BumpGuard

Guard your dependency bumps.BumpGuard is aModel Context Protocol(MCP) server that tells your AI coding agentexactly which lines ofyourcode breakwhen you upgrade a dependency — and verifies AI‑written code against the API that isactually installed, so it stops calling functions that don't exist.

// check_upgrade(package="pydantic", to_version="2.0.3", from_version="1.10.13", code="...") { "safe_to_upgrade": false, "summary": { "breaking": 1, "total_api_changes": 4919, "breaking_api_changes": 2015 }, "findings": [ { "symbol": "pydantic.BaseSettings", "line": 2, "severity": "breaking", "message": "You use 'pydantic.BaseSettings', which no longer exists in the target version...", "suggestion": "Consider 'pydantic.v1.env_settings.BaseSettings'" } ] }

Out of2,015breaking API changes, BumpGuard surfaced theonethat affects this code — with the line number and a fix hint.

Every answer is grounded in evidence (installed version, source location). Because analysis is static,"no findings" means "nothing proven to break," not a guarantee— BumpGuard is explicit about that in its output.

Requires Python 3.10+. The server speaks MCP over stdio.

Install BumpGuard into thesame environment as the project you're working on, so it sees the packages you actually have installed.

Claude Desktop / Claude Code(claude_desktop_config.json):

{ "mcpServers": { "bumpguard": { "command": "bumpguard-mcp" } } }

Cursor / Windsurf / VS Code (Copilot)— point your MCP config at thebumpguard-mcpcommand (orpython -m bumpguard.server). Any MCP‑compatible client works.

- "Before upgrading pandas to 2.2, check whether my data pipeline breaks."
- "Verify this snippet actually uses the installed OpenAI SDK."
- "List the real methods onhttpx.Client."

┌──────────────── language‑neutral core ────────────────┐ MCP tools → │ diff engine · breaking‑change classifier · analyzer │ │ (matches API changes against YOUR usage) │ └───────────────────────┬──────────────────────────────┘ │ Provider interface ┌───────────────────────┴──────────────────────────────┐ │ Python provider │ .NET (NuGet) │ Java (Maven) │ │ • AST surface │ • DLL metadata │ • jar bytecode │ │ • usage scanner │ • Roslyn scan │ • source scan │ │ • wheel fetch │ • nupkg fetch │ • jar fetch │ └──────────────────────────────────────────────────────┘

- Extracta package's public API surface by parsing its source with Python'sast— for the installed version, and for the target version (downloaded as a wheel and unpacked,never installed or executed).
- Diffthe two surfaces into removed / signature‑changed / added symbols, and classify each as breaking, potentially breaking, or info.
- Scanyour code (also viaast) for usages — resolving import aliases, re‑exports, instance‑method calls, and the keyword/positional arguments each call passes.
- Matchusages against changes and report a precise, per‑line verdict.

Safety:BumpGuard never imports third‑party code, so there are no import side effects, no hangs from heavy packages, and no arbitrary code execution. Wheel downloads are sandboxed to a temp dir, time‑bounded, and guarded against path traversal / zip bombs.

BumpGuard is built around apluggable provider interface. The diff engine, breaking‑change classifier, analyzer, reporting, and MCP tools are all language‑neutral; only thesurface extractionandusage scanningare ecosystem‑specific.

- ✅Python (PyPI)— available now.
- ✅.NET (NuGet)— available now. Reads public API from assembly metadata via reflection-only loading (no code executed); needs the.NET SDK(dotnet) on PATH. A small helper is built once on first use.
- ✅Java (Maven)— available now. Reads public API directly from compiled.jarbytecode (constant pool, access flags, descriptors) inpure Python—no JDK or Maven requiredand no third‑party code is executed.
- 🔜JS/TS (npm)— parse.d.tsdeclarations.

Adding an ecosystem means implementing oneProvider— seedocs/ADD_A_PROVIDER.md.

git clone https://github.com/appcreationsca/bumpguard-mcp cd bumpguard-mcp python -m venv .venv && . .venv/Scripts/activate # Windows pip install -e ".[dev]" pytest

The test suite (42 tests) runs offline using fixture packages — no network required.

Releases are automated via GitHub Actions. To cut a release:
- Bump the version inpyproject.tomlandsrc/bumpguard/__init__.py.
- Move theCHANGELOG.md"Unreleased" notes under a new version heading.
- Commit, then tag and push:

TheReleaseworkflow runs the tests, builds the wheel + sdist, and publishes to PyPI viaTrusted Publishing(OIDC — no stored tokens). TheCIworkflow runs the test matrix (Linux + Windows, Python 3.10/3.13) on every push and PR.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

Skene is a codebase analysis toolkit for product-led growth. It scan your codebase, detect growth opportunities, and generate actionable implementation plans.

Provides seamless integration with SonarQube Server or Cloud, and enables analysis of code snippets directly within the agent context

AI-to-AI code review platform — Claude, Codex, and Gemini cross-check each other via MCP, REST API, and CLI for consensus-based results.

A stateful LSP runtime for AI agents: warm language server sessions with 50+ tools for go-to-definition, find-references, diagnostics, rename, and more across 30+ languages.

Persistent code index using Tree-sitter for fast, precise code search. Replaces grep with ~50 token responses instead of 2000+.

AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.

Orchestrates a dual-AI engineering loop where a Primary AI plans and implements, while a Review AI validates and reviews, with continuous feedback for optimal code quality. Supports custom AI pairing (Claude, Codex, Gemini, etc.)

AmazingMCP — MCP Server for .NET / C# Codebases

An MCP server that gives AI agents deep understanding of C# codebases via Roslyn — type search, dependency graphs, usage analysis, and architecture overviews, all from a live in-memory compilation.