Dependency Fitness Mcp

io.github.TweedBeetlePublished by GitHub account TweedBeetlev0.1.1Updated Oct 24, 2026

npm dependency fitness: deprecated/yanked/superseded + verified safe migration target.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that gives a coding assistant a cross-checked fitness verdict on an npm package, including whether it is deprecated and what to migrate to.

What you can do
Check a single npm package, at latest or a given version, range or dist-tag, for deprecation, yank, malicious markers and supersession, with a confidence score and warnings. Infer and verify a safe migration target from the maintainer's deprecation notice, refusing to guess when no successor can be confirmed. Audit a batch of packages or the contents of a package.json, up to 50 per call, and return per-package verdicts plus a summary for a CI or pre-merge gate. Reconcile the npm registry, deps.dev, OSV.dev and GitHub, flagging disagreement and catching archived repositories behind active-looking packages.
When to use it
Use it when an assistant is about to add or upgrade an npm dependency and should first confirm the package is maintained and safe, or find a replacement for a deprecated one. Also useful as a batch check before merging dependency changes.
Requirements
Runs locally over stdio via npx or a global install; needs Node 18 or newer. No account or key is required, but network access to the npm registry, deps.dev, OSV.dev and GitHub is needed. An optional GITHUB_TOKEN environment variable raises the GitHub rate limit for the archived-repository check.
Before you install
It reads public package metadata and sends package names to third-party services (npm, deps.dev, OSV.dev, GitHub). Verdicts are advisory and confidence-scored; an unreachable source lowers confidence rather than failing, so treat low-confidence results with care. It only covers npm, and the optional GITHUB_TOKEN is a credential to keep private.

Installation

In SourceWeft

  1. Open Dependency Fitness Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

dependency-fitness-mcp — npm dependency fitness verdicts for coding agents

Is this npm package safe to depend on — and if not, what do I move to?

An MCP server that gives a coding agent a cross-validated fitness verdict for an npm package before it writes or upgrades a dependency:

jsonc
{  "deprecated": true,  "yanked": false,  "malicious": false,  "superseded_by": { "latest": "14.0.0", "majors_behind": 13, "breaking_boundary": true },  "safe_migration_target": {    "package": "uuid",    "version": "14.0.0",    "rationale": "Maintainer's deprecation notice recommends 'uuid' (verified present and not deprecated).",    "confidence": "high"  },  "confidence": "high",  "last_verified": "2026-06-05T18:10:31Z"}

It reconciles four free, sanctioned sources — the npm registry, Google's deps.dev, OSV.dev, and GitHub — into one confidence-scored answer, and infers a safe migration target when a package is deprecated or superseded.

Why this exists (and what it deliberately isn't)

"Is it deprecated?" is already free — deps.dev serves that flag, and several free MCP servers already answer "what's the latest version?". This tool does the part nobody serves as data:

  • Migration-target inference. When a package is deprecated, it parses the maintainer's own deprecation notice for a named successor, then verifies that successor actually exists and isn't itself deprecated before recommending it.
  • Cross-validation, not a guess. It reconciles deprecation across the npm registry and deps.dev, catches "deceptive deprecation" (registry says active but the GitHub repo is archived), and flags disagreement with a confidence level instead of inventing an answer.
  • It refuses to guess. If a package is deprecated but no successor can be established, it says exactly that (low confidence) rather than recommending a plausible-but-wrong replacement. A wrong "use X instead" ships broken code.
  • Anti-slopsquatting. A non-existent / hallucinated package name returns a clear "not found" verdict (with an OSV malicious-record check), so an agent won't silently install a hallucinated dependency.

This is intentionally a narrow tool: the deprecation / yank / supersede / migration middle, where the free incumbents sit on either side but leave the seam open.

Tools

check_package_fitness

Single-package verdict. Input: package (e.g. request, @babel/core), optional version (exact, semver range, or dist-tag — omit for latest). Output: the full Verdict (structured) plus a human-readable summary.

audit_dependencies

Batch verdict for a CI / pre-merge gate. Input: packages (e.g. ["[email protected]", "request"]) and/or the raw contents of a package.json. Output: a per-package verdict array plus a summary (how many deprecated / malicious / vulnerable / behind). Capped at 50 packages per call.

Install / connect

Requires Node ≥ 18. Run via npx (no install) or install globally.

Claude Code:

bash
claude mcp add dependency-fitness -- npx -y dependency-fitness-mcp

Claude Desktop / Cursor / any MCP client (mcp.json / claude_desktop_config.json):

jsonc
{  "mcpServers": {    "dependency-fitness": { "command": "npx", "args": ["-y", "dependency-fitness-mcp"] }  }}

Optional env: GITHUB_TOKEN raises the GitHub rate limit (used only for the archived-repo cross-check); everything else needs no key.

Run locally / develop

bash
npm installnpm run build        # tsc -> dist/npm test             # vitest (offline, deterministic synthesis tests)npm run smoke        # live: hits the real registries, prints verdictsnpm run dev          # run the server from source over stdio

How a verdict is built

        ┌─ npm registry ── per-version `deprecated` string, dist-tags, repo URL  (authoritative)query ──┼─ deps.dev ────── isDeprecated / deprecatedReason / advisoryKeys        (corroborator)        ├─ OSV.dev ─────── advisories + MAL-* malicious markers + "fixed in"      (corroborator)        └─ GitHub ──────── archived flag + last-push recency                       (deceptive-deprecation check)                    │                    ▼   cross-validate deprecation ─→ infer + verify migration target ─→ confidence + warnings ─→ Verdict

npm is the source of truth; the others corroborate. A corroborator being unreachable lowers confidence and adds a warning — it never fabricates a signal.

Status

v0.1 — thin, working, npm-only. This is a fast public validation of whether a narrow "agent-data endpoint via MCP directory" can find its users organically. Roadmap and the explicit kill criterion live in KILL_CRITERION.md. Next layers (documented, not yet built): PyPI, and de-facto-successor inference by mining what high-trust packages actually depend on now.

License

MIT © Christo Wilken / 9592 Solutions UG. Built in public.

Source: README.md at commit b057e04

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts