Server data from the Official MCP Registry
Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.
Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.
Remote endpoints: streamable-http: https://mcp.depscope.dev/mcp
Valid MCP server (3 strong, 6 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry.
5 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
From the project's GitHub README.
Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.
→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.
The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.
What the model sees at every session start:
check_malicious → check_typosquat → check_package → install_commandFor Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:
git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope
All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.
LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.
Add to your MCP config:
{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}
{
"mcpServers": {
"depscope": {
"command": "npx",
"args": ["-y", "depscope-mcp"]
}
}
}
| Tool | Purpose |
|---|---|
check_package | Full package check: deprecated/CVE/health/recommendation |
get_health_score | 0-100 score with breakdown (maintenance/popularity/security/maturity/community) |
get_vulnerabilities | Open CVEs from OSV + KEV/EPSS |
package_exists | Hallucination detector (404 = LLM invented it) |
find_alternatives | Curated alternatives for deprecated/abandoned packages |
get_typosquat | Suspicious name similarity check |
get_breaking_changes | Migration plan between versions |
get_bugs | Known bugs from GitHub issues |
compare_packages | Side-by-side health/license/vuln comparison |
resolve_error | Map error message → likely cause + fix |
search_errors | Find similar error reports across ecosystems |
check_compat | Stack compatibility check |
get_latest_version | Latest stable + maturity signal |
| ... and 9 more | full list in tools.js |
npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia
Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.
AGPL-3.0-or-later. Backend is proprietary; this client is open.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.