# dep-oracle [Health: Active]

**Category:** 🧬 Biology & Bioinformatics  
**Repository:** https://github.com/ertugrulakben/dep-oracle  
**GitHub Stars:** 0  
**npm Downloads (last month):** 215  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/dep-oracle

## Description
Predictive dependency security engine. Trust scores, zombie detection, blast radius analysis.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dep-oracle": {
    "command": "npx",
    "args": ["-y","dep-oracle"]
  }
}
```

## Documentation

## What dep-oracle MCP server does

The dep-oracle MCP server analyzes dependencies in a Node.js project and assigns each package a score from 0 to 100. The score combines security history, maintainer health, project activity, popularity, funding, and license data. Results are grouped into safe, warning, and critical ranges, helping developers identify packages that need investigation.

It also identifies potentially abandoned packages, estimates blast radius, detects likely typosquatting, projects three-month risk trends, and suggests alternatives for selected risky dependencies. The underlying command-line tool can scan a project or inspect one package, such as `express` or a version-pinned package.

## How it works

A project scan starts from its dependency metadata and evaluates direct and transitive packages. Trust scoring uses weighted metrics: security history and maintainer health each account for 25%, activity 20%, popularity 15%, funding 10%, and license data 5%. Missing data is handled by redistributing available weight, with a reliability warning when several metrics cannot be collected.

Blast-radius analysis searches JavaScript and TypeScript source files for direct `import`, `require`, and dynamic `import()` references. It excludes common generated and dependency directories, then reports affected files and the share of the codebase involved. It does not follow re-exports or analyze Python imports.

Typosquat checks combine a static collection of known package names, cached npm download data, and name-similarity patterns such as character changes, prefixes, suffixes, and missing letters. Migration suggestions come from a curated mapping of packages to alternatives and include difficulty and migration context.

## Setup and configuration

Run the command-line package without a global install using:

```bash
npx dep-oracle
```

Alternatively, install it globally with npm and run `dep-oracle scan`. A project scan can produce terminal, JSON, HTML, or SARIF output. The `--offline` option uses cached data, while `--threshold` makes the command exit with status 1 when the overall result falls below a chosen score. Specific packages can be excluded with `--ignore`.

For MCP use, configure the dep-oracle MCP server with `npx` as the command and `dep-oracle` as its argument in the client’s MCP settings. Score weights can be adjusted in `.dep-oraclerc.json`.

## Tools and capabilities

- Scan a project’s direct and transitive dependencies.
- Check an individual package or package version.
- Calculate weighted trust scores and classify risk.
- Flag inactive critical dependencies and likely typosquats.
- Estimate direct-import blast radius for JavaScript and TypeScript.
- Recommend alternatives for mapped packages.
- Produce terminal, HTML, JSON, and SARIF reports.
- Run from cached data when offline.

## Limitations and notes

The dep-oracle MCP server is designed around npm and JavaScript or TypeScript dependency analysis. Blast-radius results are incomplete for Python-only projects because Python imports are not analyzed. Re-exports and barrel files are not traced, so the reported impact covers direct imports only.

Risk scores depend on external package and repository data. If GitHub, npm, or another required source is unavailable, the engine continues with fewer metrics and redistributes their weight; multiple unavailable metrics produce a reliability warning. Typosquat dynamic data is cached for seven days, and the static detection set covers more than 1,847 known package names.

The project is licensed under MIT. Its documented MCP integration is for Claude Code, while the command-line interface can also run independently in local workflows and CI/CD through the documented GitHub Action support.

_Full upstream README: https://allmcps.com/mcp/dep-oracle/readme_