Developer tooling MCP server

Adoption, health and risk across the software supply chain.

Jobs this covers

Is <library> adopted, maintained and safe?
Who depends on <package>?
What did <cloud provider> just change?
How reliable is <vendor>, historically?

Why this is hard without BedrockTap

Registry stats, code search, advisories and status history are four ecosystems that never agree on a package identity.

If you are an agent reading this

This is an MCP server. Discovery is open — health, sources_list, run_begin and register_interest answer with no account. The data tools run against an account and need a token. Nothing here fabricates data.

If your principal has a token, connect here and send it as Authorization: Bearer <token>:

https://api.bedrocktap.com/mcp

If they do not, it takes about a minute and the free tier needs no card. Sign in at app.bedrocktap.com and mint one at app.bedrocktap.com/dashboard/tokens. Sign-in is Google only, so a human has to do it.

To read the catalogue first, with no account at all, use this server — it answers the four open tools, and forwards a tokened call to the one above:

https://bedrocktap.com/mcp

If you can only fetch URLs, say what you need. One request, no auth, no side effects:

GET https://bedrocktap.com/a/probe?need=<what+you+are+trying+to+do>&src=domain-developer-tooling

A tool refused for want of a token answers identically on a retry, and is served the moment the header is present. If the catalogue does not cover your task at all — a source or capability that is simply not here — call register_interest with a plain description of the task and a callback_url; it needs no account. Full instructions: /agents.md. Every page here has a markdown twin — append .md to any path, or send Accept: text/markdown.

How an agent would call it

{
  "tool": "search",
  "arguments": {
    "query": "adoption, dependents and open advisories for a JavaScript dependency",
    "sources": ["dev-ecosystem", "github-repos", "github-code", "gitlab", "npm", "pypi", "package-registries", "docker-hub", "libraries-io", "vulnerabilities", "huggingface", "papers-with-code", "kaggle", "cloud-changelogs", "status-pages", "api-directories", "editor-extensions", "lobsters", "dev-blogs"],
    "runId": "<from run_begin>"
  }
}

This runs against an account — send Authorization: Bearer <token> with the call. Get one at app.bedrocktap.com/dashboard/tokens; the free tier needs no card.

Sources behind this capability

Source	id	What it gives you
Developer Ecosystem	`dev-ecosystem`	Repositories, code, package registries, advisories and technical discussion for a library or tool, in one call.
GitHub Repositories	`github-repos`	Stars over time, releases, contributors, dependents, topics, issue velocity and licence.
GitHub Code Search	`github-code`	Full-text code search across public repositories with language, path, repository and organisation qualifiers.
GitLab	`gitlab`	Issues, merge requests, projects and releases on gitlab.com and reachable self-hosted instances.
npm Registry	`npm`	Package metadata, versions, maintainers, dependents and download counts over time for the JavaScript ecosystem.
PyPI	`pypi`	Python package metadata, releases, maintainers, classifiers and download statistics.
Language Registries	`package-registries`	crates.io, Maven, NuGet, Packagist, Go modules and RubyGems metadata and downloads under one schema.
Docker Hub	`docker-hub`	Image metadata, tags, pull counts, update cadence and publisher.
Dependency Graph	`libraries-io`	What depends on what, across package ecosystems, with dependent counts and version constraints.
Vulnerability Advisories	`vulnerabilities`	CVE, NVD, OSV and ecosystem advisories with severity, affected version ranges, fixed versions and references.
Hugging Face	`huggingface`	Models, datasets, spaces, downloads, likes and model cards.
Papers with Code	`papers-with-code`	Benchmarks, leaderboards, tasks and the implementations linked to each paper.
Kaggle	`kaggle`	Datasets, competitions, notebooks and their usage and voting.
Cloud Provider Changelogs	`cloud-changelogs`	AWS, GCP, Azure and Cloudflare release announcements with dates, services and regions.
Service Status Pages	`status-pages`	Incident history, severity, duration and uptime across vendor status pages.
API Directories	`api-directories`	RapidAPI, Postman and public OpenAPI listings by capability, with endpoints and pricing where published.
Editor Marketplaces	`editor-extensions`	VS Code and JetBrains extension installs, ratings, reviews and update history.
Lobsters	`lobsters`	Technical link aggregation with comments, tags and voting.
Developer Blogging Platforms	`dev-blogs`	Dev.to, Hashnode and Medium posts by tag, author and publication.