# DigiCatalyst-Systems/dep-diff-mcp [Health: Active]

**Category:** 🧠 Knowledge & Memory  
**Repository:** https://github.com/DigiCatalyst-Systems/dep-diff-mcp  
**GitHub Stars:** 2  
**npm Downloads (last month):** 333  
**Views:** 5  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp

## Description
Translates a lockfile diff (npm, PyPI) into a human-readable upgrade plan. Point it at a Dependabot PR and get back semver classification, breaking changes from GitHub release notes, CVEs fixed in range, migration links, and a per-package recommendation. Bulk tool ranks up to 50 changes by risk (security > caution > review > likely-safe > safe). Install via npx -y @digicatalyst/dep-diff-mcp.

## Tools
Capabilities this server exposes over MCP:

- **analyze_package_change** — Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.
- **analyze_packages_bulk** — Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lockfile diff, or batch upgrade. Returns: total count, breakdown by semver class, total security fixes found, packages with breaking changes, and per-package details. Limit 50 packages per call (chunk larger lists).

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dep-diff-mcp": {
    "command": "npx",
    "args": ["-y","@digicatalyst/dep-diff-mcp"],
    "env": {
      "GITHUB_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `GITHUB_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What DigiCatalyst-Systems/dep-diff-mcp does

DigiCatalyst-Systems/dep-diff-mcp turns dependency version changes into an upgrade assessment rather than stopping at a major, minor, or patch label. It supports npm packages, PyPI projects, and GitHub Actions, including action references such as `actions/checkout` and nested references such as `github/codeql-action/init`.

Each analysis can report the semver class, release-note-derived breaking changes, security advisories fixed between the starting and target versions, migration guide URLs, and a recommendation with a risk level. Security findings come from OSV.dev, while release notes and repository information come from GitHub.

## How it works

Use `analyze_package_change` with an ecosystem, package or action name, starting version, and target version. The response provides a structured result for one upgrade, suitable for questions such as whether a patch release is safe or what changed in a major release.

Use `analyze_packages_bulk` for a Dependabot update, `npm outdated` output, lockfile diff, or another list of upgrades. It processes up to 50 changes in parallel and returns summary counts, including the number of packages, semver classes, security fixes, and packages with breaking changes. Results are ordered by recommendation level: `security`, `caution`, `review`, `likely-safe`, then `safe`.

Both tools return JSON text and MCP structured content validated against a declared output schema. Clients that support structured output can read fields such as `recommendationLevel` and `securityFixes` directly.

## Setup and configuration

For a local stdio installation, configure an MCP client to run:

```bash
npx -y @digicatalyst/dep-diff-mcp
```

Claude Code can add it at user or project scope with `claude mcp add`. Cursor and Claude Desktop use their MCP configuration files. Restart the client after changing its configuration.

A hosted streamable-HTTP instance is available at `https://dep-diff.digicatalyst.ca/mcp`, which can be configured with an HTTP MCP entry instead of installing the npm package. The hosted service authenticates to GitHub with its own token; an optional `githubToken` URL parameter lets requests use your GitHub quota instead.

GitHub authentication is optional. The local server checks `GITHUB_TOKEN` first, then an authenticated `gh` CLI session, and otherwise uses GitHub's anonymous limit of 60 requests per hour. A token is useful for bulk analysis. If configured, use a least-privilege token with public repository read access and protect the client configuration file because it stores the value in plaintext.

## Tools and capabilities

- `analyze_package_change` examines one npm, PyPI, or GitHub Actions upgrade.
- `analyze_packages_bulk` evaluates and ranks up to 50 upgrades in one call.
- Semver classification covers major, minor, patch, downgrade, and unknown changes.
- Release notes can yield detected breaking changes and migration links.
- OSV.dev advisories identify security fixes present in the target range.
- Recommendations distinguish security, caution, review, likely-safe, and safe outcomes.

## Limitations and notes

Bulk requests are limited to 50 packages; split larger dependency sets into multiple calls. GitHub API access is rate-limited without authentication, making anonymous access more suitable for occasional individual analyses than large batches. The local package keeps token use on the local setup, while the hosted endpoint is stateless and does not retain query logs according to its privacy documentation.

_Full upstream README: https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp/readme_