# appcreationsca/bumpguard-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/appcreationsca/bumpguard-mcp  
**GitHub Stars:** 3  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/appcreationsca-bumpguard-mcp

## Description
Pre-flight dependency-upgrade impact analysis: reports exactly which of your code's API usages break before you bump a dependency, with line numbers, severity, and fix hints. Also verifies AI-written code against the actually-installed API to catch hallucinated calls. Static analysis only — never runs third-party code. Python + .NET. pip install bumpguard-mcp

## Tools
Capabilities this server exposes over MCP:

- **diff_versions** — *"What changed between two versions of this library?"* The raw breaking‑change list, no code scan — good for planning a migration.
- **verify_snippet** — *"Do the imports and API calls in this code really exist here?"* Catches hallucinated/typo'd package names (slopsquatting) and attributes that aren't on the installed package.
- **check_import** — *"Is this package installed? If not, what's the closest real name?"*
- **list_symbols** — *"What's the real public API of this package?"* Discover functions/classes/methods + signatures instead of guessing — for the installed version or any fetched version.
- **list_languages** — Which ecosystem providers are available.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "bumpguard-mcp": {
    "command": "uvx",
    "args": ["bumpguard-mcp"]
  }
}
```

## Documentation

## What appcreationsca/bumpguard-mcp MCP server does

The appcreationsca/bumpguard-mcp MCP server helps coding agents reason about dependency changes using API evidence from the local environment or a fetched package version. Its main upgrade workflow compares a baseline API with a target API, then checks which changed symbols are used by the supplied code. Results can identify removed symbols, signature changes, severity, source lines, and suggested replacements.

The server also checks whether imports, package names, attributes, functions, classes, and methods in a code snippet exist in the selected package version. This is useful for detecting misspelled packages, outdated examples, and AI-generated calls that are not present in the installed API. API discovery is available through symbol and signature listings.

## How it works

The appcreationsca/bumpguard-mcp MCP server uses static analysis rather than importing libraries or running their code. For Python, it parses source with the Python AST and scans usage, including import aliases, re-exports, instance method calls, and arguments passed to calls. Target Python versions can be downloaded as wheels, unpacked in a temporary directory, and analyzed without installation.

A language-neutral diff engine classifies API changes as breaking, potentially breaking, or informational. The usage analyzer then matches those changes against the code being checked and produces a per-line result. Downloads are sandboxed, time-limited, size-controlled, and protected against path traversal and zip-bomb risks.

For .NET, public APIs are read from assembly metadata and code is scanned with Roslyn; the .NET SDK must be available on PATH, and a helper is built on first use. Java support reads public API metadata directly from JAR bytecode in Python, without requiring a JDK or Maven. Java artifacts use Maven coordinates such as `group:artifact`.

## Setup and configuration

Install the appcreationsca/bumpguard-mcp MCP server with `pip install bumpguard-mcp`. Python 3.10 or newer is required. The MCP server communicates over stdio, and the installed executable is `bumpguard-mcp`.

Place that executable in the MCP configuration for a compatible client. The README gives configuration guidance for Claude Desktop, Cursor, Windsurf, and other MCP-compatible clients. Install it in the same environment as the project under analysis so the server can see the intended installed packages.

For .NET analysis, ensure `dotnet` is on PATH. For Java analysis, no JDK or Maven installation is required. Python and .NET package identifiers differ by ecosystem, while Java packages are selected using Maven coordinates.

## Tools and capabilities

The appcreationsca/bumpguard-mcp MCP server exposes these capabilities:

- `check_upgrade` checks whether a proposed version change affects the supplied code and reports relevant findings.
- `diff_versions` returns the raw breaking-change list between two versions without scanning code.
- `verify_snippet` checks imports and API calls against an installed or selected package version. It is available for Python, but not for .NET in v1.
- `check_import` checks whether a package is installed and can suggest a close package name.
- `list_symbols` lists public functions, classes, methods, and signatures for an installed or fetched version.
- `list_languages` reports available ecosystem providers.

## Limitations and notes

A result with no findings means that no break was proven by the static analysis; it is not a guarantee that runtime behavior will remain unchanged. Java and .NET support have documented v1 limits. .NET parameter comparisons are limited for overloaded members, and short names resolved through `using` directives may receive lower-confidence results. Java and .NET workflows support upgrade checks, version diffs, symbol listings, and import checks, while .NET does not support snippet verification in v1.

The appcreationsca/bumpguard-mcp MCP server does not execute third-party code. Its conclusions depend on the API surface and usage patterns it can statically inspect, so dynamic behavior outside those patterns may not be represented.

_Full upstream README: https://allmcps.com/mcp/appcreationsca-bumpguard-mcp/readme_