Verifies FastAPI code against the project's resolved dependency version, detecting deprecated patterns such as lifespan handlers and Pydantic v2 schema usage with authoritative evidence.
Detects deprecated Pydantic v1 APIs and provides version-correct replacements such as model_dump, model_validate, ConfigDict, and field/model validators based on the project's actual Pydantic version.
Audits SQLAlchemy usage against the resolved version, promoting 2.0-style queries, DeclarativeBase, mapped_column, and session.execute(select(...)) while flagging incompatible or deprecated patterns.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@FreshStack MCP Audit our codebase for deprecated Pydantic v1 APIs."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Evidence-backed technology intelligence layer for AI coding agents.
Prevents AI coding assistants from generating outdated, deprecated, or version-incompatible code.
AI coding assistants frequently generate code using outdated syntax, deprecated methods, or incompatible library versions because their parametric memory lacks real-time awareness of:
The project's actual, resolved dependency versions in lockfiles.
Official deprecation cycles and migration guides (e.g., Pydantic v1 vs. v2, SQLAlchemy 1.4 vs. 2.0, FastAPI lifespan vs. @app.on_event).
Exact version compatibility boundaries.
Related MCP server: Dependency Freshness MCP Server
FreshStack does NOT guess or decide what is "modern" from parametric memory.
It verifies technology information strictly against authoritative sources according to an explicit hierarchy:
Actual project state and resolved dependency versions (uv.lock, pinned requirements.txt, pyproject.toml)
Official version-specific documentation
Official migration guides
Official changelogs
Official package registry metadata (PyPI)
Other authoritative sources
LLM knowledge only when no stronger evidence exists
The Golden Rule: The project's resolved dependency version has absolute priority over the latest available package version. If a project is pinned to FastAPI
0.115.x, FreshStack never blindly enforces documentation from an incompatible newer release.
uv.lock
pyproject.toml (PEP 621 & Poetry)
requirements.txt
FastAPI (Lifespan handlers, Pydantic v2 schemas)
Pydantic (model_dump, model_validate, model_config = ConfigDict, @field_validator, @model_validator)
SQLAlchemy (2.0 style queries, DeclarativeBase, mapped_column, session.execute(select(...)))
Alembic (1.12+ connection context migrations)
freshstack-mcp/
├── freshstack/
│ ├── __init__.py # Package entry and version
│ ├── config.py # Environment variables, logging, cache path configuration
│ ├── models.py # Pydantic v2 schemas (StackInfo, EvidenceSource, AuditViolation)
│ ├── cache.py # Local SQLite database abstraction with TTL
│ ├── inspect.py # Stack inspection (uv.lock, pyproject.toml, requirements.txt)
│ ├── pypi.py # PyPI registry metadata client with local caching
│ ├── knowledge.py # Authoritative version rules & official documentation citations
│ ├── resolve.py # Constraint resolution pipeline (VERIFIED, INFERRED, UNKNOWN)
│ ├── audit.py # Deterministic AST static analysis and violation detection
│ └── server.py # FastMCP / MCPServer stdio transport server
├── tests/
│ ├── fixtures/ # Sample lockfiles and manifests (uv.lock, pyproject.toml, requirements.txt)
│ ├── test_inspect.py # Stack inspection unit tests
│ ├── test_cache.py # SQLite cache and TTL tests
│ ├── test_resolve.py # Constraint resolution and priority tests
│ ├── test_audit.py # Deterministic AST audit tests
│ └── test_server.py # MCP server tool execution tests
├── pyproject.toml # Modern PEP 621 configuration (uv-compatible)
├── CONTRIBUTING.md # Development and contribution standards
├── LICENSE # MIT License
├── .env.example # Configuration templates
└── .gitignore # Clean source control patternsinspect_stack(project_dir: str = ".") -> strDetects project metadata, Python version, package manager (uv, poetry, pip), and exact resolved versions for all supported libraries.
Example Response:
{
"project_name": "sample-service",
"python_version": ">=3.10",
"package_manager": "uv",
"detected_files": ["uv.lock", "pyproject.toml"],
"supported_libraries": {
"fastapi": "0.115.0",
"pydantic": "2.9.2",
"sqlalchemy": "2.0.35",
"alembic": "1.13.3"
}
}resolve_constraints(task_description: str, libraries: list = None, project_dir: str = ".") -> strGiven a developer task and target libraries, determines active version constraints, deprecated APIs, recommended replacements, and authoritative evidence citations.
Example Output (excerpt):
{
"confidence": "VERIFIED",
"deprecated_patterns": [
{
"name": "BaseModel.dict()",
"status": "deprecated",
"reason": ".dict() is deprecated in Pydantic v2. Use .model_dump() instead.",
"replacement": "model.model_dump(mode='python')",
"evidence": {
"source_type": "migration_guide",
"title": "Pydantic V2 Migration Guide - Model Methods",
"url": "https://docs.pydantic.dev/latest/migration/#changes-to-pydanticbasemodel"
}
}
]
}freshness_audit(code: str, project_dir: str = ".") -> strAnalyzes generated or developer-written Python code using deterministic static AST analysis. Pinpoints exact line numbers, columns, severity, rationale, and authoritative evidence for deprecated or incompatible APIs.
FreshStack is designed with privacy as a foundational requirement:
Local AST Analysis: Code parsing occurs on the local machine via Python's ast module.
No Secret Transmission: API keys, passwords, environment variables, and unrelated codebase files are never transmitted externally.
Offline Capable: Operates seamlessly in offline environments using the local SQLite evidence cache.
