Developer Tools

minimal.dev

Provides tools for searching, inspecting, and analyzing software packages, including security advisories and dependencies.

1 endpoint8 known toolsFirst detected July 29, 2026Last detected July 29, 2026

ENDPOINT 1

https://minimal.dev/api/mcp

No auth detected

MCP server metadata

Name: minimal-pkgs
Version: 4.0.0

Capabilities

tools.listChanged

Server instructions

Read-only access to the minimal.dev package catalog (the gominimal/pkgs repository): package metadata, versions, security advisories, dependency graphs, SBOMs, OpenSSF scorecards, and catalog history. Every snapshot is anchored at a commit sha; tools float with the latest commit unless you pass a `sha` (get a sha from list_catalog_commits). Snapshot identity: JSON results carry `schemaVersion` and `commitSha`; search_packages, get_package, and get_advisories additionally carry `pushedAt`. get_sbom returns the raw CycloneDX/SPDX document, whose own metadata carries the snapshot identity. The full REST surface (including bulk and diff endpoints) is described at https://minimal.dev/api/pkgs/openapi.json.

Known tools 8

search_packages

Find catalog packages by name/topic text, category, and/or minimum advisory severity.

Inferred read-only

get_package

Full record for one package — description, version, dependencies, direct advisories, OpenSSF scorecard, and links.

Inferred read-only

get_package_versions

Version-history timeline for a package (newest first), each entry with its commit sha, version, and file/line diff stats.

Inferred read-only

get_advisories

Security advisories affecting a package: its direct advisories plus (by default) advisories inherited through its transitive runtime dependencies.

Inferred read-only

get_dependencies

The package's DIRECT build + runtime dependencies, each enriched with version, license, and active-advisory rollup as of the snapshot.

Inferred read-only

get_sbom

Software bill of materials for a package — the transitive build + runtime closure and a vulnerabilities block.

Inferred read-only

list_catalog_commits

Recent commits on gominimal/pkgs:main (newest first) with their subjects.

Inferred read-only

diff_catalog

What changed in the catalog FROM `base` (older commit) TO `sha` (newer commit): packages added/removed, version upgrades, and advisory deltas.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.minimal-pkgs]
url = "https://minimal.dev/api/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "minimal-pkgs": {
      "type": "http",
      "url": "https://minimal.dev/api/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: minimal-pkgs
Remote MCP URL: https://minimal.dev/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "minimal-pkgs": {
      "url": "https://minimal.dev/api/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "minimal-pkgs": {
      "type": "http",
      "url": "https://minimal.dev/api/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "minimal-pkgs",
  "transport": "streamable-http",
  "url": "https://minimal.dev/api/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.