Log inSubmit server
Dep Diff MCP logo

Dep Diff MCP

by DigiCatalyst-Systems

Analyzes npm, PyPI, and GitHub Actions upgrades for semver risk, breaking changes, security fixes, and migration guidance.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Dep Diff MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "digicatalyst-systems-dep-diff-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@digicatalyst/dep-diff-mcp"
      ],
      "env": {
        "GITHUB_TOKEN": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

DigiCatalyst-Systems/dep-diff-mcp analyzes dependency upgrades from npm, PyPI, or GitHub Actions and turns version changes into ranked recommendations. Its tools classify semver changes, inspect GitHub release notes for breaking changes and migration links, and check OSV.dev for security fixes resolved between versions. Use the single-package tool for focused upgrade questions or the bulk tool for Dependabot PRs and lockfile batches of up to 50 changes. It runs locally through stdio or remotely through a hosted streamable-HTTP endpoint.

Use cases

  • Assess a single Dependabot version change
  • Rank risks across a lockfile diff
  • Find security fixes in an upgrade range
  • Review breaking changes before a major bump
  • Locate migration guides in release notes

Key features

  • Supports npm, PyPI, and GitHub Actions
  • Classifies major, minor, patch, downgrade, and unknown changes
  • Detects breaking changes from GitHub release notes
  • Finds advisories fixed between package versions
  • Ranks batches by recommendation level
  • Returns MCP structured output and JSON text

Tools2

What Dep Diff MCP lets your agent do. Expand a tool for its parameters.

Verified live~562 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

16/16 checks healthy over the last 91d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 6d ago via OSV.dev · @digicatalyst/dep-diff-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars2Stargazers on the source repository.
npm downloads333Package downloads in the last 30 days.
Last commit10d agoMost recent push to the default branch.
Tools exposed2Callable tools this server registers over MCP.
Directory activity5 viewsConfig copies, upvotes, and views on AllMCPs.

How Dep Diff MCP works

What DigiCatalyst-Systems/dep-diff-mcp does

DigiCatalyst-Systems/dep-diff-mcp turns dependency version changes into an upgrade assessment rather than stopping at a major, minor, or patch label. It supports npm packages, PyPI projects, and GitHub Actions, including action references such as actions/checkout and nested references such as github/codeql-action/init.

Each analysis can report the semver class, release-note-derived breaking changes, security advisories fixed between the starting and target versions, migration guide URLs, and a recommendation with a risk level. Security findings come from OSV.dev, while release notes and repository information come from GitHub.

How it works

Use analyze_package_change with an ecosystem, package or action name, starting version, and target version. The response provides a structured result for one upgrade, suitable for questions such as whether a patch release is safe or what changed in a major release.

Use analyze_packages_bulk for a Dependabot update, npm outdated output, lockfile diff, or another list of upgrades. It processes up to 50 changes in parallel and returns summary counts, including the number of packages, semver classes, security fixes, and packages with breaking changes. Results are ordered by recommendation level: security, caution, review, likely-safe, then safe.

Both tools return JSON text and MCP structured content validated against a declared output schema. Clients that support structured output can read fields such as recommendationLevel and securityFixes directly.

Setup and configuration

For a local stdio installation, configure an MCP client to run:

Terminal
npx -y @digicatalyst/dep-diff-mcp

Claude Code can add it at user or project scope with claude mcp add. Cursor and Claude Desktop use their MCP configuration files. Restart the client after changing its configuration.

A hosted streamable-HTTP instance is available at https://dep-diff.digicatalyst.ca/mcp, which can be configured with an HTTP MCP entry instead of installing the npm package. The hosted service authenticates to GitHub with its own token; an optional githubToken URL parameter lets requests use your GitHub quota instead.

GitHub authentication is optional. The local server checks GITHUB_TOKEN first, then an authenticated gh CLI session, and otherwise uses GitHub's anonymous limit of 60 requests per hour. A token is useful for bulk analysis. If configured, use a least-privilege token with public repository read access and protect the client configuration file because it stores the value in plaintext.

Tools and capabilities

  • analyze_package_change examines one npm, PyPI, or GitHub Actions upgrade.
  • analyze_packages_bulk evaluates and ranks up to 50 upgrades in one call.
  • Semver classification covers major, minor, patch, downgrade, and unknown changes.
  • Release notes can yield detected breaking changes and migration links.
  • OSV.dev advisories identify security fixes present in the target range.
  • Recommendations distinguish security, caution, review, likely-safe, and safe outcomes.

Limitations and notes

Bulk requests are limited to 50 packages; split larger dependency sets into multiple calls. GitHub API access is rate-limited without authentication, making anonymous access more suitable for occasional individual analyses than large batches. The local package keeps token use on the local setup, while the hosted endpoint is stateless and does not retain query logs according to its privacy documentation.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Dep Diff MCP

DigiCatalyst-Systems/dep-diff-mcp is an MCP server that connects dependency upgrades to npm, PyPI, GitHub Actions, GitHub release notes, and OSV.dev. Its main tools, analyze_package_change and analyze_packages_bulk, classify semver changes, find breaking changes and security fixes, surface migration links, and return recommendations.

Install it locally by configuring your MCP client to run `npx -y @digicatalyst/dep-diff-mcp`. Claude Code supports `claude mcp add`, while Cursor and Claude Desktop use their MCP configuration files. Alternatively, configure the hosted streamable-HTTP endpoint at `https://dep-diff.digicatalyst.ca/mcp`.

Yes, DigiCatalyst-Systems/dep-diff-mcp works with Cursor through its `~/.cursor/mcp.json` configuration. Add a server entry that runs `npx -y @digicatalyst/dep-diff-mcp`, restart Cursor, and ask about an individual upgrade or a Dependabot batch.

The bulk tool analyzes up to 50 package changes per call. Larger lists should be split into multiple requests. It processes the supplied upgrades in parallel and returns aggregate counts plus ranked per-package results.

No, a GitHub token is optional, but authentication is recommended for bulk analysis. The local server checks `GITHUB_TOKEN`, then an authenticated `gh` CLI session, and otherwise uses GitHub's anonymous limit of 60 requests per hour.

Related MCP servers

All in Knowledge & Memory All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewDep Diff MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/digicatalyst-systems-dep-diff-mcp?style=directory)](https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/digicatalyst-systems-dep-diff-mcp"><img src="https://allmcps.com/api/badge/digicatalyst-systems-dep-diff-mcp?style=directory" alt="Dep Diff MCP on AllMCPs" /></a>