MCP server

Why MCP

An AI assistant is good at reading a repository and running your tests. It is a poor judge of which versions are old enough and aligned with each other, because it guesses from training data that is months old. Ripedeps closes that gap: the agent gets a deterministic plan built from live registry data, together with the explanation of every decision, and then continues with its own work.

• Suggestions: the exact new ranges, as a diff and as a complete file.
• Decisions and explanations: the candidates are ranked in a fixed order, and the tool result gives one decision and one explanation sentence per package, ready to be relayed to you.
• Read-only: Ripedeps never writes to your machine or repository. The tool is marked readOnlyHint.

Connect your client

The server is remote, so there is nothing to install: https://mcp.ripedeps.com/mcp. It speaks MCP over Streamable HTTP, is stateless and needs no login.

Claude Code

claude mcp add --transport http ripedeps https://mcp.ripedeps.com/mcp

Add --scope project to share it with your team through .mcp.json, or --scope user for all your projects:

{
  "mcpServers": {
    "ripedeps": {
      "type": "http",
      "url": "https://mcp.ripedeps.com/mcp"
    }
  }
}

Cursor

{
  "mcpServers": {
    "ripedeps": {
      "url": "https://mcp.ripedeps.com/mcp"
    }
  }
}

VS Code

{
  "servers": {
    "ripedeps": {
      "type": "http",
      "url": "https://mcp.ripedeps.com/mcp"
    }
  }
}

Any other client that supports remote MCP servers over Streamable HTTP works the same way: give it the URL.

To see the raw protocol without a client:

curl -s -X POST https://mcp.ripedeps.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The plan_upgrade tool

One tool. Its parameters are the same as the REST API's. Send exactly one of packageJson andpackageJsonUrl.

The tool description recommends minAgeDays: 7 to the agent. The default is 0, or the file's ripedeps entry. By default the output file gets a ripedeps entry with the settings used; pass skipAdoptConfig: true to avoid that.

What the tool returns

Three parts, so any client can use what it understands best:

1. structuredContent: the full plan, the same JSON as the API response (diff, new file, packages, warnings, notes, meta).
2. A text summary with one line per upgraded, held or skipped package, each with its explanation, then the notes and warnings. For files with more than 50 such packages the rest is left to structuredContent.
3. The diff as text, ready for patch -p1.

The real text summary for a file with next and react (7-day gate, minor steps):

Ripedeps plan: 1 to upgrade, 2 held back, 0 current.
next ^15.0.0 -> ^15.5.28: `next` 15.0.0 -> 15.5.28 (minor step, 9 days old, age gate 7); newest version that qualifies; not taken: `next@16.4.3` is a major step from 15.0.0, above the allowed minor level
`react` held at 18.3.1; not taken: `react@19.3.1` is a major step from 18.3.1, above the allowed minor level
`react-dom` held at 18.3.1; not taken: `react-dom@19.3.1` is a major step from 18.3.1, above the allowed minor level
Note: The `ripedeps` entry was added (minAgeDays 7, maxBump minor) so later runs use the same limits

--- a/package.json+++ b/package.json@@ -1,8 +1,12 @@ {
   "name": "web",
   "dependencies": {
-    "next": "^15.0.0",+    "next": "^15.5.28",     "react": "^18.3.1",
     "react-dom": "^18.3.1"
+  },+  "ripedeps": {+    "minAgeDays": 7,+    "maxBump": "minor"   }
 }

The Note: line tells the agent that the ripedeps entry was added to the file. Warning: lines carry unavoidable constraint conflicts with a hint of what would resolve them.

Progress and timeouts

When the client sends a progress token, the server reports progress while it loads package data. A plan that takes longer than 60 seconds ends as an error result with a retry hint; call the tool again, the data loaded so far is cached.

A typical session

The division of labour is the point: Ripedeps decides which versions, the agent does the work, you review. The tool output in the transcript is real (see above); the words of the agent are illustrative.

You     Bring the dependencies of this repo up to date. Keep new releases out
        for a week, and no major upgrades.

Agent   [calls plan_upgrade { packageJson: "<package.json>", minAgeDays: 7 }]

Ripedeps Ripedeps plan: 1 to upgrade, 2 held back, 0 current.
        ...one explanation per package, see above...

Agent   Ripedeps proposes next ^15.0.0 -> ^15.5.28. It leaves react and
        react-dom at 18.3.1 because 19 would be a major step. Applying
        the diff, then running npm install and the tests.
        [runs: patch -p1, npm install, npm test]

Agent   Done: tests pass. next 15.0.0 -> 15.5.28 (9 days old, newest version
        that qualifies). react 19 is available if you want a major upgrade;
        I can plan that next.

Use cases and prompts

Tell the agent which package needs attention and it sends a focus: the plan, the diff and the explanations then cover just that package and the neighbours it needs, instead of a full upgrade.

Teach your agent

Put the rules in the instructions file your assistant reads, for example CLAUDE.md or AGENTS.md, so every session upgrades dependencies the same way:

## Dependency upgrades

- Use the ripedeps MCP tool `plan_upgrade` to decide versions; do not pick versions yourself.
- Pass the file text as `packageJson` with `minAgeDays: 7`. Keep `maxBump` at `minor` unless I ask for a major upgrade.
- Apply the returned diff (`patch -p1`), then run `npm install` and the test suite.
- Report the `explanation` of every upgraded or held package and any `Note:` and `Warning:` lines. Do not commit unless I ask.

Agents that read llms.txt find the same rules, the parameters and the connection details in one always-current file: /llms.txt.

Details

• Endpoint: https://mcp.ripedeps.com/mcp. Only POST is supported; GET and DELETE answer 405 because the server is stateless and keeps no sessions.
• Limits: the same as the API: 256 KB, 300 dependencies, 50 focus entries. Requests are rate limited to about 30 per minute.
• Errors: reported as an error result with the code and message, for example invalid_request or no_processable_dependency. The codes are listed on the API page.
• Deterministic: the same input and registry data give the same plan and the same sentences. No model runs inside Ripedeps.

Prefer a terminal? See the command line. Building your own automation? See the REST API.