# DigiCatalyst-Systems/dep-diff-mcp [Health: Active]

**Category:** 🧠 Knowledge & Memory  
**Repository:** https://github.com/DigiCatalyst-Systems/dep-diff-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 1358  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp

## Description
Translates a lockfile diff (npm, PyPI) into a human-readable upgrade plan. Point it at a Dependabot PR and get back semver classification, breaking changes from GitHub release notes, CVEs fixed in range, migration links, and a per-package recommendation. Bulk tool ranks up to 50 changes by risk (security > caution > review > likely-safe > safe). Install via npx -y @digicatalyst/dep-diff-mcp.

## Tools
Capabilities this server exposes over MCP:

- **analyze_package_change** — Analyze one package upgrade. Inputs: `ecosystem` (`npm`, `pypi`, or `github-actions`), `name`, `fromVersion`, `toVersion`.
- **analyze_packages_bulk** — Analyze up to 50 package upgrades in parallel. Returns packages ranked by risk (`security` > `caution` > `review` > `likely-safe` > `safe`), plus summary counts.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dep-diff-mcp": {
    "command": "npx",
    "args": ["-y","@digicatalyst/dep-diff-mcp"]
  }
}
```

## Documentation

## What DigiCatalyst-Systems/dep-diff-mcp MCP server does

DigiCatalyst-Systems/dep-diff-mcp MCP server turns dependency version changes into structured upgrade assessments. It supports npm packages, PyPI packages, and GitHub Actions references such as `actions/checkout` or nested action paths. Given a package name, ecosystem, starting version, and target version, it reports the semver class, repository information when available, release-note findings, security fixes, migration resources, and a recommendation level.

The security analysis checks OSV.dev data for advisories affecting the old version and resolved by the new version. Release-note processing looks for breaking-change information and upgrade guidance. This helps distinguish a routine patch update from an update that addresses a high-severity issue or requires migration work.

## How it works

The `analyze_package_change` tool handles one upgrade at a time. Its required inputs are `ecosystem`, `name`, `fromVersion`, and `toVersion`. The ecosystem value must be `npm`, `pypi`, or `github-actions`.

The `analyze_packages_bulk` tool accepts up to 50 package changes and analyzes them in parallel. Results are ordered by recommendation level: `security`, `caution`, `review`, `likely-safe`, and `safe`. The response also includes aggregate counts by semver class, the number of security fixes, and the number of packages with breaking changes.

Both tools provide a JSON text representation and MCP structured content validated against an output schema. Clients that support structured results can read fields such as `recommendationLevel` and `securityFixes` directly.

## Setup and configuration

Install the local server with the npm package command `npx -y @digicatalyst/dep-diff-mcp`. Claude Code can register it at user or project scope. Cursor and Claude Desktop can run it through their MCP configuration files using `npx` and the package name.

A hosted streamable HTTP instance is also available at `https://dep-diff.digicatalyst.ca/mcp`, allowing a compatible client to connect without installing the npm package. The hosted service uses its own GitHub authentication by default; a GitHub token can be supplied in the URL when requests should use the caller's quota.

For a local deployment, the server first checks the `GITHUB_TOKEN` environment variable, then tries `gh auth token` from an authenticated GitHub CLI installation, and finally uses GitHub anonymously. The token is used for reading release notes and is not required for the server to start.

## Tools and capabilities

- Classify changes as major, minor, patch, downgrade, or unknown.
- Extract breaking changes from GitHub release-note headers.
- Identify CVEs and other OSV.dev fixes covered by the upgrade.
- Find migration guide links in release notes.
- Produce a per-package recommendation and risk level.
- Rank a batch of up to 50 dependency changes.

## Limitations and notes

Without authentication, GitHub allows 60 API requests per hour, which may be sufficient for occasional single-package checks but can limit bulk analysis. An authenticated GitHub CLI session or fine-grained public-read token can raise the available rate limit. GitHub release-note findings therefore depend on accessible repository data.

DigiCatalyst-Systems/dep-diff-mcp MCP server assesses version changes; its output is a planning aid rather than a substitute for testing an upgrade in the target project. The bulk tool has a fixed maximum of 50 package changes per request. GitHub Actions updates should be passed as action repository references rather than ordinary package names.

DigiCatalyst-Systems/dep-diff-mcp MCP server can be run locally when repository and token data should remain on the developer's machine, or accessed through the documented hosted endpoint when local installation is not preferred.

_Full upstream README: https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp/readme_