is a free, open data service (REST API + MCP server) that gives AI coding agents and developers verified, dated facts about the state of npm, PyPI and Rust (crates.io) packages — the things language models get wrong because their training data is out of date.

🌐 https://vigia.coredls.cloud · MCP: https://vigia.coredls.cloud/mcp · Registry: cloud.coredls.vigia/vigia

claude mcp add --transport http vigia https://vigia.coredls.cloud/mcp

Or install it as a Claude Code plugin, which bundles the MCP server and a skill that tells the agent when to use it:

/plugin marketplace add MatiasDelosSantos/vigia
/plugin install vigia@vigia

Other agents can use the skill directly: skills/vigia/SKILL.md (also served at https://vigia.coredls.cloud/skill.md).

One-click install: Cursor · VS Code

Why

Models freeze at their training cutoff; ecosystems ship thousands of releases a day. Agents confidently write code against APIs that changed. Example — Next.js 14 → 15, detected automatically from the packages' TypeScript types:

GET /v1/packages/npm/next/upgrade?from=14&to=15

next/headers · cookies   (): ReadonlyRequestCookies   →   (): Promise<ReadonlyRequestCookies>
next/headers · headers   (): ReadonlyHeaders          →   (): Promise<ReadonlyHeaders>
+ new module: next/form
summary: 4 removed exports · 10 changed signatures · 16 changed/removed members · 5 new deprecations

What it answers (that nothing else does in one call)

Question	REST	MCP tool
What breaks if I upgrade X from A to B? Removed exports and import paths, changed signatures and class members, new `@deprecated`, `engines`/`peerDependencies` changes, changelog in between	`GET /v1/packages/npm/{name}/upgrade?from=14&to=15`	`upgrade_impact`
Does this API exist in this version? Exact signature, import path, deprecation message, "did you mean"	`GET /v1/packages/npm/{name}/symbols/{symbol}?version=15`	`symbol_status`
Newest version that works with Node 18 / React 18 / Python 3.8? Uses the requirements declared by each version	`GET /v1/packages/{npm\|pypi}/{name}/compatible?with=node@18,react@18`	`find_compatible_version`
Is my exact version vulnerable? Nearest fixed version? (OSV)	`GET /v1/packages/{eco}/{name}/versions/{version}`	`version_status`
Latest version, deprecation, runtime requirements, peers, license	`GET /v1/packages/{eco}/{name}`	`package_status`
Check a whole `package.json` / `requirements.txt`	`POST /v1/check`	`check_dependencies`
Is this Python / Node / PHP / Java / Django / Ubuntu... version still supported? When does it reach end of life? (~480 products)	`GET /v1/eol/{product}/{version}`	`eol_status`
What changed since my training cutoff? New major versions, runtime releases and AI models after a date	`GET /v1/since?cutoff=2025-06`	`changes_since_cutoff`
AI model prices, context windows, retirement dates	`GET /v1/models`	`model_status`

Every response includes when it was verified and where the data came from. Full spec: /openapi.json · Docs in 18 languages: /docs.

Project context for agents (no MCP needed)

Agents read AGENTS.md / CLAUDE.md by themselves. Generate a block with the facts about your dependencies (end-of-life runtimes, vulnerabilities, deprecated packages, what breaks in the major versions you are behind on):

Web: https://vigia.coredls.cloud/context (paste your package.json or requirements.txt)
Script (zero dependencies, Node 18+; read it first): curl -fsSL https://vigia.coredls.cloud/context.mjs -o vigia-context.mjs && node vigia-context.mjs
API: POST /v1/context

Claude Code: automatic. The plugin includes hooks that give the agent these facts at session start and re-check whenever it edits package.json or requirements.txt (so it learns that Node 18 is end of life, or that lodash has known vulnerabilities, without calling any tool). The manifest is sent to Vigia and not stored; set VIGIA_DISABLE=1 to turn the hooks off. Without the plugin, copy examples/claude-code-settings.json into .claude/settings.json and point it at hooks/vigia-hook.mjs.

Per-month pages of what changed after a training cutoff: https://vigia.coredls.cloud/since

GitHub Action

Flags outdated, deprecated and vulnerable dependencies on every pull request:

name: dependencies
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  vigia:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: MatiasDelosSantos/vigia@v1
        with:
          fail-on: vulnerable                        # optional: vulnerable, deprecated, major, outdated
          github-token: ${{ secrets.GITHUB_TOKEN }}  # optional: comment on the PR

Badges

[](https://vigia.coredls.cloud/npm/react)
[](https://vigia.coredls.cloud/npm/react)

How it works

Registries are the source of truth. npm, PyPI and crates.io metadata with ETags, publish dates and per-version requirements (engines, Requires-Python, rust-version); deps.dev for npm history; OSV for vulnerabilities; OpenRouter for AI models.
API surface analysis never executes package code. Tarballs are downloaded, only .d.ts, package.json and changelogs are extracted, and the TypeScript compiler API reads the exported declarations in an isolated worker thread with memory and time limits. Packages without bundled types fall back to @types/*.
Facts are never overwritten. Each change closes the previous value (bitemporal history), so ?as_of= can answer "what did Vigia say on date X".
Self-updating. A worker tracks ~34,000 popular packages (npm every 15 min–2 h; PyPI via its update feed; the top 3,000 Rust crates from crates.io), resolves unknown packages on first request, and pre-computes upgrade reports for the 300 most popular npm packages.

Stack: TypeScript, Node 22, Hono, PostgreSQL 17, MCP SDK, Docker.

Run it yourself

cp .env.example .env          # set POSTGRES_PASSWORD and PUBLIC_URL
docker compose up -d          # vigia-db, vigia-api (:3005), vigia-worker
npm install && npm test       # 70 unit tests

Data license & privacy

Vigia's compiled data is CC-BY-4.0 (attribute "Vigia"); upstream data keeps each source's terms. Manifests sent to /v1/check are not stored; no cookies or trackers. See terms and privacy.

License

Code: AGPL-3.0. Operations notes (Spanish): docs/OPERACION.es.md.

Vigía

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Vigía?

Does Vigía need an API key?

What transport does Vigía use?

When was Vigía last checked?

Documentation

Vigia — what breaks when you upgrade, before your agent writes the code

Why

What it answers (that nothing else does in one call)

Project context for agents (no MCP needed)

GitHub Action

Badges

How it works

Run it yourself

Data license & privacy

License