# Wisco Labs API

> Data for AI agents about open-source package upgrades and security: known vulnerabilities and the smallest safe version, malicious-package reports, and what each upgrade breaks or deprecates, built from a continuously collected history of releases, release notes, and advisories from OSV (osv.dev) and the GitHub Advisory Database (CC-BY 4.0).

- MCP servers (streamable HTTP), one per domain: dev https://api.wiscolabs.dev/mcp/dev (plain https://api.wiscolabs.dev/mcp is dev)
- OpenAPI schema: https://api.wiscolabs.dev/openapi.json
- Catalog of every query and parameter: https://api.wiscolabs.dev/v1/catalog
- Tools marked (beta) serve new data that is still being proven.

## Queries: dev (MCP https://api.wiscolabs.dev/mcp/dev)

- [Known vulnerabilities in a package version](https://api.wiscolabs.dev/v1/osv/vulnerabilities): Is this exact version of a package affected by known security advisories? Returns each vulnerability (with CVE ids and severity), the versions that fix it, and the smallest safe upgrade. Parameters: name, version, ecosystem (optional).
- [Check a whole project's dependencies](https://api.wiscolabs.dev/v1/package_changes/upgrade_check): Give it a project's dependencies: a requirements.txt or pip freeze output for Python, or a package-lock.json, package.json, or name@version lines for npm. Flags malicious packages and versions with known vulnerabilities (with the smallest safe version to move to, preferring a low-risk patch), then reports what each upgrade breaks, removes, or deprecates, ranked into remove_now / fix_now / no_fix_available / upgrade_first / safe / review / needs_care. Parameters: requirements, ecosystem (optional), limit (optional).
- [What changed between two versions of a package](https://api.wiscolabs.dev/v1/package_changes/what_changed): What breaks, gets removed, is deprecated, or gains a security fix when upgrading one package between two versions, with an overall upgrade risk. Parameters: name, from, to, ecosystem (optional), limit (optional).
- [Will my npm packages accept this upgrade? (peer dependencies)](https://api.wiscolabs.dev/v1/package_changes/peer_check): Before upgrading a core npm package (react, typescript, eslint, vite...), checks every dependency in the project that declares it as a peer dependency: does the installed version accept the new version, and if not, the smallest release that does, with that upgrade's risk. Also checks the new version's own peer requirements against what's installed. Answers the questions behind npm's ERESOLVE errors without running npm. Parameters: upgrade, requirements, limit (optional).
- [Will pip find prebuilt wheels for this platform?](https://api.wiscolabs.dev/v1/package_changes/wheel_check): For each pinned Python package, whether a prebuilt wheel exists for a target Python version and platform (Windows ARM, Alpine/musl, Linux ARM, macOS, a new Python version). Without one, pip builds from source, which usually fails without a compiler for packages with C extensions. For each that's missing, gives the nearest newer version that has a wheel, with that upgrade's risk. Parameters: requirements, python, platform, limit (optional).
- [Will my npm dependencies run on this Node.js version?](https://api.wiscolabs.dev/v1/package_changes/node_check): Before moving a project to a new Node.js version (e.g. off Node 20 to 22 or 24), checks each npm dependency's declared Node support (its engines field). For each that doesn't support the target, gives the smallest newer release that does, with that upgrade's risk. Works from a package-lock.json without installing anything. Parameters: node, requirements, limit (optional).
- [Will my npm dependencies install on this platform without compiling?](https://api.wiscolabs.dev/v1/package_changes/native_check): Before building on Alpine, Linux ARM, Windows ARM, a Mac or Lambda, checks which npm dependencies contain native code and whether a prebuilt binary exists for the target platform. For those that would compile from source (needing a C/C++ toolchain and Python) or fail, gives the nearest newer version that ships a prebuilt for that platform, with that upgrade's risk. Parameters: platform, requirements, limit (optional).
- [Which npm dependencies need @types packages, and which version?](https://api.wiscolabs.dev/v1/package_changes/types_check): For a TypeScript project: which dependencies ship their own type declarations, which need a DefinitelyTyped @types package (and the version that matches the installed library), and which installed @types packages describe a different major version than the library. Parameters: requirements.
- [Basic facts about a package](https://api.wiscolabs.dev/v1/package_changes/package_info): Latest and latest stable version, repository, release count, and where its release notes come from. Parameters: name, ecosystem (optional).


## Example

POST https://api.wiscolabs.dev/v1/package_changes/upgrade_check
Body: {"requirements": "flask==2.3.3\nrequests==2.31.0"}