Log inSubmit server
Dependency Fitness MCP logo

Dependency Fitness MCP

Evaluates npm packages for deprecation, yanks, vulnerabilities, malicious records, and verified migration targets.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Dependency Fitness MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "dependency-fitness-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "dependency-fitness-mcp"
      ],
      "env": {
        "GITHUB_TOKEN": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 2 tools correctly (3d ago).

Overview

The dependency-fitness-mcp MCP server evaluates npm dependencies by reconciling npm, deps.dev, OSV.dev, and GitHub data. It exposes single-package and batch audit tools that return structured verdicts, confidence levels, warnings, and migration recommendations when a package is deprecated or superseded. Reach for it before adding or upgrading dependencies, or as a CI and pre-merge gate. It runs over stdio with Node.js 18 or later and requires no API key for normal operation.

Use cases

  • Check a package before adding it to an npm project
  • Audit package.json dependencies in a CI job
  • Identify verified replacements for deprecated packages
  • Block hallucinated or malicious package names
  • Review dependency upgrades before merging

Key features

  • Cross-validates npm, deps.dev, OSV.dev, and GitHub data
  • Checks deprecation, yanks, vulnerabilities, and malicious records
  • Infers and verifies maintainer-named migration targets
  • Returns confidence levels and warnings
  • Audits up to 50 packages per call

Tools2

What Dependency Fitness MCP lets your agent do. Expand a tool for its parameters.

Verified live~368 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

19/22 checks healthy over the last 91d

What it can do

From the 2 tools this server returned when we ran it.

Makes network requests · 1Read-only tools · 2
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceNot published
Package age152 days
Maintainers1

Observed 2026-11-05 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 7d ago via OSV.dev · dependency-fitness-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads188Package downloads in the last 30 days.
Last commit5mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed2Callable tools this server registers over MCP.

How Dependency Fitness MCP works

What dependency-fitness-mcp MCP server does

dependency-fitness-mcp MCP server produces fitness verdicts for npm packages before an agent writes or upgrades a dependency. A verdict can include deprecation, yank status, malicious-package records, vulnerability information, supersession details, confidence, warnings, and the time of the last verification.

When a package is deprecated, the server attempts to identify a successor from the maintainer's deprecation notice. It then checks that the named package exists and is not itself deprecated before returning it as a migration target. If no successor can be established, the result reports that uncertainty rather than selecting an unverified replacement. Nonexistent package names receive a not-found result, with an OSV malicious-record check included.

How it works

The dependency-fitness-mcp MCP server queries four public sources: the npm registry, deps.dev, OSV.dev, and GitHub. npm provides the authoritative package data, including per-version deprecation text, distribution tags, and the repository URL. deps.dev corroborates deprecation state and advisory information. OSV.dev supplies vulnerability records, fixed-version data, and malicious-package markers. GitHub is used to check whether the linked repository is archived and to consider recent push activity.

The service reconciles these signals into a confidence-scored result. If a corroborating source cannot be reached, the result receives lower confidence and a warning; the server does not fill in missing evidence with an inferred claim. This helps surface disagreement, including cases where registry metadata looks active but the linked repository is archived.

Tools and capabilities

check_package_fitness returns a complete verdict and a readable summary for one npm package. Provide a package name such as request or @babel/core. An optional version accepts an exact version, semver range, or distribution tag; when omitted, the latest version is checked.

audit_dependencies evaluates multiple packages for a CI or pre-merge decision. Its input can contain package references such as react@18.2.0 and request, and can also use the raw contents of a package.json. The response includes one verdict per package and aggregate counts for deprecated, malicious, vulnerable, and outdated dependencies. Each call accepts at most 50 packages.

The dependency-fitness-mcp MCP server is intentionally limited to npm dependency fitness. PyPI support and successor inference based on package adoption are described as future work, not current capabilities.

Setup and configuration

Run the dependency-fitness-mcp MCP server with Node.js 18 or newer. It can be launched without a local installation through npx -y dependency-fitness-mcp, or installed globally. Claude Code can register it with claude mcp add dependency-fitness -- npx -y dependency-fitness-mcp. Other MCP clients can use a server entry whose command is npx and whose argument is -y dependency-fitness-mcp.

The only documented environment variable is GITHUB_TOKEN. Supplying it raises the GitHub rate limit for the archived-repository cross-check; the remaining data sources do not require a key. For local development, the repository provides build, test, smoke-test, and source-mode development commands. The smoke test contacts live registries, while the test suite uses offline deterministic synthesis tests.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Dependency Fitness MCP

dependency-fitness-mcp is an MCP server that connects coding agents to the npm registry, deps.dev, OSV.dev, and GitHub. Its main tools, check_package_fitness and audit_dependencies, evaluate individual or batched npm packages for deprecation, yanks, vulnerabilities, malicious records, supersession, and verified migration targets.

Install it by running it through npx with Node.js 18 or later: `npx -y dependency-fitness-mcp`. You can also install it globally. Configure an MCP client with `npx` as the command and `-y dependency-fitness-mcp` as its argument.

Yes, dependency-fitness-mcp works with Cursor through its MCP configuration file. Add a server entry using `npx` as the command and `-y dependency-fitness-mcp` as the argument; no API key is required for the normal data sources.

Call `audit_dependencies` with package references, such as `react@18.2.0` or `request`, and/or the raw contents of a `package.json`. The tool returns per-package verdicts and summary counts, with a maximum of 50 packages per call.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDependency Fitness MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/dependency-fitness-mcp?style=directory)](https://allmcps.com/mcp/dependency-fitness-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/dependency-fitness-mcp"><img src="https://allmcps.com/api/badge/dependency-fitness-mcp?style=directory" alt="Dependency Fitness MCP on AllMCPs" /></a>