Dep

io.github.rog0xPublished by GitHub account rog0xv1.0.1Updated Oct 24, 2026

License check, outdated deps, security for AI agents

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.rog0x/dep
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account rog0x for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.rog0x%2Fdep.svg)](https://sourceweft.com/mcp/io.github.rog0x%2Fdep?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A local MCP server that lets an assistant inspect a Node.js project's dependencies: licenses, outdated versions, dependency trees, bundle size and security.

What you can do: Analyze dependency licenses, flagging copyleft and unknown licenses and compatibility issues, from a project's package.json and lockfile data, without installing node_modules for size estimates. Find outdated packages by comparing installed or specified versions against the latest on npm, categorized as major, minor or patch. Build and display the dependency tree, including transitive packages, maximum depth and circular dependencies. Estimate total bundle size by querying the Bundlephobia API for each production dependency. Audit dependencies for known vulnerabilities via npm audit or the npm registry advisory API, with severity levels and fix recommendations.
When to use it: Useful when reviewing a Node.js project's dependency health before a release or upgrade, checking license compliance, or triaging known vulnerabilities and outdated packages from within an assistant session.
Requirements: Runs locally as a Node.js process (npm package @rog0x/mcp-dep-tools, built with npm install and npm run build) and is configured in the desktop client with a node command pointing at the built entry file. Each tool needs an absolute project_dir path containing a package.json. Network access is needed for npm registry, Bundlephobia and advisory queries.

Before you install

Tools read project files and send dependency names and versions to external services (npm registry, Bundlephobia, advisory API). The security audit may run npm audit in the project. No credentials are declared, but review what project paths you expose.

Installation

In SourceWeft

Open Dep in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-dep-tools

MCP server providing dependency and package management tools for AI agents. Analyze licenses, find outdated packages, visualize dependency trees, estimate bundle sizes, and audit security vulnerabilities — all from your AI assistant.

Tools

dep_check_licenses

Analyze licenses of all dependencies in a project. Lists each dependency's license type, flags copyleft (GPL) and unknown licenses, and checks for compatibility issues.

dep_find_outdated

Check which dependencies are outdated. Compares installed or specified versions against the latest on npm, categorizes updates as major/minor/patch, and shows how many days since the latest version was published.

dep_analyze_tree

Build and display the dependency tree. Shows direct dependencies and their transitive sub-dependencies, calculates maximum depth, detects circular dependencies, and counts total transitive packages.

dep_analyze_size

Estimate total bundle size from package.json without installing node_modules. Queries the Bundlephobia API for each production dependency to get minified and gzipped sizes.

dep_security_audit

Check dependencies for known security vulnerabilities. Runs npm audit when a lockfile is present, otherwise queries the npm registry advisory API directly. Reports severity levels, affected version ranges, and fix recommendations.

Setup

Usage with Claude Desktop

Add to your Claude Desktop config:

json

{  "mcpServers": {    "dep-tools": {      "command": "node",      "args": ["path/to/mcp-dep-tools/dist/index.js"]    }  }}

{  "mcpServers": {    "dep-tools": {      "command": "node",      "args": ["path/to/mcp-dep-tools/dist/index.js"]    }  }}

All tools accept a single parameter

project_dir (string, required): Absolute path to the project directory containing a package.json.

License

MIT

Source: README.md at commit 594c2c3

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.0.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.