Clone the repository and install with uv:
git clone https://github.com/freshstack/freshstack-mcp.git
cd freshstack-mcp
# Create virtual environment and install
uv venv .venv
uv pip install -e ".[dev]"Start the server using stdio transport:
uv run freshstackOr run via Python directly:
python -m freshstack.serverAdd FreshStack to your claude_desktop_config.json:
{
"mcpServers": {
"freshstack": {
"command": "uv",
"args": [
"--directory",
"/path/to/freshstack-mcp",
"run",
"freshstack"
]
}
}
}Execute the complete test suite:
uv run pytest -vAnalyze Python code to detect deprecated APIs, version mismatches, and outdated patterns.
Uses deterministic static AST analysis grounded in authoritative documentation.
Args: code: Python source code snippet or module to audit. project_dir: Root directory of the Python project to ground version context against.
Returns: JSON string containing FreshnessAuditReport with detected violations, severity, and replacements.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| project_dir | No | . |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the analysis method (static AST, deterministic), implies read-only behavior, and describes the return format (JSON string with violations, severity, replacements). This is solid transparency for an analysis tool, though it could mention limitations or prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a front-loaded purpose sentence, a methodological note, then Args and Returns sections. Every sentence earns its place with no redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters and an output schema, the description covers purpose, method, parameter semantics, and return value. It is nearly complete, but could add a note about what makes documentation 'authoritative' or any system prerequisites. Overall, an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It fully explains both parameters: 'code' is the Python source snippet or module to audit, and 'project_dir' is the root directory for grounding version context. This adds meaning beyond the schema's bare property titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Analyze Python code to detect deprecated APIs, version mismatches, and outdated patterns.' This clearly distinguishes it from siblings like inspect_stack and resolve_constraints, which address different concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on what the tool does and its approach ('deterministic static AST analysis grounded in authoritative documentation'), implying when it should be used for freshness auditing. However, it does not explicitly name alternatives or state when not to use it, so it falls short of the highest bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Detect Python version, package manager, resolved dependencies, and supported libraries.
Args: project_dir: Root directory of the Python project to inspect (defaults to current directory).
Returns: JSON string containing StackInfo with resolved versions and evidence sources.
| Name | Required | Description | Default |
|---|---|---|---|
| project_dir | No | . |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does disclose that the result is a JSON string containing StackInfo with resolved versions and evidence sources, and notes the default project directory. It does not mention failure modes, read-only guarantees, or whether inspection is limited to local files, but it is adequate for a clearly inspection-oriented tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured with a single verb-first sentence followed by Args and Returns sections. Every line earns its place and there is no redundant prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and an output schema, the description covers the input semantics, default behavior, and return shape. It is largely complete; the only gap is that it does not clarify when to use this tool over its dependency-focused siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no property descriptions (0% coverage), but the Args section fully compensates: project_dir is defined as the root directory of the Python project to inspect and defaults to the current directory. This is exactly the semantic meaning an agent needs beyond the raw type and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific action—detect—and the exact subject: Python version, package manager, resolved dependencies, and supported libraries. This is clear about what the tool does, but it does not explicitly differentiate it from the sibling tools resolve_constraints and freshness_audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use inspect_stack instead of resolve_constraints or freshness_audit. The description explains what the tool does but not the conditions or prerequisites that would select this tool over its alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Determine exact project dependency versions and retrieve authoritative version-specific constraints.
Identifies version-specific APIs, deprecated/forbidden patterns, recommended patterns, and authoritative evidence sources (documentation URLs, changelogs).
Args: task_description: Description of the coding task or feature to implement. libraries: Optional list or mapping of specific libraries to inspect (e.g. ['fastapi', 'pydantic']). project_dir: Root directory of the Python project (defaults to current directory).
Returns: JSON string containing ResolvedConstraints with verified rules and evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| libraries | No | ||
| project_dir | No | . | |
| task_description | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It transparently states what the tool determines, identifies, and returns, including the JSON response shape. It does not explicitly say whether it is read-only or may make network calls, but the verbs 'determine' and 'retrieve' strongly imply a non-mutating analysis operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a summary paragraph, an Args section, and a Returns section. Every sentence contributes meaningful information without redundancy or padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with no annotations, the description is mostly complete: it covers purpose, parameters, and return type. It could further strengthen sibling differentiation and clarify expected behavior with external resources, but the core invocation context is sufficiently specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully compensate. It does: task_description is explained as the coding task description, libraries as an optional list or mapping with an example, and project_dir as the Python project root with a default. This adds meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Determine exact project dependency versions and retrieve authoritative version-specific constraints.' It also enumerates concrete outputs (APIs, deprecated/forbidden patterns, evidence sources), which clearly distinguishes it from siblings like inspect_stack and freshness_audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives practical usage context: it takes a task description, allows optional library filtering, and targets a Python project directory. It does not explicitly name alternatives or exclusion criteria, but the purpose is clear enough for an agent to infer when this tool applies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.0.0freshness_auditinspect_stackresolve_constraintsEach tool has a clearly distinct role: one inspects the environment, one resolves authoritative constraints for a task, and one audits existing code. The only conceptual overlap (deprecated patterns in resolve_constraints and freshness_audit) is separated by input type and purpose.
inspect_stack and resolve_constraints follow a clear verb_noun pattern, but freshness_audit uses a noun_noun form and breaks the convention. The overall set is still readable and predictable.
Three tools is well-scoped for a focused analysis and guidance server, covering environment discovery, constraint resolution, and code audit without redundancy. Each tool earns its place.
The workflow is complete for its apparent domain: inspect the stack, resolve version-specific rules, then audit code against them. No dead ends remain because the audit returns violations and replacements; a remediation/write tool would be outside this server's stated analysis scope.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Open-source licence risk checks for AI coding agents and dependency trees.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Evidence-backed architecture-quality analysis for Python agent applications.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Jayesh01323/freshstack-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server