Server data from the Official MCP Registry
npm dependency fitness: deprecated/yanked/superseded + verified safe migration target.
npm dependency fitness: deprecated/yanked/superseded + verified safe migration target.
Valid MCP server (3 strong, 3 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry.
8 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-tweedbeetle-dependency-fitness-mcp": {
"args": [
"-y",
"dependency-fitness-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
Is this npm package safe to depend on — and if not, what do I move to?
An MCP server that gives a coding agent a cross-validated fitness verdict for an npm package before it writes or upgrades a dependency:
{
"deprecated": true,
"yanked": false,
"malicious": false,
"superseded_by": { "latest": "14.0.0", "majors_behind": 13, "breaking_boundary": true },
"safe_migration_target": {
"package": "uuid",
"version": "14.0.0",
"rationale": "Maintainer's deprecation notice recommends 'uuid' (verified present and not deprecated).",
"confidence": "high"
},
"confidence": "high",
"last_verified": "2026-06-05T18:10:31Z"
}
It reconciles four free, sanctioned sources — the npm registry, Google's deps.dev, OSV.dev, and GitHub — into one confidence-scored answer, and infers a safe migration target when a package is deprecated or superseded.
"Is it deprecated?" is already free — deps.dev serves that flag, and several free MCP servers already answer "what's the latest version?". This tool does the part nobody serves as data:
This is intentionally a narrow tool: the deprecation / yank / supersede / migration middle, where the free incumbents sit on either side but leave the seam open.
check_package_fitnessSingle-package verdict. Input: package (e.g. request, @babel/core), optional
version (exact, semver range, or dist-tag — omit for latest). Output: the full
Verdict (structured) plus a human-readable summary.
audit_dependenciesBatch verdict for a CI / pre-merge gate. Input: packages (e.g.
["react@18.2.0", "request"]) and/or the raw contents of a package.json. Output:
a per-package verdict array plus a summary (how many deprecated / malicious /
vulnerable / behind). Capped at 50 packages per call.
Requires Node ≥ 18. Run via npx (no install) or install globally.
Claude Code:
claude mcp add dependency-fitness -- npx -y dependency-fitness-mcp
Claude Desktop / Cursor / any MCP client (mcp.json / claude_desktop_config.json):
{
"mcpServers": {
"dependency-fitness": { "command": "npx", "args": ["-y", "dependency-fitness-mcp"] }
}
}
Optional env: GITHUB_TOKEN raises the GitHub rate limit (used only for the
archived-repo cross-check); everything else needs no key.
npm install
npm run build # tsc -> dist/
npm test # vitest (offline, deterministic synthesis tests)
npm run smoke # live: hits the real registries, prints verdicts
npm run dev # run the server from source over stdio
┌─ npm registry ── per-version `deprecated` string, dist-tags, repo URL (authoritative)
query ──┼─ deps.dev ────── isDeprecated / deprecatedReason / advisoryKeys (corroborator)
├─ OSV.dev ─────── advisories + MAL-* malicious markers + "fixed in" (corroborator)
└─ GitHub ──────── archived flag + last-push recency (deceptive-deprecation check)
│
▼
cross-validate deprecation ─→ infer + verify migration target ─→ confidence + warnings ─→ Verdict
npm is the source of truth; the others corroborate. A corroborator being
unreachable lowers confidence and adds a warning — it never fabricates a
signal.
v0.1 — thin, working, npm-only. This is a fast public validation of whether a
narrow "agent-data endpoint via MCP directory" can find its users organically.
Roadmap and the explicit kill criterion live in
KILL_CRITERION.md. Next layers (documented, not yet
built): PyPI, and de-facto-successor inference by mining what high-trust
packages actually depend on now.
MIT © Christo Wilken / 9592 Solutions UG. Built in public.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.