Saves tokens, energy & blocks unsafe packages — 22 tools, 19 ecosystems, 1.2M+ pkgs, MIT.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Not yet automatically verified
We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Capabilities & Tool Schemas (13)
Inspect callable tools, capabilities, and parameters exposed to AI agents by DepScope MCP Server.
check_packageFull package check: deprecated/CVE/health/recommendation
get_health_score0-100 score with breakdown (maintenance/popularity/security/maturity/community)
get_vulnerabilitiesOpen CVEs from OSV + KEV/EPSS
package_existsHallucination detector (404 = LLM invented it)
find_alternativesCurated alternatives for deprecated/abandoned packages
get_typosquatSuspicious name similarity check
Documentation Overview
DepScope MCP Server
Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.
→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.
What's new in v0.9.0
The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.
What the model sees at every session start:
- The 19-ecosystem coverage list
- An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
- Three pillars: token-saving, energy-saving, security
- Standard invocation flow:
check_malicious→check_typosquat→check_package→install_command
For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:
All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.
Why this exists
LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.
Quick start
Claude Desktop / Cursor / Windsurf (remote MCP)
Add to your MCP config:
Local (stdio via npx)
Tools (22)
| Tool | Purpose |
|---|---|
check_package | Full package check: deprecated/CVE/health/recommendation |
get_health_score | 0-100 score with breakdown (maintenance/popularity/security/maturity/community) |
get_vulnerabilities | Open CVEs from OSV + KEV/EPSS |
package_exists | Hallucination detector (404 = LLM invented it) |
find_alternatives | Curated alternatives for deprecated/abandoned packages |
get_typosquat | Suspicious name similarity check |
get_breaking_changes | Migration plan between versions |
get_bugs | Known bugs from GitHub issues |
compare_packages | Side-by-side health/license/vuln comparison |
resolve_error | Map error message → likely cause + fix |
search_errors | Find similar error reports across ecosystems |
check_compat | Stack compatibility check |
get_latest_version | Latest stable + maturity signal |
| ... and 9 more | full list in tools.js |
Ecosystems (19)
npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia
Pricing
Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.
License
AGPL-3.0-or-later. Backend is proprietary; this client is open.
Links
- depscope.dev — homepage
- docs — integration guide
- Glama listing
- awesome-mcp-servers
Related MCP Servers
Adoption & maintenance
Factual signals from GitHub, npm, and our automated checks — not a rating.
Last commit
4mo ago
Most recent push to the default branch.
Tools exposed
13
Callable tools this server registers over MCP.
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about DepScope MCP Server
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/mcp-168)HTML Embed
<a href="https://allmcps.com/mcp/mcp-168"><img src="https://allmcps.com/api/badge/mcp-168?style=directory" alt="DepScope MCP Server on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
11/11 checks healthy over the last 42d
48Quality signal: Fair · 48/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership10/20
Documentation & tools25/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Supply-chain signal
No high-severity advisories surfaced by our automated scan.
Critical 0High 0Medium 0Low 0
Scanned 3d ago via OSV.dev · depscope-mcp (npm)
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.