Package Facts Helps Coding Agents Avoid Outdated, Deprecated and Vulnerable Packages
When you ask an AI to help with code, it often has to pick packages, which are ready-made building blocks such as React or pandas that other people publish for anyone to use. Many packages release new versions every few weeks. An AI model learns from text gathered up to a certain date, so it often suggests a version from memory that is months or years out of date. An old version can be deprecated by its makers or have known security problems, and fixing that later costs time.
The current facts live in public lists called registries: npm for JavaScript and PyPI for Python. Security alerts live in separate public databases. To check a package properly, an AI has to gather facts from several of these sources.
Our tool, Package Facts, does that work in one call. It returns the current checked version, known security alerts for your version, and the major versions on the way to the latest one. We tested it on 6 real packages, and every fact we checked matched the registries and the public advisory lists. It costs about 2 cents (20 sats) per call.
What does Package Facts tell your AI?
You give it a link to a package on npm or PyPI, or you give it the ecosystem, the package name and the version you use today. It returns these facts:
- The latest version and the date it came out.
- The license, which says how you are allowed to use the package.
- The link to the package's source code.
- Whether the version you use has been marked as deprecated, which means its makers say you should stop using it.
- Known public security advisories for your version, with how serious each one is and which versions fix it.
- The major versions between your version and the latest one. Major versions are the big jumps, such as React 17 to 18, where code often needs changes.
The advisories come from public databases. Package Facts reports what those databases list, so it is a quick summary for your AI and not a full security review.
The results
We asked Package Facts about 6 real cases. Two asked only for the latest version, and four started from an older version that someone might still be using. We then checked every answer against the registries and the advisory lists.
| Package | Question | What Package Facts found |
|---|---|---|
| react (npm) | What is the latest version? | 19.3.0, released Sep 9, 2026, MIT license |
| next (npm) | Upgrade from 14.2.3 | Version deprecated by its makers, 35 known advisories, major versions 15.0.0 and 16.0.0 on the way to 16.4.0 |
| requests (PyPI) | Upgrade from 2.25.1 | 8 known advisories, fixed in 2.31.0, 2.32.0, 2.32.4 and 2.33.0, latest 2.34.2 |
| pandas (PyPI) | What is the latest version? | 3.0.6, released Sep 17, 2026, BSD 3-Clause License |
| langchain (PyPI) | Upgrade from 0.1.0 | 10 known advisories, major version 1.0.0 on the way to 1.4.5 |
| react (npm) | Upgrade from 17.0.2 | Major versions 18.0.0 and 19.0.0 on the way to 19.3.0 |
The checks we ran:
- The latest version, release date, license and source link matched the registry in all 6 cases.
- requests 2.25.1 came back with 8 known advisories, the same 8 that PyPI lists. The versions that fix them also matched PyPI.
- next 14.2.3 came back marked as deprecated, with its makers' message to upgrade quoted in full. It counted 35 known advisories and listed 12 of them in the card.
- react 17.0.2 came back with the major versions 18.0.0 and 19.0.0. Those are the real stable releases, from Mar 29, 2022 and Dec 5, 2024.
- langchain 0.1.0 came back with 10 known advisories, the same count the public advisory database lists.
Where Package Facts saves work
Upgrades and older versions. For next 14.2.3, an AI would need the registry record for the old version, the record for the latest version, the release history and a separate advisory database to learn the same facts. Package Facts puts them in one checked answer.
Security alerts. npm's version records do not list security advisories. An AI working only from the registry would not see that next 14.2.3 had 35 known advisories.
A simple version lookup is not where it pays off. If your AI only needs the latest version of one package, npm's small "latest" record is enough. In a second test on Oct 15, 2026, that record for react was 785 tokens, while the full Package Facts result was 1,565 tokens. For vite, Package Facts used 23% fewer tokens than that record. A token is a small chunk of text that AI models read and charge for. So for a plain version check, Package Facts does not save tokens.
Compared with the full registry record. Some agents download the full registry record, which lists every version a package has ever released. For next, that record is about 12.7 million tokens, which is more than any AI model can read at once. Compared with the full registry record, the Package Facts text card used a median of 99.99% fewer tokens across our 6 cases. That record is not a fair cost baseline for a careful agent, so we do not use it as our main claim.
In short, Package Facts is one of the most valuable shortcuts when your AI is choosing or upgrading packages. It replaces a guess from old training data with current checked versions, security alerts and upgrade paths for about 2 cents.
How to use it
- Add Amazap to Claude or another AI app at amazap.com/mcp. (MCP is a standard way to plug tools into AI apps.)
- Ask a question about a package, such as "I'm on react 17.0.2. What do I need to know before I upgrade?"
Your AI gives Package Facts a link to the package on npm or PyPI, or the ecosystem, name and version. You see the price before you pay: about 2 cents (20 sats) per call. If a paid call fails, the price goes back to your balance as credit. To learn how AI agents pay for tools like this, see agentic payments on Amazap.
How we tested
- Packages: 6 cases across npm and PyPI: react latest, next from 14.2.3, requests from 2.25.1, pandas latest, langchain from 0.1.0, and react from 17.0.2. We used all three kinds of input: an npmjs.com link, a pypi.org link, and the ecosystem with a name and version.
- Checking: we compared each latest version, release date, license and source link with the registry files. We compared the requests advisories and fixed-in versions with PyPI's own list, the langchain advisory count with the public OSV database, and the react major versions with npm's release dates.
- Tokens: OpenAI's cl100k_base tokenizer. On Oct 13, 2026, we compared the Package Facts text card with the full registry record (registry.npmjs.org or pypi.org's full JSON). On Oct 15, 2026, we compared the full Package Facts result, as an AI receives it, with npm's "latest" record for react and vite. Other models count a little differently.
- Price: 20 sats per call, shown as $0.02 on the receipt. The price is set in dollars, so the sats amount follows the bitcoin rate. The service is
amazap-basics-package-facts. - Full data: package-facts-benchmark.csv.
See also: the API Spec Digest benchmark and the Log Squeezer benchmark.
FAQ
Why does my AI suggest old package versions?
An AI model learns from text gathered up to a certain date, so it remembers the versions that were current then. In our test, react's latest version was 19.3.0 and next's was 16.4.0, and an AI working from older memory could easily suggest something years behind.
What does Package Facts check?
It checks the latest version, release date, license, source link and deprecation status from the registry. It also lists known public security advisories for your version with their fixed-in versions, and the major versions between your version and the latest.
Does it get the facts right?
Yes, in our test. The latest version, release date, license and source link matched the registry in all 6 cases. For requests 2.25.1, the 8 advisories and their fixed-in versions matched PyPI's own list.
Does it save tokens?
It depends on what your AI would read instead. Compared with the full registry record, the text card used a median of 99.99% fewer tokens. Compared with npm's small "latest" record, a simple version lookup was not smaller. The value is in upgrades and security checks, where your AI would otherwise gather facts from several sources.
Is Package Facts a security scanner?
No. It reports known public advisories for a version, with their severity and fixed-in versions, so your AI can see them quickly. It is a summary of public data, not security advice.
How much does Package Facts cost?
About 2 cents (20 sats) per call. The price is set in dollars, so the sats amount follows the bitcoin rate. That is the full price, and you see it before you pay.