Dependency Health MCP

io.github.ux-xd由 GitHub 帳號 ux-xd 發布v0.1.1更新於 Oct 24, 2026

Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

一個遠端 MCP 伺服器，讓助理查詢八種生態系統中套件的相依性健康狀況，以及執行環境和作業系統的生命週期終止日期。

可以做什麼
檢查單一套件是否已棄用、已封存、已停滯，查詢指定版本的公告與建議替代品，涵蓋 npm、PyPI、crates.io、RubyGems、Go、Maven、NuGet 與 Packagist。一次呼叫稽核整個 package.json 或 requirements.txt，或最多 25 個套件的明確清單，提供每個套件的結論與彙總。查詢執行環境、作業系統、資料庫或框架版本的支援與終止日期，包括最新修補、LTS 標記與距終止天數。
適用情境
在固定、升級、分支或稽核相依套件之前使用，或在決定選用哪個 Node、Python、Ubuntu、PostgreSQL 等版本、或判斷已部署版本是否仍受支援時使用。
執行需求
遠端 Streamable HTTP 端點；無需帳號、API 金鑰或身分驗證。需要能連線至該伺服器及其上游登錄庫的網路。每次工具呼叫都必須提供一句描述使用者目標的 task_context。
安裝前請注意
task_context 欄位被描述為此免費服務了解代理需求的方式，應視為傳送給第三方的資料，避免填入機密或敏感資訊。它不是弱點掃描器、授權合規工具或熱門度排名，也無法查看私有登錄庫或隨原始碼附帶的程式碼。所有工具皆為唯讀。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Dependency Health MCP，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.ux-xd%2Fdephealth/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "dependency-health": {
      "type": "http",
      "url": "https://dephealth.dsh.sh/mcp"
    }
  }
}

README

Dependency Health MCP

Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates. Remote MCP server over Streamable HTTP at https://dephealth.dsh.sh/mcp. Free, no API key. Tools: package_health, deps_audit, runtime_eol. The tool list is fixed per version.

One call answers whether a package is still alive: a verdict (deprecated, archived, stale, active or unknown) with the evidence behind it — registry deprecation (per-version on npm, go.mod Deprecated/retract for Go, NuGet deprecation, Packagist abandoned), yanked releases, repository archived and last-push dates, maintainer and dependent counts, known advisories for the exact version, and what replaced it. Covers npm, PyPI, crates.io, RubyGems, Go modules, Maven, NuGet and Packagist through ecosyste.ms, the native registries and deps.dev, all keyless. deps_audit takes a whole package.json or requirements.txt (up to 25 packages) and runtime_eol reports endoflife.date support and EOL dates for runtimes and OSes. Free, no key, no account; every response lists the upstream calls it made.

Use when: Before pinning, upgrading or auditing a dependency: package_health returns whether it is deprecated, archived, stale or active with the raw registry evidence, advisories for the version you use and the replacement if there is one; deps_audit does the same for a whole manifest; runtime_eol says whether a Node, Python, OS or database version is still supported and when it dies.

Not for: Not a vulnerability scanner (advisory ids only, no CVSS triage or reachability), not license compliance, not a popularity ranking, and it cannot see private registries or vendored code.

Quick install (Claude Code): claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user

Live server: https://dephealth.dsh.sh

Docs

Upstreams

Optional

Tools

ToolPurposeEffects
package_healthIs this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.read-only, open-world, idempotent
deps_auditHealth verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.read-only, open-world, idempotent
runtime_eolSupport and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.read-only, open-world, idempotent

Every tool takes task_context: one sentence on what the user is trying to do. It is required.

package_health

Is this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.

Input schema:

json
{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "ecosystem": {      "type": "string",      "enum": [        "npm",        "pypi",        "cargo",        "rubygems",        "go",        "maven",        "nuget",        "packagist"      ],      "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"    },    "name": {      "type": "string",      "minLength": 1,      "maxLength": 200,      "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""    },    "version": {      "description": "The exact version you use or intend to pin; enables per-version advisories and deprecation. Omit for the latest.",      "type": "string",      "maxLength": 80    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "ecosystem",    "name",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json
{  "ecosystem": "npm",  "name": "request",  "task_context": "example: Is this package alive? One verdict — deprecated, archived, s"}

deps_audit

Health verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.

