DepScope

dev.depscopePublished by depscope.devOfficial publisherv0.9.24Updated Oct 24, 2026

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: dev.depscope/mcp
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to depscope.dev, which also runs its endpoint. That identifies the publisher; it does not make the server's tools safe.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/dev.depscope%2Fmcp.svg)](https://sourceweft.com/mcp/dev.depscope%2Fmcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

DepScope is a package-intelligence MCP server that lets an assistant verify packages across 19 ecosystems before they are installed.

What you can do: Check packages: existence, deprecation, health score, latest version and curated alternatives for abandoned packages, plus side-by-side comparison of health, license and vulnerabilities across ecosystems (npm, PyPI, Cargo, Go, Maven and others). Assess risk: open CVEs from OSV with KEV/EPSS signals, typosquat name-similarity checks and stack compatibility checks. Plan upgrades: breaking changes and migration plans between versions, known bugs from GitHub issues. Troubleshoot: map an error message to a likely cause and fix, and search similar error reports across ecosystems.
When to use it: Useful when an AI coding agent installs or upgrades dependencies and you want to catch hallucinated, deprecated or typosquatted package names before they reach the project, or when comparing libraries and planning a migration.
Requirements: Either the remote endpoint at mcp.depscope.dev or the local npm package depscope-mcp run via npx (Node.js). No authentication, API keys or environment variables are declared; network access to the DepScope backend is needed.

Before you install

The server sends a system-prompt directive to the client at handshake that tells the model to invoke it proactively, which changes assistant behavior without a manual rule file. Package names and error messages you query are sent to the third-party depscope.dev backend. The backend is proprietary and the README notes npm versions below 0.9.0 are deprecated.

Installation

In SourceWeft

Open DepScope in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.depscope%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "depscope": {
      "type": "http",
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

README

DepScope MCP Server

[npm version] [License: AGPL-3.0] [MCP Compatible]

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

The 19-ecosystem coverage list
An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
Three pillars: token-saving, energy-saving, security
Standard invocation flow: check_malicious → check_typosquat → check_package → install_command

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

Local (stdio via npx)

json

{  "mcpServers": {    "depscope": {      "command": "npx",      "args": ["-y", "depscope-mcp"]    }  }}

{  "mcpServers": {    "depscope": {      "command": "npx",      "args": ["-y", "depscope-mcp"]    }  }}

Tools (22)

Tool	Purpose
`check_package`	Full package check: deprecated/CVE/health/recommendation
`get_health_score`	0-100 score with breakdown (maintenance/popularity/security/maturity/community)
`get_vulnerabilities`	Open CVEs from OSV + KEV/EPSS
`package_exists`	Hallucination detector (404 = LLM invented it)
`find_alternatives`	Curated alternatives for deprecated/abandoned packages
`get_typosquat`	Suspicious name similarity check
`get_breaking_changes`	Migration plan between versions
`get_bugs`	Known bugs from GitHub issues
`compare_packages`	Side-by-side health/license/vuln comparison
`resolve_error`	Map error message → likely cause + fix
`search_errors`	Find similar error reports across ecosystems
`check_compat`	Stack compatibility check
`get_latest_version`	Latest stable + maturity signal
... and 9 more	full list in `tools.js`

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

Tools

SourceWeft has not read this server's tools yet.

Version history

v0.9.24LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.