
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@aimodelwatch/mcp
Advanced tools
MCP server for AI Model Watch — prices, context windows, lifecycle status and deprecation dates for 270+ AI/LLM models, from official provider pages, refreshed daily. Read-only, no key.
MCP server for AI Model Watch: prices per 1M tokens, context windows, lifecycle status and provider-declared retirement dates for 270+ AI/LLM models across 12 providers, compiled daily from official provider pages. Read-only, no key, no signup.
It is a thin client over the public feed (/api/models.json, /api/deprecations.json), cached in
memory for 15 minutes. A null field means the provider does not publish that value — never a guess.
Every row carries the source_url it was read from.
Run on demand (nothing to install):
npx -y @aimodelwatch/mcp
claude mcp add aimodelwatch -- npx -y @aimodelwatch/mcp
Add to claude_desktop_config.json, .cursor/mcp.json, or your client's MCP config:
{
"mcpServers": {
"aimodelwatch": {
"command": "npx",
"args": ["-y", "@aimodelwatch/mcp"]
}
}
}
Transport is stdio. Requires Node.js 20+.
All tools are read-only and return JSON (as text and as structuredContent, with a published
outputSchema). Field names are exactly those of the feed — see the
API reference and the
OpenAPI spec.
| Tool | What it does | Arguments |
|---|---|---|
list_models | Filtered, paginated summary rows | provider, status (ga/preview/beta/deprecated/retired, or active = the first three), open_weight, modality, query (id/name/api_string), limit (≤500, default 100), offset |
get_model | Full row for one model, incl. notes and source_url; on a miss returns found: false + similar ids | id (id or api_string, case-insensitive) |
search_models | Free-text search that also looks inside notes (batch prices, cache tiers, hosting) | query, limit |
compare_models | Side-by-side rows plus blended price | ids (2–6) |
cheapest_models | N cheapest by blended price (mean of input/output) | count, modality, status (default active), provider |
check_model_status | Is this id safe to pin? Lifecycle, dates, days to retirement, stated replacement (with its row) | id |
list_deprecations | Every provider-declared deprecation/retirement, upcoming or past relative to as_of | provider, when, after, before, as_of, limit, offset |
models_changed_since | Lifecycle events (released / deprecated / retired) dated on or after a date, newest first; future-dated retirements (retires) only with include_scheduled | since, provider, include_scheduled, limit |
feed_freshness | The catalog's updated date, its age in days, counts, providers, feed URLs and this server's cache state | — |
models_changed_since is built from the dated fields on each row; the feed has no per-field
modification timestamps, so price changes are not visible there — check updated and the
changelog.
| URI | Content |
|---|---|
aimodelwatch://models | The full /api/models.json feed, verbatim (application/json) |
aimodelwatch://deprecations | The full /api/deprecations.json feed, verbatim |
Ask your agent:
gpt-4o still safe to pin? What replaces it?"The data is MIT-licensed and free to use; attribution ("Data by AI Model Watch —
https://aimodelwatch.dev") is appreciated. This server identifies itself to the feed as
aimodelwatch-mcp/<version> (+https://aimodelwatch.dev). If you build something else on the feed,
please send an identifiable User-Agent too — the project's only success metric is distinct
machine consumers, and an anonymous UA is invisible to it.
cd mcp-server
npm install # also builds dist/ (prepare)
npm test # unit + in-process MCP round-trip tests against a fixture snapshot of the feed
npm run smoke # spawns dist/index.js over stdio and calls the LIVE feed (needs network)
Tests run with node --test on Node 22.18+/24 (native TypeScript type stripping). The fixture in
test/fixtures/ is a verbatim snapshot of the live feed; refresh it when the schema changes.
server.json is the MCP Registry manifest; mcpName
in package.json is the registry's npm ownership check. Publishing (npm and registry) is a
maintainer action: npm publish --access public, then mcp-publisher login github and
mcp-publisher publish.
MIT
FAQs
MCP server for AI Model Watch — prices, context windows, lifecycle status and deprecation dates for 270+ AI/LLM models, from official provider pages, refreshed daily. Read-only, no key.
The npm package @aimodelwatch/mcp receives a total of 2 weekly downloads. As such, @aimodelwatch/mcp popularity was classified as not popular.
We found that @aimodelwatch/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.