# dependency-fitness-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/TweedBeetle/dependency-fitness-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 188  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/dependency-fitness-mcp

## Description
npm dependency fitness: deprecated/yanked/superseded + verified safe migration target.

## Tools
Capabilities this server exposes over MCP:

- **check_package_fitness** — Return a cross-validated fitness verdict for an npm package: is it deprecated / yanked / superseded / malicious, and if so what is the safe migration target. Unlike a plain 'is it deprecated' lookup, this reconciles the npm registry, deps.dev, OSV and GitHub into one confidence-scored answer, infers a safe replacement when one exists, and flags disagreement instead of guessing. Also detects non-existent / hallucinated package names.
- **audit_dependencies** — Audit many npm dependencies at once and return a per-package fitness verdict plus a summary (how many are deprecated / malicious / vulnerable / behind). Accepts a list of package specs (e.g. ['react@18.2.0', 'request']) and/or the raw contents of a package.json. Ideal for a CI / pre-merge dependency gate. Capped at 50 packages per call.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dependency-fitness-mcp": {
    "command": "npx",
    "args": ["-y","dependency-fitness-mcp"],
    "env": {
      "GITHUB_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `GITHUB_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What dependency-fitness-mcp MCP server does

dependency-fitness-mcp MCP server produces fitness verdicts for npm packages before an agent writes or upgrades a dependency. A verdict can include deprecation, yank status, malicious-package records, vulnerability information, supersession details, confidence, warnings, and the time of the last verification.

When a package is deprecated, the server attempts to identify a successor from the maintainer's deprecation notice. It then checks that the named package exists and is not itself deprecated before returning it as a migration target. If no successor can be established, the result reports that uncertainty rather than selecting an unverified replacement. Nonexistent package names receive a not-found result, with an OSV malicious-record check included.

## How it works

The dependency-fitness-mcp MCP server queries four public sources: the npm registry, deps.dev, OSV.dev, and GitHub. npm provides the authoritative package data, including per-version deprecation text, distribution tags, and the repository URL. deps.dev corroborates deprecation state and advisory information. OSV.dev supplies vulnerability records, fixed-version data, and malicious-package markers. GitHub is used to check whether the linked repository is archived and to consider recent push activity.

The service reconciles these signals into a confidence-scored result. If a corroborating source cannot be reached, the result receives lower confidence and a warning; the server does not fill in missing evidence with an inferred claim. This helps surface disagreement, including cases where registry metadata looks active but the linked repository is archived.

## Tools and capabilities

`check_package_fitness` returns a complete verdict and a readable summary for one npm package. Provide a package name such as `request` or `@babel/core`. An optional version accepts an exact version, semver range, or distribution tag; when omitted, the latest version is checked.

`audit_dependencies` evaluates multiple packages for a CI or pre-merge decision. Its input can contain package references such as `react@18.2.0` and `request`, and can also use the raw contents of a `package.json`. The response includes one verdict per package and aggregate counts for deprecated, malicious, vulnerable, and outdated dependencies. Each call accepts at most 50 packages.

The dependency-fitness-mcp MCP server is intentionally limited to npm dependency fitness. PyPI support and successor inference based on package adoption are described as future work, not current capabilities.

## Setup and configuration

Run the dependency-fitness-mcp MCP server with Node.js 18 or newer. It can be launched without a local installation through `npx -y dependency-fitness-mcp`, or installed globally. Claude Code can register it with `claude mcp add dependency-fitness -- npx -y dependency-fitness-mcp`. Other MCP clients can use a server entry whose command is `npx` and whose argument is `-y dependency-fitness-mcp`.

The only documented environment variable is `GITHUB_TOKEN`. Supplying it raises the GitHub rate limit for the archived-repository cross-check; the remaining data sources do not require a key. For local development, the repository provides build, test, smoke-test, and source-mode development commands. The smoke test contacts live registries, while the test suite uses offline deterministic synthesis tests.

_Full upstream README: https://allmcps.com/mcp/dependency-fitness-mcp/readme_