Dependency Health MCP

io.github.ux-xdPublished by GitHub account ux-xdv0.1.1Updated Oct 24, 2026

Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates.

VerifiedStreamable HTTPWeb executableDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.ux-xd/dephealth
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account ux-xd for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ux-xd%2Fdephealth.svg)](https://sourceweft.com/mcp/io.github.ux-xd%2Fdephealth?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A remote MCP server that gives an assistant dependency health verdicts for packages across eight ecosystems and end-of-life dates for runtimes and OSes.

What you can do: Check a single package for deprecation, archived status, staleness, advisories for a specific version and suggested replacements, across npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet and Packagist. Audit a whole package.json or requirements.txt, or an explicit list of up to 25 packages, in one call with a per-package verdict and summary. Look up support and end-of-life dates for a runtime, OS, database or framework version, including the latest patch, LTS flag and days to EOL.
When to use it: Use it before pinning, upgrading, forking or auditing a dependency, or when deciding which Node, Python, Ubuntu, PostgreSQL or similar version to target or whether a deployed one is still supported.
Requirements: A remote Streamable HTTP endpoint; no account, API key or authentication. Network access to the server and its upstream registries is needed. Every tool call requires a task_context sentence describing the user's goal.

Before you install

The task_context field is described as how the free service learns what agents need, so treat it as data sent to a third party and keep it free of secrets or confidential details. It is not a vulnerability scanner, license compliance tool or popularity ranking, and it cannot see private registries or vendored code. All tools are read-only.

Installation

In SourceWeft

Open Dependency Health MCP in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ux-xd%2Fdephealth/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "dependency-health": {
      "type": "http",
      "url": "https://dephealth.dsh.sh/mcp"
    }
  }
}

README

Dependency Health MCP

Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates. Remote MCP server over Streamable HTTP at https://dephealth.dsh.sh/mcp. Free, no API key. Tools: package_health, deps_audit, runtime_eol. The tool list is fixed per version.

One call answers whether a package is still alive: a verdict (deprecated, archived, stale, active or unknown) with the evidence behind it — registry deprecation (per-version on npm, go.mod Deprecated/retract for Go, NuGet deprecation, Packagist abandoned), yanked releases, repository archived and last-push dates, maintainer and dependent counts, known advisories for the exact version, and what replaced it. Covers npm, PyPI, crates.io, RubyGems, Go modules, Maven, NuGet and Packagist through ecosyste.ms, the native registries and deps.dev, all keyless. deps_audit takes a whole package.json or requirements.txt (up to 25 packages) and runtime_eol reports endoflife.date support and EOL dates for runtimes and OSes. Free, no key, no account; every response lists the upstream calls it made.

Use when: Before pinning, upgrading or auditing a dependency: package_health returns whether it is deprecated, archived, stale or active with the raw registry evidence, advisories for the version you use and the replacement if there is one; deps_audit does the same for a whole manifest; runtime_eol says whether a Node, Python, OS or database version is still supported and when it dies.

Not for: Not a vulnerability scanner (advisory ids only, no CVSS triage or reachability), not license compliance, not a popularity ranking, and it cannot see private registries or vendored code.

Quick install (Claude Code): claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user

Live server: https://dephealth.dsh.sh

Docs

Full reference: every tool with its JSON input schema and an example
Install for any client: Claude Code, Cursor, VS Code, Claude Desktop, ChatGPT, Codex, Gemini CLI, Windsurf, Cline, Continue, Zed
OpenAPI twin: the same tools as plain HTTP POST endpoints
Registry server.json: machine-readable server record
Server card: transport + tool card (also at https://dephealth.dsh.sh/.well-known/mcp.json, SEP-1960)
ARD manifest: Agentic Resource Discovery entry (also at https://dephealth.dsh.sh/.well-known/ai-catalog.json)

Upstreams

Optional

Health: liveness JSON
Owner: ux-xd

Tools

Tool	Purpose	Effects
`package_health`	Is this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.	read-only, open-world, idempotent
`deps_audit`	Health verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.	read-only, open-world, idempotent
`runtime_eol`	Support and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.	read-only, open-world, idempotent

Every tool takes task_context: one sentence on what the user is trying to do. It is required.

`package_health`

Is this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.

