BumpGuard

Guard your dependency bumps. BumpGuard is a Model Context Protocol (MCP) server that tells your AI coding agent exactly which lines of your code break when you upgrade a dependency — and verifies AI‑written code against the API that is actually installed, so it stops calling functions that don't exist.

It does this by static analysis only. BumpGuard never imports or executes third‑party code; it reads a package's real public API straight from its source.

Docs tell your agent what should exist. BumpGuard tells it what actually exists here.

Why this exists

The #1 frustration developers report with AI coding tools is code that's "almost right, but not quite." A huge slice of that is API drift and hallucination:

• The model writes pydantic.BaseSettings or openai.ChatCompletion.create(...) — perfectly valid two versions ago, gone in the version you have installed.
• You bump pandas from 1.5 to 2.2 and discover the breakage one stack trace at a time.
• A changelog lists 1,800 breaking changes; you only care about the three your code actually touches.

BumpGuard closes that gap with ground truth from your environment instead of the model's memory.

What it does

A real example — upgrading pydantic 1 → 2 in code that uses BaseSettings:

// check_upgrade(package="pydantic", to_version="2.0.3", from_version="1.10.13", code="...")
{
  "safe_to_upgrade": false,
  "summary": { "breaking": 1, "total_api_changes": 4919, "breaking_api_changes": 2015 },
  "findings": [
    {
      "symbol": "pydantic.BaseSettings",
      "line": 2,
      "severity": "breaking",
      "message": "You use 'pydantic.BaseSettings', which no longer exists in the target version...",
      "suggestion": "Consider 'pydantic.v1.env_settings.BaseSettings'"
    }
  ]
}

Out of 2,015 breaking API changes, BumpGuard surfaced the one that affects this code — with the line number and a fix hint.

Tools

Every answer is grounded in evidence (installed version, source location). Because analysis is static, "no findings" means "nothing proven to break," not a guarantee — BumpGuard is explicit about that in its output.

Install

pip install bumpguard-mcp

Requires Python 3.10+. The server speaks MCP over stdio.

Install BumpGuard into the same environment as the project you're working on, so it sees the packages you actually have insta

... View full README on GitHub