MCP Dependency Doctor

io.github.petrovicistefanv0.1.1更新于 Oct 9, 2026

Read-only npm dependency diagnostics for AI coding agents.

已验证STDIO仅桌面Developer ToolsSecurity & Monitoring

概览

AI 生成的概览

为 AI 编程助手提供只读的 npm 依赖诊断，包括清单、审计、过期版本和包健康信息。

功能
通过 stdio 暴露四个只读工具：dependency_inventory 列出清单与锁文件中的精确版本（含传递依赖）；dependency_audit 返回 npm audit 的 JSON 报告（含传递依赖漏洞）；dependency_outdated 报告当前、期望和最新版本；package_health 报告弃用状态、发布时长、engines 和 peer 要求。项目工具接受相对于 MCP_PROJECT_ROOT 的 projectPath。它从不执行 install、audit fix 或包生命周期脚本。
适用场景
适合助手在不修改文件的前提下检查 npm 项目的依赖树、排查已知漏洞或规划升级顺序。面向使用 package-lock.json v2 或 v3 的 npm 项目。
运行要求
通过 npx 或 Node.js 22+ 与 npm 在本地运行。需将 MCP_PROJECT_ROOT 设为项目目录。审计、过期和包健康工具需要访问所配置的 npm 注册表；本地服务器无需账号或 API 密钥。
安装前请注意
网络工具会向注册表披露包名和版本，注册表认证遵循用户的 npm 配置。项目路径通过 realpath 限制，请勿将服务器暴露给不受信任的远程客户端。应将注册表文本和包元数据视为不受信任的数据。无遥测或云端上传。托管 HTTP 路径需要 Authorization Bearer 令牌，并通过控制平面预留配额单位。

安装

在 SourceWeft 中

  1. 打开 控制台中的 MCP Dependency Doctor，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

MCP Dependency Doctor

Read-only dependency diagnostics for AI coding agents. Free local inventory and npm audits, without an account. Node.js 22+, npm required. Initial scope: npm projects with package-lock.json v2/v3.

Install in your AI client

Works with any MCP client over stdio; no account or API key needed for the local server.

Claude Code

sh
claude mcp add dependency-doctor -- npx -y mcp-dependency-doctor

Codex CLI

sh
codex mcp add dependency-doctor -- npx -y mcp-dependency-doctor

Claude Desktop, Cursor, Windsurf, Cline, Gemini CLI — add to the client's MCP config (claude_desktop_config.json, ~/.cursor/mcp.json, ~/.codeium/windsurf/mcp_config.json, Cline MCP settings, ~/.gemini/settings.json):

json
{  "mcpServers": {    "dependency-doctor": {      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

VS Code / GitHub Copilot — .vscode/mcp.json:

json
{  "servers": {    "dependency-doctor": {      "type": "stdio",      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

Zed — settings.json:

json
{  "context_servers": {    "dependency-doctor": {      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

Run from source

sh
git clone https://github.com/petrovicistefan/mcp-dependency-doctor.gitcd mcp-dependency-doctornpm testMCP_PROJECT_ROOT=/absolute/path/to/your/project node src/server.js

npm publication is pending. This implementation has no third-party runtime dependencies.

Claude Desktop / compatible stdio client

json
{  "mcpServers": {    "dependency-doctor": {      "command": "node",      "args": ["/absolute/path/to/mcp-dependency-doctor/src/server.js"],      "env": {"MCP_PROJECT_ROOT": "/absolute/path/to/your/project"}    }  }}

Tools

ToolPurposeNetwork
dependency_inventoryManifest + exact lockfile versions, including transitive dependenciesNo
dependency_auditnpm audit JSON report, including transitive vulnerabilitiesConfigured npm registry
dependency_outdatedCurrent, wanted and latest versions from npmConfigured npm registry
package_healthPublic package deprecation, release age, engines and peer requirementsregistry.npmjs.org

Project tools accept projectPath, relative to MCP_PROJECT_ROOT. Example agent request: “Audit this project, inspect deprecated packages and suggest an upgrade order. Do not change files.”

The server never runs install, audit fix, or package lifecycle scripts. Network tools disclose package names and versions to registries. Registry authentication follows the user's npm configuration. Public package health does not use npm credentials. Project paths are confined through realpath; do not expose the server to untrusted remote clients. Treat registry text and package metadata as untrusted data, never instructions. No telemetry or cloud uploads.

Limitations

MVP uses legacy MCP stdio protocol revisions through 2025-11-25. The 2026-07-28 stateless protocol is not implemented. Official SDK migration and interoperability testing with real clients are planned before publication.

Node and peer requirements are reported, not resolved: there is no full compatibility solver yet. Old releases are a maintenance signal, not proof of abandonment. No automatic remediation. npm audit coverage depends on the registry and lockfile. npm network operations time out after 45 seconds and fail explicitly; an incomplete audit is never reported as clean. Remote registry smoke tests were blocked in the development environment; unit tests use deterministic fixtures.

Hosted path (quotas via control plane)

The local stdio MCP stays fully useful without an account. Quotas apply only on a separate hosted HTTP process that reserves units on mcp-control-plane before analysis.

sh
cp .env.example .env   # set CONTROL_PLANE_URLnpm run start:hosted   # default 127.0.0.1:3101
MethodPathBody
GET/healthLiveness
POST/v1/package-health{ "requestId", "name" }
POST/v1/inventory{ "requestId", "packageJson", "lockfile"? }

Requires Authorization: Bearer mcp_…. Hosted dependency_audit / dependency_outdated are not in this MVP. Manifests and package names stay on the hosted host; control-plane sees only product, requestId, and units.

Roadmap and commercial boundary

Free: local inventory, basic audit and health diagnostics without signup. Pro (planned): cloud history, monitoring, team dashboard and reports; no paid plan is live yet. Hosted quotas use the control-plane path above; local counters are not used for paid enforcement.

Next: official MCP SDK; semver-aware Node/peer compatibility; upgrade plan; pnpm/yarn; MCP Registry manifest once repository and npm ownership are verified; shared cloud auth/billing. No server.json claiming unpublished npm artifacts is included.

Development

sh
npm testnpm run checknpm pack --dry-run

Protocol: https://modelcontextprotocol.io/specification/2025-11-25 Audit: https://docs.npmjs.com/cli/v11/commands/npm-audit/

来源：README.md，提交 40bd026

工具

0
工具元数据尚未被收录。

版本历史

1
  1. v0.1.1最新Oct 9, 2026