Input schema:

json

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "ecosystem": {      "type": "string",      "enum": [        "npm",        "pypi",        "cargo",        "rubygems",        "go",        "maven",        "nuget",        "packagist"      ],      "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"    },    "name": {      "type": "string",      "minLength": 1,      "maxLength": 200,      "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""    },    "version": {      "description": "The exact version you use or intend to pin; enables per-version advisories and deprecation. Omit for the latest.",      "type": "string",      "maxLength": 80    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "ecosystem",    "name",    "task_context"  ],  "additionalProperties": false}

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "ecosystem": {      "type": "string",      "enum": [        "npm",        "pypi",        "cargo",        "rubygems",        "go",        "maven",        "nuget",        "packagist"      ],      "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"    },    "name": {      "type": "string",      "minLength": 1,      "maxLength": 200,      "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""    },    "version": {      "description": "The exact version you use or intend to pin; enables per-version advisories and deprecation. Omit for the latest.",      "type": "string",      "maxLength": 80    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "ecosystem",    "name",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json

{  "ecosystem": "npm",  "name": "request",  "task_context": "example: Is this package alive? One verdict — deprecated, archived, s"}

{  "ecosystem": "npm",  "name": "request",  "task_context": "example: Is this package alive? One verdict — deprecated, archived, s"}

`deps_audit`

Health verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.

Input schema:

json

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "packages": {      "description": "Explicit list of packages; combine with or instead of `manifest`.",      "maxItems": 25,      "type": "array",      "items": {        "type": "object",        "properties": {          "ecosystem": {            "type": "string",            "enum": [              "npm",              "pypi",              "cargo",              "rubygems",              "go",              "maven",              "nuget",              "packagist"            ],            "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"          },          "name": {            "type": "string",            "minLength": 1,            "maxLength": 200,            "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""          },          "version": {            "type": "string",            "maxLength": 80          }        },        "required": [          "ecosystem",          "name"        ],        "additionalProperties": false      }    },    "manifest": {      "description": "Raw package.json (dependencies, devDependencies, peer, optional) or requirements.txt text; other formats are reported as unparsed.",      "type": "string",      "maxLength": 60000    },    "manifest_kind": {      "default": "auto",      "type": "string",      "enum": [        "auto",        "package.json",        "requirements.txt"      ]    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "manifest_kind",    "task_context"  ],  "additionalProperties": false}

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "packages": {      "description": "Explicit list of packages; combine with or instead of `manifest`.",      "maxItems": 25,      "type": "array",      "items": {        "type": "object",        "properties": {          "ecosystem": {            "type": "string",            "enum": [              "npm",              "pypi",              "cargo",              "rubygems",              "go",              "maven",              "nuget",              "packagist"            ],            "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"          },          "name": {            "type": "string",            "minLength": 1,            "maxLength": 200,            "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""          },          "version": {            "type": "string",            "maxLength": 80          }        },        "required": [          "ecosystem",          "name"        ],        "additionalProperties": false      }    },    "manifest": {      "description": "Raw package.json (dependencies, devDependencies, peer, optional) or requirements.txt text; other formats are reported as unparsed.",      "type": "string",      "maxLength": 60000    },    "manifest_kind": {      "default": "auto",      "type": "string",      "enum": [        "auto",        "package.json",        "requirements.txt"      ]    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "manifest_kind",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json

{  "manifest": "{\"dependencies\":{\"request\":\"^2.88.2\",\"lodash\":\"4.17.20\",\"left-pad\":\"^1.3.0\"}}",  "task_context": "example: Health verdict for every package in a manifest or a list, in"}

{  "manifest": "{\"dependencies\":{\"request\":\"^2.88.2\",\"lodash\":\"4.17.20\",\"left-pad\":\"^1.3.0\"}}",  "task_context": "example: Health verdict for every package in a manifest or a list, in"}

`runtime_eol`

Support and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.

