Log inSubmit server
Dep Oracle logo

Dep Oracle

Assess npm dependency trust, maintenance, typosquatting risk, and impact with scans, package checks, and MCP access.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Dep Oracle

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "dep-oracle": {
      "command": "npx",
      "args": [
        "-y",
        "dep-oracle"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y dep-oracle

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 5d ago.

Overview

The dep-oracle MCP server brings dependency trust analysis into Claude Code through the Model Context Protocol. It evaluates npm packages and project dependency trees using trust scores, maintenance signals, typosquat detection, trend projections, and JavaScript or TypeScript import analysis. Reach for it when reviewing supply-chain risk, prioritizing dependency upgrades, or checking whether an unmaintained package affects critical parts of a codebase.

Use cases

  • Scan a Node.js dependency tree for supply-chain risk
  • Check whether a package is abandoned or suspicious
  • Measure which JavaScript files depend on a package
  • Find migration alternatives for risky dependencies
  • Export dependency findings as SARIF for CI/CD

Key features

  • Weighted 0-100 dependency trust scores
  • Zombie dependency and typosquat detection
  • JavaScript and TypeScript blast-radius analysis
  • Three-month dependency risk projections
  • Migration suggestions for mapped packages
  • MCP and multi-format report support

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

7/7 checks healthy over the last 41d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 16d ago via OSV.dev · dep-oracle (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads215Package downloads in the last 30 days.
Last commit7mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Dep Oracle works

What dep-oracle MCP server does

The dep-oracle MCP server analyzes dependencies in a Node.js project and assigns each package a score from 0 to 100. The score combines security history, maintainer health, project activity, popularity, funding, and license data. Results are grouped into safe, warning, and critical ranges, helping developers identify packages that need investigation.

It also identifies potentially abandoned packages, estimates blast radius, detects likely typosquatting, projects three-month risk trends, and suggests alternatives for selected risky dependencies. The underlying command-line tool can scan a project or inspect one package, such as express or a version-pinned package.

How it works

A project scan starts from its dependency metadata and evaluates direct and transitive packages. Trust scoring uses weighted metrics: security history and maintainer health each account for 25%, activity 20%, popularity 15%, funding 10%, and license data 5%. Missing data is handled by redistributing available weight, with a reliability warning when several metrics cannot be collected.

Blast-radius analysis searches JavaScript and TypeScript source files for direct import, require, and dynamic import() references. It excludes common generated and dependency directories, then reports affected files and the share of the codebase involved. It does not follow re-exports or analyze Python imports.

Typosquat checks combine a static collection of known package names, cached npm download data, and name-similarity patterns such as character changes, prefixes, suffixes, and missing letters. Migration suggestions come from a curated mapping of packages to alternatives and include difficulty and migration context.

Setup and configuration

Run the command-line package without a global install using:

Terminal
npx dep-oracle

Alternatively, install it globally with npm and run dep-oracle scan. A project scan can produce terminal, JSON, HTML, or SARIF output. The --offline option uses cached data, while --threshold makes the command exit with status 1 when the overall result falls below a chosen score. Specific packages can be excluded with --ignore.

For MCP use, configure the dep-oracle MCP server with npx as the command and dep-oracle as its argument in the client’s MCP settings. Score weights can be adjusted in .dep-oraclerc.json.

Tools and capabilities

  • Scan a project’s direct and transitive dependencies.
  • Check an individual package or package version.
  • Calculate weighted trust scores and classify risk.
  • Flag inactive critical dependencies and likely typosquats.
  • Estimate direct-import blast radius for JavaScript and TypeScript.
  • Recommend alternatives for mapped packages.
  • Produce terminal, HTML, JSON, and SARIF reports.
  • Run from cached data when offline.

Limitations and notes

The dep-oracle MCP server is designed around npm and JavaScript or TypeScript dependency analysis. Blast-radius results are incomplete for Python-only projects because Python imports are not analyzed. Re-exports and barrel files are not traced, so the reported impact covers direct imports only.

Risk scores depend on external package and repository data. If GitHub, npm, or another required source is unavailable, the engine continues with fewer metrics and redistributes their weight; multiple unavailable metrics produce a reliability warning. Typosquat dynamic data is cached for seven days, and the static detection set covers more than 1,847 known package names.

The project is licensed under MIT. Its documented MCP integration is for Claude Code, while the command-line interface can also run independently in local workflows and CI/CD through the documented GitHub Action support.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Dep Oracle

dep-oracle is an MCP server that connects Claude Code to npm dependency and repository-risk analysis. Its main tools support project scans and individual package checks, including trust scores, zombie detection, typosquat checks, blast-radius estimates, trend projections, and migration suggestions for risky dependencies.

Install it by configuring `npx` with `dep-oracle` as the argument in your MCP client settings.

The command-line package can run independently with `npx dep-oracle` or a global npm installation.

It calculates a 0-100 score from security history, maintainer health, activity, popularity, funding, and license data. Security history and maintainer health each have a 25% weight, followed by activity at 20%, popularity at 15%, funding at 10%, and license data at 5%.

No, not currently. Blast-radius analysis searches JavaScript and TypeScript import patterns only, so Python-only projects return a blast-radius value of zero. The analysis also counts direct imports without tracing re-exports or barrel files.

Related MCP servers

All in Biology & Bioinformatics All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDep Oracle AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/dep-oracle?style=directory)](https://allmcps.com/mcp/dep-oracle)
HTML Embed
<a href="https://allmcps.com/mcp/dep-oracle"><img src="https://allmcps.com/api/badge/dep-oracle?style=directory" alt="Dep Oracle on AllMCPs" /></a>