MCP Dependency Doctor

io.github.petrovicistefanv0.1.1更新於 Oct 9, 2026

Read-only npm dependency diagnostics for AI coding agents.

已驗證STDIO僅桌面Developer ToolsSecurity & Monitoring

概覽

AI 產生的概覽

為 AI 程式助理提供唯讀的 npm 相依性診斷，涵蓋清單、稽核、過期版本與套件健康資訊。

功能
透過 stdio 提供四個唯讀工具：dependency_inventory 列出清單與鎖定檔中的精確版本（含遞移相依性）；dependency_audit 回傳 npm audit 的 JSON 報告（含遞移相依性弱點）；dependency_outdated 回報目前、期望與最新版本；package_health 回報棄用狀態、發佈時間、engines 與 peer 需求。專案工具接受相對於 MCP_PROJECT_ROOT 的 projectPath。它從不執行 install、audit fix 或套件生命週期指令碼。
適用情境
適合助理在不修改檔案的前提下檢查 npm 專案的相依性樹、排查已知弱點或規劃升級順序。鎖定使用 package-lock.json v2 或 v3 的 npm 專案。
執行需求
透過 npx 或 Node.js 22+ 與 npm 在本機執行。需將 MCP_PROJECT_ROOT 設為專案目錄。稽核、過期與套件健康工具需要連線至所設定的 npm 登錄；本機伺服器不需帳號或 API 金鑰。
安裝前請注意
網路工具會向登錄揭露套件名稱與版本，登錄驗證依循使用者的 npm 設定。專案路徑透過 realpath 限制，請勿將伺服器暴露給不受信任的遠端用戶端。應將登錄文字與套件中介資料視為不受信任的資料。無遙測或雲端上傳。託管 HTTP 路徑需要 Authorization Bearer 權杖，並透過控制平面保留配額單位。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 MCP Dependency Doctor，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

MCP Dependency Doctor

Read-only dependency diagnostics for AI coding agents. Free local inventory and npm audits, without an account. Node.js 22+, npm required. Initial scope: npm projects with package-lock.json v2/v3.

Install in your AI client

Works with any MCP client over stdio; no account or API key needed for the local server.

Claude Code

sh
claude mcp add dependency-doctor -- npx -y mcp-dependency-doctor

Codex CLI

sh
codex mcp add dependency-doctor -- npx -y mcp-dependency-doctor

Claude Desktop, Cursor, Windsurf, Cline, Gemini CLI — add to the client's MCP config (claude_desktop_config.json, ~/.cursor/mcp.json, ~/.codeium/windsurf/mcp_config.json, Cline MCP settings, ~/.gemini/settings.json):

json
{  "mcpServers": {    "dependency-doctor": {      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

VS Code / GitHub Copilot — .vscode/mcp.json:

json
{  "servers": {    "dependency-doctor": {      "type": "stdio",      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

Zed — settings.json:

json
{  "context_servers": {    "dependency-doctor": {      "command": "npx",      "args": [        "-y",        "mcp-dependency-doctor"      ]    }  }}

Run from source

sh
git clone https://github.com/petrovicistefan/mcp-dependency-doctor.gitcd mcp-dependency-doctornpm testMCP_PROJECT_ROOT=/absolute/path/to/your/project node src/server.js

npm publication is pending. This implementation has no third-party runtime dependencies.

Claude Desktop / compatible stdio client

json
{  "mcpServers": {    "dependency-doctor": {      "command": "node",      "args": ["/absolute/path/to/mcp-dependency-doctor/src/server.js"],      "env": {"MCP_PROJECT_ROOT": "/absolute/path/to/your/project"}    }  }}

Tools

ToolPurposeNetwork
dependency_inventoryManifest + exact lockfile versions, including transitive dependenciesNo
dependency_auditnpm audit JSON report, including transitive vulnerabilitiesConfigured npm registry
dependency_outdatedCurrent, wanted and latest versions from npmConfigured npm registry
package_healthPublic package deprecation, release age, engines and peer requirementsregistry.npmjs.org

Project tools accept projectPath, relative to MCP_PROJECT_ROOT. Example agent request: “Audit this project, inspect deprecated packages and suggest an upgrade order. Do not change files.”

The server never runs install, audit fix, or package lifecycle scripts. Network tools disclose package names and versions to registries. Registry authentication follows the user's npm configuration. Public package health does not use npm credentials. Project paths are confined through realpath; do not expose the server to untrusted remote clients. Treat registry text and package metadata as untrusted data, never instructions. No telemetry or cloud uploads.

Limitations

MVP uses legacy MCP stdio protocol revisions through 2025-11-25. The 2026-07-28 stateless protocol is not implemented. Official SDK migration and interoperability testing with real clients are planned before publication.

Node and peer requirements are reported, not resolved: there is no full compatibility solver yet. Old releases are a maintenance signal, not proof of abandonment. No automatic remediation. npm audit coverage depends on the registry and lockfile. npm network operations time out after 45 seconds and fail explicitly; an incomplete audit is never reported as clean. Remote registry smoke tests were blocked in the development environment; unit tests use deterministic fixtures.

Hosted path (quotas via control plane)

The local stdio MCP stays fully useful without an account. Quotas apply only on a separate hosted HTTP process that reserves units on mcp-control-plane before analysis.

sh
cp .env.example .env   # set CONTROL_PLANE_URLnpm run start:hosted   # default 127.0.0.1:3101
MethodPathBody
GET/healthLiveness
POST/v1/package-health{ "requestId", "name" }
POST/v1/inventory{ "requestId", "packageJson", "lockfile"? }

Requires Authorization: Bearer mcp_…. Hosted dependency_audit / dependency_outdated are not in this MVP. Manifests and package names stay on the hosted host; control-plane sees only product, requestId, and units.

Roadmap and commercial boundary

Free: local inventory, basic audit and health diagnostics without signup. Pro (planned): cloud history, monitoring, team dashboard and reports; no paid plan is live yet. Hosted quotas use the control-plane path above; local counters are not used for paid enforcement.

Next: official MCP SDK; semver-aware Node/peer compatibility; upgrade plan; pnpm/yarn; MCP Registry manifest once repository and npm ownership are verified; shared cloud auth/billing. No server.json claiming unpublished npm artifacts is included.

Development

sh
npm testnpm run checknpm pack --dry-run

Protocol: https://modelcontextprotocol.io/specification/2025-11-25 Audit: https://docs.npmjs.com/cli/v11/commands/npm-audit/

來源：README.md，提交 40bd026

工具

0
工具後設資料尚未被收錄。

版本歷史

1
  1. v0.1.1最新Oct 9, 2026