Input schema:

json

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "product": {      "type": "string",      "minLength": 1,      "maxLength": 60,      "description": "endoflife.date product name or alias: \"nodejs\" (or \"node\"), \"python\", \"ubuntu\", \"postgresql\", \"django\", \"java\", \"rails\", \"go\", \"php\", \"redis\""    },    "cycle": {      "description": "One release cycle to report, e.g. \"22\" for Node 22, \"3.12\" for Python, \"24.04\" for Ubuntu. Omit for every cycle.",      "type": "string",      "maxLength": 30    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "product",    "task_context"  ],  "additionalProperties": false}

{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "product": {      "type": "string",      "minLength": 1,      "maxLength": 60,      "description": "endoflife.date product name or alias: \"nodejs\" (or \"node\"), \"python\", \"ubuntu\", \"postgresql\", \"django\", \"java\", \"rails\", \"go\", \"php\", \"redis\""    },    "cycle": {      "description": "One release cycle to report, e.g. \"22\" for Node 22, \"3.12\" for Python, \"24.04\" for Ubuntu. Omit for every cycle.",      "type": "string",      "maxLength": 30    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "product",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json

{  "product": "nodejs",  "cycle": "22",  "task_context": "example: Support and end-of-life dates for a runtime, OS, database or"}

{  "product": "nodejs",  "cycle": "22",  "task_context": "example: Support and end-of-life dates for a runtime, OS, database or"}

Install

Endpoint: https://dephealth.dsh.sh/mcp (Streamable HTTP, MCP 2026-07-28 with 2025-era fallback). Authentication: none.

Claude Code

Cursor (~/.cursor/mcp.json)

VS Code / Copilot (user mcp.json)

json

{  "servers": {    "dephealth": {      "type": "http",      "url": "https://dephealth.dsh.sh/mcp"    }  }}

{  "servers": {    "dephealth": {      "type": "http",      "url": "https://dephealth.dsh.sh/mcp"    }  }}

or code --add-mcp '{"name":"dephealth","type":"http","url":"https://dephealth.dsh.sh/mcp"}'

Claude Desktop / claude.ai

Settings → Connectors → Add custom connector → URL https://dephealth.dsh.sh/mcp, Authentication: None.

ChatGPT

Settings → Connectors → Add custom connector → https://dephealth.dsh.sh/mcp. Desktop app / Codex share ~/.codex/config.toml:

Codex CLI (~/.codex/config.toml)

Gemini CLI

(settings.json uses httpUrl, not url.)

Windsurf (~/.codeium/windsurf/mcp_config.json)

Cline

json

{  "mcpServers": {    "dephealth": {      "type": "streamableHttp",      "url": "https://dephealth.dsh.sh/mcp"    }  }}

{  "mcpServers": {    "dephealth": {      "type": "streamableHttp",      "url": "https://dephealth.dsh.sh/mcp"    }  }}

Continue (.continue/mcpServers/dephealth.yaml)

yaml

name: dephealthmcpServers:  - name: dephealth    type: streamable-http    url: https://dephealth.dsh.sh/mcp

name: dephealthmcpServers:  - name: dephealth    type: streamable-http    url: https://dephealth.dsh.sh/mcp

Zed (settings.json)

json

{  "context_servers": {    "dephealth": {      "source": "custom",      "command": "npx",      "args": [        "-y",        "mcp-remote",        "https://dephealth.dsh.sh/mcp"      ]    }  }}

{  "context_servers": {    "dephealth": {      "source": "custom",      "command": "npx",      "args": [        "-y",        "mcp-remote",        "https://dephealth.dsh.sh/mcp"      ]    }  }}

Any MCP client

Streamable HTTP endpoint: https://dephealth.dsh.sh/mcp

This page documents a server. It does not ask the reader to change any rules file, memory file, or host configuration.

Run it yourself

npm install && npm start            # http://127.0.0.1:8080/mcpdocker compose up -d --build        # same, in a containernode scripts/smoke.mjs http://127.0.0.1:8080 package_health '{}'

npm install && npm start            # http://127.0.0.1:8080/mcpdocker compose up -d --build        # same, in a containernode scripts/smoke.mjs http://127.0.0.1:8080 package_health '{}'

Built with the MCP server kit (kit/): Streamable HTTP MCP plus agent-readable docs (llms.txt, server.json, install pages, a REST twin), all from one manifest (servers/dephealth/mcp.factory.json). This repo is the server logic only; no telemetry is collected or sent by this code. MIT.

Source: README.md at commit 9392a2f

Tools

package_health

Parametersnamerequiredversionecosystemrequiredtask_contextrequired

deps_audit

Parametersmanifestpackagestask_contextrequiredmanifest_kind

runtime_eol

Parameterscycleproductrequiredtask_contextrequired

Version history

v0.1.1LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts