Depscope

What cuttalo/depscope MCP server does

The cuttalo/depscope MCP server exposes 22 package-analysis tools for AI agents working with ecosystems such as npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Composer, Pub, Hex, Swift, CocoaPods, CPAN, Hackage, CRAN, Conda, Homebrew, JSR, and Julia. Its main purpose is to reduce dependency mistakes before an agent produces an install command or recommends a library.

The tools cover both individual packages and complete dependency sets. An agent can verify that a name exists, identify likely typosquats, check for malicious or historical supply-chain incidents, retrieve vulnerability data, and inspect package health. Other tools compare packages, find alternatives, create migration plans, check compatibility between versions, identify breaking changes, and return known non-CVE bugs.

How it works

Requests are sent through MCP to the hosted DepScope backend. The remote endpoint is https://mcp.depscope.dev/mcp. A local client can instead start the npm package depscope-mcp over stdio; the client remains a local process while the intelligence backend is hosted by DepScope.

For quick decisions, get_package_prompt returns a compact, language-model-oriented brief with a verdict, health information, vulnerabilities, alternatives, and maintainer alerts. check_package provides a larger machine-readable report when an application needs structured fields. scan_project accepts dependency lists from one ecosystem or mixed ecosystem inputs and reports hallucinated, deprecated, typosquatted, vulnerable, and otherwise risky packages. check_bulk is intended for fast pre-install filtering of batches rather than dependency-tree auditing.

The service also includes tools for operational package work: install_command produces ecosystem-specific installation syntax, pin_safe suggests a version below a selected vulnerability tier, and resolve_error maps an error or symptom to a verified solution or search results.

Setup and configuration

For Claude Desktop, Cursor, or Windsurf, configure an MCP server with the remote URL:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

For a local stdio configuration, run the cuttalo/depscope MCP server through npx:

{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

No API key or other credential is required. The hosted service is described as free, with rate limits; higher quotas, SLA support, and on-premises deployment are available by contacting the provider.

Tools and capabilities

• Validate package names and retrieve the latest published version.
• Detect malicious packages, typosquats, deprecations, vulnerabilities, and known bugs.
• Review health scores, maintainer signals, OpenSSF Scorecard data, quality indicators, and provenance signals.
• Compare packages and locate alternatives, including standard-library replacements where available.
• Check version compatibility, major-version changes, migration paths, and safer pins.
• Audit dependency batches or project manifests and produce an overall risk verdict.
• View trending packages and submit tickets for data errors, missing listings, security reports, or partnerships.

The cuttalo/depscope MCP server also exposes the same underlying data through documented HTTPS REST endpoints, so applications that do not use MCP can query package checks directly.

Limitations and notes

The MCP client source is open source under AGPL-3.0, while the backend API and intelligence layer are proprietary hosted services. The landing-page repository and its documentation use CC-BY-4.0, so these licenses should not be treated as interchangeable.

Results depend on the backend data and its supported ecosystems. check_bulk is a database-backed preflight filter, not a complete dependency-tree audit; use scan_project for project-level dependency review. Likewise, get_health_score is intended as a later go/no-go signal after malware and typosquat checks, not as the sole first screening step. The service has rate limits, although the material does not specify their values.