Dep Diff MCP

What DigiCatalyst-Systems/dep-diff-mcp MCP server does

DigiCatalyst-Systems/dep-diff-mcp MCP server turns dependency version changes into structured upgrade assessments. It supports npm packages, PyPI packages, and GitHub Actions references such as actions/checkout or nested action paths. Given a package name, ecosystem, starting version, and target version, it reports the semver class, repository information when available, release-note findings, security fixes, migration resources, and a recommendation level.

The security analysis checks OSV.dev data for advisories affecting the old version and resolved by the new version. Release-note processing looks for breaking-change information and upgrade guidance. This helps distinguish a routine patch update from an update that addresses a high-severity issue or requires migration work.

How it works

The analyze_package_change tool handles one upgrade at a time. Its required inputs are ecosystem, name, fromVersion, and toVersion. The ecosystem value must be npm, pypi, or github-actions.

The analyze_packages_bulk tool accepts up to 50 package changes and analyzes them in parallel. Results are ordered by recommendation level: security, caution, review, likely-safe, and safe. The response also includes aggregate counts by semver class, the number of security fixes, and the number of packages with breaking changes.

Both tools provide a JSON text representation and MCP structured content validated against an output schema. Clients that support structured results can read fields such as recommendationLevel and securityFixes directly.

Setup and configuration

Install the local server with the npm package command npx -y @digicatalyst/dep-diff-mcp. Claude Code can register it at user or project scope. Cursor and Claude Desktop can run it through their MCP configuration files using npx and the package name.

A hosted streamable HTTP instance is also available at https://dep-diff.digicatalyst.ca/mcp, allowing a compatible client to connect without installing the npm package. The hosted service uses its own GitHub authentication by default; a GitHub token can be supplied in the URL when requests should use the caller's quota.

For a local deployment, the server first checks the GITHUB_TOKEN environment variable, then tries gh auth token from an authenticated GitHub CLI installation, and finally uses GitHub anonymously. The token is used for reading release notes and is not required for the server to start.

Tools and capabilities

• Classify changes as major, minor, patch, downgrade, or unknown.
• Extract breaking changes from GitHub release-note headers.
• Identify CVEs and other OSV.dev fixes covered by the upgrade.
• Find migration guide links in release notes.
• Produce a per-package recommendation and risk level.
• Rank a batch of up to 50 dependency changes.

Limitations and notes

Without authentication, GitHub allows 60 API requests per hour, which may be sufficient for occasional single-package checks but can limit bulk analysis. An authenticated GitHub CLI session or fine-grained public-read token can raise the available rate limit. GitHub release-note findings therefore depend on accessible repository data.

DigiCatalyst-Systems/dep-diff-mcp MCP server assesses version changes; its output is a planning aid rather than a substitute for testing an upgrade in the target project. The bulk tool has a fixed maximum of 50 package changes per request. GitHub Actions updates should be passed as action repository references rather than ordinary package names.

DigiCatalyst-Systems/dep-diff-mcp MCP server can be run locally when repository and token data should remain on the developer's machine, or accessed through the documented hosted endpoint when local installation is not preferred.