Freshdeps Mcp

io.github.SolvoHQPublished by GitHub account SolvoHQv1.0.0Updated Oct 24, 2026

Live npm/PyPI dependency-health verdicts so AI agents stop recommending stale or CVE'd packages

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that checks npm and PyPI packages for maintenance status, deprecation and known CVEs so an assistant can vet dependencies before recommending

What you can do
Check a single npm or PyPI package for dependency health, given its ecosystem and package name. Get back a readable summary plus structured details: maintenance signal, latest version, last release and commit age, deprecation, yank or archived flags, and known CVE count from OSV. Receive a hand-verified alternative when the package is considered dead.
When to use it
Useful when an assistant suggests libraries or dependencies and you want current health data rather than training-era knowledge, for example before adding a package to a project or auditing an existing dependency list.
Requirements
Runs as a local Node.js process over stdio, typically launched with npx or node. It calls a backend verdict API, defaulting to the project's hosted service; the FRESHDEPS_API_BASE variable can point it at another base URL. Network access is needed.
Before you install
Package names are sent to the backend verdict API, so queries leave the machine. The optional GOATCOUNTER_CODE variable enables fire-and-forget usage analytics. The README notes the npm package is not yet published, so the npx install line may not work yet.

Installation

In SourceWeft

  1. Open Freshdeps Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

freshdeps-mcp

MCP server exposing live npm / PyPI dependency-health verdicts so AI coding agents can check a package before recommending it — closing the 6–18 month staleness gap in model training data.

Tool

check_dependency_freshness

InputType
ecosystem"npm" | "pypi"
packagestring

Returns a concise human-readable summary and structured content: maintenance signal (active/slowing/stale/abandoned/unknown), latest version, last release/commit age, deprecation/yank/archived flags, known CVE count (OSV), and a hand-verified alternative if the package is dead.

It calls ${FRESHDEPS_API_BASE}/api/verdict (default https://freshdeps.vercel.app).

Install (Claude Desktop / Cursor)

Once published:

json
{  "mcpServers": {    "freshdeps": { "command": "npx", "args": ["-y", "freshdeps-mcp"] }  }}

From this repo (before publish):

json
{  "mcpServers": {    "freshdeps": {      "command": "node",      "args": ["/absolute/path/to/code/mcp/server.js"]    }  }}

Run / test manually

bash
npm installFRESHDEPS_API_BASE=http://localhost:3100 node server.js

The server speaks JSON-RPC over stdio (StdioServerTransport).

Env

VarPurpose
FRESHDEPS_API_BASEbackend base URL (default prod)
GOATCOUNTER_CODEoptional fire-and-forget usage analytics

Source: README.md at commit e43d8cb

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts