4da MCP Server

What 4da-mcp-server does

The 4da-mcp-server MCP server helps an AI coding agent evaluate dependency changes before installation or build steps. It can compare an installed package with a requested version, identify release and breaking-change information, relate those changes to imports and files in the project, and report known vulnerabilities affecting installed versions.

Its analysis is based on the repository where the server starts. The server also provides vulnerability scanning, dependency health information, ranked upgrade planning, ecosystem news through ecosystem_pulse, and decision memory features where supported by the available tools. It does not require an account or API key, and project code remains on the local machine.

How it works

The 4da-mcp-server MCP server discovers supported dependency files across a project tree, including independently locked projects below the root. Supported formats include npm, pnpm, Yarn, Bun, Cargo, Poetry, uv, PDM, Pipenv, requirements files, Go, RubyGems, and Composer. It follows .gitignore, checks multiple installed copies, and refreshes its view when lockfiles change. For npm projects, it also checks the contents of node_modules.

The server uses OSV.dev for known vulnerability data and package sources such as npm, crates.io, PyPI, and the Go module proxy for versions, release metadata, deprecations, and yanks. Registry data, vulnerability results, and news are cached for limited periods and requests are rate-limited. Changelogs are taken from package archives by default; GitHub changelog access is optional through FOURDA_GITHUB_CHANGELOG=true.

Incomplete coverage is reported rather than hidden. Unsupported ecosystems, unreadable lockfiles, skipped test fixtures, dependencies that could not be checked, and manifests without lockfiles appear in coverage information. Maven, Gradle, .NET, Pub, Hex, SwiftPM, and CocoaPods are not read according to the supplied documentation.

Setup and configuration

Node.js 22 or later is required. Node 22.13 and later uses the built-in node:sqlite; earlier Node 22 releases can use the optional better-sqlite3 module. Run npx @4da/mcp-server --doctor to see which database implementation is active.

The server runs over stdio. Claude Code can add it with claude mcp add 4da -- npx @4da/mcp-server. Cursor, Windsurf, Claude Desktop, and VS Code can use an MCP configuration entry with npx as the command and @4da/mcp-server as its argument. The --setup command can detect supported editors, merge configuration while preserving existing entries, and create backups; use --dry-run to inspect changes first.

Tools and capabilities

The documented agent-facing capabilities include:

• upgrade_impact for comparing a dependency version with a target and relating changes to project usage.
• dependency_check for release metadata, package health signals, and safe releases within a constraint.
• vulnerability_scan for OSV-based checks against installed dependencies.
• dependency_health for dependency health data, including npm weekly downloads where available.
• upgrade_planner for ranked upgrade planning.
• ecosystem_pulse for Hacker News-based ecosystem information.

A Claude Code plugin also includes a hook that notices dependency-version edits in common manifest files and advises the agent to run dependency_check and upgrade_impact before installing and building.

Limitations and notes

The 4da-mcp-server MCP server depends on external registries and OSV.dev for much of its metadata. If vulnerability queries fail or exceed the query budget, results identify unchecked dependencies and withhold aggregate vulnerability totals where necessary. Large dependency trees are queried in batches.

The server scans lockfiles and installed dependencies, not merely declared version ranges in manifests. Test-fixture directories are excluded unless a request enables include_test_fixtures: true. GitHub is contacted for changelogs only when the optional setting is enabled; the supplied documentation also lists an optional local Ollama or OpenAI embedding provider for semantic recall.