Bumpguard MCP

What appcreationsca/bumpguard-mcp MCP server does

The appcreationsca/bumpguard-mcp MCP server helps coding agents reason about dependency changes using API evidence from the local environment or a fetched package version. Its main upgrade workflow compares a baseline API with a target API, then checks which changed symbols are used by the supplied code. Results can identify removed symbols, signature changes, severity, source lines, and suggested replacements.

The server also checks whether imports, package names, attributes, functions, classes, and methods in a code snippet exist in the selected package version. This is useful for detecting misspelled packages, outdated examples, and AI-generated calls that are not present in the installed API. API discovery is available through symbol and signature listings.

How it works

The appcreationsca/bumpguard-mcp MCP server uses static analysis rather than importing libraries or running their code. For Python, it parses source with the Python AST and scans usage, including import aliases, re-exports, instance method calls, and arguments passed to calls. Target Python versions can be downloaded as wheels, unpacked in a temporary directory, and analyzed without installation.

A language-neutral diff engine classifies API changes as breaking, potentially breaking, or informational. The usage analyzer then matches those changes against the code being checked and produces a per-line result. Downloads are sandboxed, time-limited, size-controlled, and protected against path traversal and zip-bomb risks.

For .NET, public APIs are read from assembly metadata and code is scanned with Roslyn; the .NET SDK must be available on PATH, and a helper is built on first use. Java support reads public API metadata directly from JAR bytecode in Python, without requiring a JDK or Maven. Java artifacts use Maven coordinates such as group:artifact.

Setup and configuration

Install the appcreationsca/bumpguard-mcp MCP server with pip install bumpguard-mcp. Python 3.10 or newer is required. The MCP server communicates over stdio, and the installed executable is bumpguard-mcp.

Place that executable in the MCP configuration for a compatible client. The README gives configuration guidance for Claude Desktop, Cursor, Windsurf, and other MCP-compatible clients. Install it in the same environment as the project under analysis so the server can see the intended installed packages.

For .NET analysis, ensure dotnet is on PATH. For Java analysis, no JDK or Maven installation is required. Python and .NET package identifiers differ by ecosystem, while Java packages are selected using Maven coordinates.

Tools and capabilities

The appcreationsca/bumpguard-mcp MCP server exposes these capabilities:

• check_upgrade checks whether a proposed version change affects the supplied code and reports relevant findings.
• diff_versions returns the raw breaking-change list between two versions without scanning code.
• verify_snippet checks imports and API calls against an installed or selected package version. It is available for Python, but not for .NET in v1.
• check_import checks whether a package is installed and can suggest a close package name.
• list_symbols lists public functions, classes, methods, and signatures for an installed or fetched version.
• list_languages reports available ecosystem providers.

Limitations and notes

A result with no findings means that no break was proven by the static analysis; it is not a guarantee that runtime behavior will remain unchanged. Java and .NET support have documented v1 limits. .NET parameter comparisons are limited for overloaded members, and short names resolved through using directives may receive lower-confidence results. Java and .NET workflows support upgrade checks, version diffs, symbol listings, and import checks, while .NET does not support snippet verification in v1.

The appcreationsca/bumpguard-mcp MCP server does not execute third-party code. Its conclusions depend on the API surface and usage patterns it can statically inspect, so dynamic behavior outside those patterns may not be represented.