Input schema:

json
{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "packages": {      "description": "Explicit list of packages; combine with or instead of `manifest`.",      "maxItems": 25,      "type": "array",      "items": {        "type": "object",        "properties": {          "ecosystem": {            "type": "string",            "enum": [              "npm",              "pypi",              "cargo",              "rubygems",              "go",              "maven",              "nuget",              "packagist"            ],            "description": "npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package)"          },          "name": {            "type": "string",            "minLength": 1,            "maxLength": 200,            "description": "Package name as the registry spells it: \"@scope/name\", \"requests\", \"serde\", \"rails\", \"github.com/gorilla/mux\", \"org.apache.commons:commons-lang3\", \"Newtonsoft.Json\", \"monolog/monolog\""          },          "version": {            "type": "string",            "maxLength": 80          }        },        "required": [          "ecosystem",          "name"        ],        "additionalProperties": false      }    },    "manifest": {      "description": "Raw package.json (dependencies, devDependencies, peer, optional) or requirements.txt text; other formats are reported as unparsed.",      "type": "string",      "maxLength": 60000    },    "manifest_kind": {      "default": "auto",      "type": "string",      "enum": [        "auto",        "package.json",        "requirements.txt"      ]    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "manifest_kind",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json
{  "manifest": "{\"dependencies\":{\"request\":\"^2.88.2\",\"lodash\":\"4.17.20\",\"left-pad\":\"^1.3.0\"}}",  "task_context": "example: Health verdict for every package in a manifest or a list, in"}

runtime_eol

Support and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.

Input schema:

json
{  "$schema": "http://json-schema.org/draft-07/schema#",  "type": "object",  "properties": {    "product": {      "type": "string",      "minLength": 1,      "maxLength": 60,      "description": "endoflife.date product name or alias: \"nodejs\" (or \"node\"), \"python\", \"ubuntu\", \"postgresql\", \"django\", \"java\", \"rails\", \"go\", \"php\", \"redis\""    },    "cycle": {      "description": "One release cycle to report, e.g. \"22\" for Node 22, \"3.12\" for Python, \"24.04\" for Ubuntu. Omit for every cycle.",      "type": "string",      "maxLength": 30    },    "task_context": {      "type": "string",      "minLength": 1,      "maxLength": 500,      "description": "One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need."    }  },  "required": [    "product",    "task_context"  ],  "additionalProperties": false}

Example arguments:

json
{  "product": "nodejs",  "cycle": "22",  "task_context": "example: Support and end-of-life dates for a runtime, OS, database or"}

Install

Endpoint: https://dephealth.dsh.sh/mcp (Streamable HTTP, MCP 2026-07-28 with 2025-era fallback). Authentication: none.

Claude Code
claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user
Cursor (~/.cursor/mcp.json)
json
{  "mcpServers": {    "dephealth": {      "url": "https://dephealth.dsh.sh/mcp"    }  }}
VS Code / Copilot (user mcp.json)
json
{  "servers": {    "dephealth": {      "type": "http",      "url": "https://dephealth.dsh.sh/mcp"    }  }}

or code --add-mcp '{"name":"dephealth","type":"http","url":"https://dephealth.dsh.sh/mcp"}'

Claude Desktop / claude.ai

Settings → Connectors → Add custom connector → URL https://dephealth.dsh.sh/mcp, Authentication: None.

ChatGPT

Settings → Connectors → Add custom connector → https://dephealth.dsh.sh/mcp. Desktop app / Codex share ~/.codex/config.toml:

toml
[mcp_servers.dephealth]url = "https://dephealth.dsh.sh/mcp"
Codex CLI (~/.codex/config.toml)
toml
[mcp_servers.dephealth]url = "https://dephealth.dsh.sh/mcp"
Gemini CLI
gemini mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user

(settings.json uses httpUrl, not url.)

Windsurf (~/.codeium/windsurf/mcp_config.json)
json
{  "mcpServers": {    "dephealth": {      "serverUrl": "https://dephealth.dsh.sh/mcp"    }  }}
Cline
json
{  "mcpServers": {    "dephealth": {      "type": "streamableHttp",      "url": "https://dephealth.dsh.sh/mcp"    }  }}
Continue (.continue/mcpServers/dephealth.yaml)
yaml
name: dephealthmcpServers:  - name: dephealth    type: streamable-http    url: https://dephealth.dsh.sh/mcp
Zed (settings.json)
json
{  "context_servers": {    "dephealth": {      "source": "custom",      "command": "npx",      "args": [        "-y",        "mcp-remote",        "https://dephealth.dsh.sh/mcp"      ]    }  }}
Any MCP client

Streamable HTTP endpoint: https://dephealth.dsh.sh/mcp

json
{  "mcpServers": {    "dephealth": {      "url": "https://dephealth.dsh.sh/mcp"    }  }}

This page documents a server. It does not ask the reader to change any rules file, memory file, or host configuration.

Run it yourself

npm install && npm start            # http://127.0.0.1:8080/mcpdocker compose up -d --build        # same, in a containernode scripts/smoke.mjs http://127.0.0.1:8080 package_health '{}'

Built with the MCP server kit (kit/): Streamable HTTP MCP plus agent-readable docs (llms.txt, server.json, install pages, a REST twin), all from one manifest (servers/dephealth/mcp.factory.json). This repo is the server logic only; no telemetry is collected or sent by this code. MIT.

來源：README.md，提交 9392a2f

工具

3

package_health

Is this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.

輸入參數name必填versionecosystem必填task_context必填

deps_audit

Health verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.

輸入參數manifestpackagestask_context必填manifest_kind

runtime_eol

Support and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.

輸入參數cycleproduct必填task_context必填

版本歷史

1
  1. v0.1.1最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分