PA
Search

Pacman MCP Server for Package Indexing

Query package indexes with the Pacman MCP server to search and retrieve package info from PyPI, npm, crates.io, Docker Hub and Terraform Registry.

View on GitHub
Quick Install
npx -y @oborchers/mcp-server-pacman

Overview

The Pacman MCP Server provides a standardized, machine-friendly HTTP API for searching and fetching metadata from multiple package registries. It implements the Model Context Protocol (MCP) “tool” pattern so LLMs and automation agents can query package indexes (PyPI, npm, crates.io, Docker Hub, and the Terraform Registry) as structured tools instead of scraping web pages. This makes it easy to integrate package lookups into chat assistants, CI pipelines, or SBOM and dependency-analysis workflows.

By exposing a consistent interface across heterogeneous registries, Pacman reduces the friction of building multi-ecosystem tooling. Instead of writing custom scrapers or SDK calls for each index, you call the corresponding MCP tool for a registry to run searches and obtain package metadata such as versions, descriptions, repository links, and license information.

Features

  • Unified search across multiple package registries: PyPI, npm, crates.io, Docker Hub, Terraform Registry
  • Per-registry MCP tools that expose search and metadata retrieval operations
  • Normalized JSON output for package name, latest version, description, homepage/repo, license
  • Lightweight server intended for local or container deployment
  • Designed to be consumed by LLM agents and automation tooling via the Model Context Protocol

Installation / Configuration

Clone the repository and run locally or run with Docker. Adjust environment variables to enable/disable registries or set the listen port.

Clone and run locally (example):

git clone https://github.com/oborchers/mcp-server-pacman.git
cd mcp-server-pacman
# create a virtualenv
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# run the server (example uses uvicorn; exact module name may vary)
uvicorn mcp_pacman.server:app --host 0.0.0.0 --port 8080

Run with Docker (example):

docker build -t mcp-pacman .
docker run -p 8080:8080 \
  -e PORT=8080 \
  -e ENABLE_PYPI=true \
  -e ENABLE_NPM=true \
  mcp-pacman

Example environment variables:

  • PORT — HTTP port to listen on (default: 8080)
  • ENABLE_PYPI, ENABLE_NPM, ENABLE_CRATES, ENABLE_DOCKER, ENABLE_TERRAFORM — enable or disable specific backends
  • DOCKER_HUB_USERNAME / DOCKER_HUB_PASSWORD — optional credentials for Docker Hub if private rate limits or auth are required

Configuration file (optional YAML example):

server:
  host: 0.0.0.0
  port: 8080

backends:
  pypi: true
  npm: true
  crates: true
  dockerhub: true
  terraform: true

dockerhub:
  username: ""
  password: ""

Available Tools / Resources

The server exposes one MCP-style tool per registry. Each tool supports two primary operations: search and get (fetch package metadata). The exact tool IDs and endpoints depend on the server implementation, but logical mappings are:

Tool IDRegistrySupported actions
pacman-pypiPyPIsearch, get
pacman-npmnpmsearch, get
pacman-cratescrates.iosearch, get
pacman-dockerDocker Hubsearch, get (image tags)
pacman-terraformTerraform Registrysearch, get

Typical returned metadata fields (normalized):

  • name
  • version (or tag)
  • summary/description
  • homepage / repository_url
  • license
  • available_versions (list)
  • raw_metadata_url

Note: This server is optimized for metadata retrieval and search; it does not host package artifacts.

Use Cases

  1. Quick package lookup from an LLM assistant

    • Query: “Find the latest pika package on PyPI and show its homepage and license.”
    • The assistant invokes the pacman-pypi tool’s search action, then calls get for the top result to extract homepage and license.

  2. Dependency upgrade suggestions in CI

    • Pipeline step queries npm and crates tools to detect newer minor/patch versions for dependencies listed in a manifest and emits upgrade PRs.

  3. SBOM enrichment and vulnerability triage

    • Use the server to resolve package metadata (homepage, repo URL, license) when building an SBOM. Feed repo URLs to vulnerability scanners.

  4. Cross-ecosystem package discovery

    • When migrating or porting code, search for packages across ecosystems (npm vs PyPI vs crates) by keywords to find comparable libraries.

Concrete curl examples

Search PyPI:

curl -X POST "http://localhost:8080/tools/pacman-pypi/search" \
  -H "Content-Type: application/json" \
  -d '{"query": "requests", "limit": 5}'

Get package metadata:

curl -X POST "http://localhost:8080/tools/pacman-npm/get" \
  -H "Content-Type: application/json" \
  -d '{"name": "express"}'

Example response (normalized JSON):

{
  "name": "express",
  "version": "4.18.2",
  "description": "Fast, unopinionated, minimalist web framework",
  "repository_url": "https://github.com/expressjs/express",
  "license": "MIT",
  "available_versions": ["4.18.0", "4.18.1",
Tags:search