# mopanc/depguard [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/mopanc/depguard  
**GitHub Stars:** 15  
**npm Downloads (last month):** 201  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mopanc-depguard

## Description
Pre-install guardian for npm packages with static code analysis, supply-chain attack detection, vulnerability audit (npm + GitHub Advisory Database), AI hallucination guard, and CycloneDX 1.6 SBOM generation with VEX. 28 MCP tools. Zero runtime dependencies — the SBOM serializer is implemented natively against the public CycloneDX schema.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "depguard": {
    "command": "npx",
    "args": ["-y","npx"]
  }
}
```

## Documentation

## What mopanc/depguard MCP server does

mopanc/depguard MCP server gives MCP-compatible coding agents a set of checks for npm packages, JavaScript projects, and freshly cloned workspaces. Its primary use is to make dependency decisions before installation, but it also reviews existing dependencies, identifies unused packages, and produces security-oriented project artifacts.

The package checks whether an npm name exists, compares names against more than 100 popular packages to identify possible typosquats, and audits package metadata and code-related indicators. Scoring combines security, maintenance, popularity, license compatibility, and dependency factors. Static findings can cap the security score even when a package is popular.

## How it works

The MCP server communicates over stdio, so an MCP client launches the CLI as a local process. The standard configuration runs `npx -y depguard-cli --mcp`. Each response includes a `tokenSavings` object with estimated manual research steps and token counts; this is intended to show the difference between using the tool and researching dependency information through multiple web requests.

Install-script analysis is static. The server examines `preinstall`, `install`, and `postinstall` scripts for patterns such as remote code execution, reverse shells, and credential-file access, but it does not execute those scripts.

Workspace auditing is designed for the period immediately after cloning and before opening a repository in an IDE. It checks for auto-executing workspace mechanisms including VS Code folder-open tasks, devcontainer lifecycle configuration, `.envrc`, JetBrains run configurations, Makefiles, `.gitattributes`, and committed Git hooks.

## Setup and configuration

Install the CLI globally with `npm install -g depguard-cli`, or run it without a global installation through `npx`. For MCP clients, use this stdio configuration:

```json
{
  "mcpServers": {
    "depguard": {
      "command": "npx",
      "args": ["-y", "depguard-cli", "--mcp"]
    }
  }
}
```

The README lists compatibility with Claude, Cursor, Windsurf, and other MCP clients, including Cline. No environment variables or API credentials are specified in the provided material.

## Tools and capabilities

The 14 documented tools cover distinct workflows:

- `depguard_guard` checks a package before installation and returns an allow, warn, or block decision.
- `depguard_should_use` compares installing a package with using native functionality or writing code from scratch.
- `depguard_audit_workspace` finds workspace-open execution paths.
- `depguard_audit_project` reviews direct and lockfile-resolved dependencies and the declared package manager.
- `depguard_remediate` groups vulnerable transitives by parent dependency to help prioritize upgrades.
- `depguard_audit`, `depguard_audit_bulk`, and `depguard_audit_deep` provide package-level, comparison, and transitive-tree audits.
- `depguard_review` looks for AI-generated code debris such as console logging, empty catches, broken imports, and orphan files.
- `depguard_sweep` searches for unused dependencies.
- `depguard_search`, `depguard_score`, and `depguard_verify` support package discovery, scoring, and existence or typosquat checks.
- `depguard_sbom` generates a CycloneDX 1.6 SBOM and can include VEX data.

The CLI also supports SARIF v2.1.0 output for selected audits, including stable GHSA-based rule identifiers and fingerprints intended for GitHub Code Scanning.

## Limitations and notes

The provided documentation describes npm-focused checks and does not establish support for non-npm package ecosystems. Risk scores are decision aids based on the documented dimensions, not proof that a package is safe. Static analysis identifies patterns and does not run package installation code. The README states that the server has zero runtime dependencies and implements its SBOM serializer against the public CycloneDX schema.

_Full upstream README: https://allmcps.com/mcp/mopanc-depguard/readme_