DepScope

Name: DepScope
Author: dev.depscope

MCP serverMCP

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

by dev.depscoperepository ↗homepage ↗v0.9.24AGPL-3.0-or-later

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"depscope-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability11/18 checks ok

Tools observed via MCP handshake

check_malicious — Supply-chain malware check against OpenSSF/OSV. USE WHEN: about to suggest install of an unvetted/unfamiliar package; name came from a blog/tutorial. Call BEFOR
check_typosquat — Typosquat detector. USE WHEN: name differs from a well-known package by 1-2 chars (`lodsh`, `reqeusts`); copy-paste from unreliable source; downloads near zero
check_bulk — Fast pre-flight filter for a batch of (ecosystem, package) pairs. DB-only, <100ms for 100 items. USE WHEN: about to emit `npm install a b c …` or `pip install a
package_exists — Boolean registry existence check. USE WHEN: about to emit a package name in an install command but unsure it exists; verifying a name generated from training da
get_latest_version — Latest published version + deprecation flag — the cheapest call. USE WHEN: only a version string matters (pinning a dep, answering 'what version of X'). If you
get_health_score — Single 0-100 health score — cheapest go/no-go gate (>=70 safe). USE WHEN: CI gating or pkg already screened for malware/typos. NOT a first screen — run check_ma
install_command — Canonical install command(s) across every package manager of the ecosystem (npm/pnpm/yarn/bun, pip/uv/poetry, cargo, go, composer, maven+gradle, nuget, …). USE
get_package_prompt — LLM-optimised package brief — plain text ~300 tokens (~75% cheaper than JSON). Verdict (SAFE/AVOID/URGENT/MALICIOUS) + health + vulns + alternatives + maintaine
check_package — Full machine-readable JSON report (~2k tokens). USE WHEN: you need to programmatically parse specific fields (CI gating, UI, sub-field extraction). Otherwise pr
get_vulnerabilities — CVE/OSV advisories affecting the latest (or specified) version. USE WHEN: security-sensitive project; user asks 'any CVEs in X'; you already know the pkg exists
find_alternatives — Curated replacements for deprecated/unhealthy packages, including stdlib built-ins (e.g. `fs.rm` for rimraf). USE WHEN: pkg flagged AVOID/URGENT; 'what to use i
get_migration_path — Prescriptive migration plan between DIFFERENT packages — rationale + literal code diff + breaking changes + effort minutes. USE WHEN: replacing `request`→`axios
get_breaking_changes — Breaking changes between two majors of the SAME package (`next@14`→`15`). USE WHEN: user is bumping a major; before recommending a major upgrade. Different from
pin_safe — Highest version below the chosen CVE severity tier, respecting a semver constraint. USE WHEN: writing a package.json/requirements.txt line; resolving dependabot
scan_project — Audit a project's dependencies in one shot. Returns a single-sentence `verdict` (e.g. "DO NOT INSTALL — 1 hallucinated: fastapi-turbo") that an agent can paste
compare_packages — Side-by-side comparison (health, vulns, downloads, maintainers, last release) of 2-10 packages in the same ecosystem. USE WHEN: 'X vs Y' / 'should I pick X or Y
check_compatibility — Is this specific multi-package version combo verified to work together? USE WHEN: pinning a stack (next@15 + react@19 + node@22); before recommending a version
resolve_error — Map error OR free-text query to a verified fix. USE WHEN: user pastes a concrete error/stack (ENOENT, ImportError, build failure) — pass `error`. OR user descri
get_known_bugs — Non-CVE known bugs for a specific package version. USE WHEN: unexpected behavior that is NOT a security issue; a pinned version misbehaves. RETURNS: {bugs[]: {t
get_trust_signals — One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release
get_trending — Live trending packages with rank-delta and weekly growth %. USE WHEN: 'what is rising in npm/PyPI/Cargo right now'; recommendation not biased by training-data c
contact_depscope — Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (`bug`), requesting a new pkg/ecosystem index (`listing`), disclosing a

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registrydev.depscope/mcp

first seen 2 mo ago · fetched 16 h agoopen ↗

npm registrydepscope-mcp

first seen 2 mo ago · fetched 4 h agoopen ↗

Field history (12 recent events)

2 mo ago · declared · name → "DepScope"
2 mo ago · declared · summary → "Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free."
2 mo ago · declared · description → "Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free."
2 mo ago · declared · publisherName → "dev.depscope"
2 mo ago · declared · repoUrl → "https://github.com/cuttalo/depscope-mcp"
2 mo ago · declared · version → "0.9.24"
2 mo ago · declared · license → "AGPL-3.0-or-later"
2 mo ago · declared · summary → "Package Intelligence MCP server for AI agents. Stops hallucinated/malicious package installs across 19 ecosystems (npm,
2 mo ago · observed · packageFacts → {"name":"depscope-mcp","registry":"npm","publishedAt":"2026-05-05T01:22:05.494Z","latestVersion":"0.9.0","weeklyDownload
2 mo ago · declared · protocols → ["mcp"]
2 mo ago · declared · description → "Package Intelligence MCP server for AI agents. Stops hallucinated/malicious package installs across 19 ecosystems (npm,
2 mo ago · declared · publisherName → "depscope"

when	check	result	http	latency	detail
6 d ago	mcp initialize	failed	410	47 ms	http 410
13 d ago	mcp initialize	failed	410	37 ms	http 410
20 d ago	mcp initialize	failed	410	28 ms	http 410
24 d ago	mcp initialize	failed	410	35 ms	http 410
26 d ago	mcp initialize	failed	410	36 ms	http 410
27 d ago	mcp initialize	failed	410	56 ms	http 410
28 d ago	mcp initialize	failed	410	30 ms	http 410
28 d ago	mcp initialize	ok	200	33 ms	server depscope 0.9.0 · protocol 2025-06-18 · 22 tools
28 d ago	mcp initialize	ok	200	34 ms	server depscope 0.9.0 · protocol 2025-06-18 · 22 tools
29 d ago	mcp initialize	ok	200	57 ms	server depscope 0.9.0 · protocol 2025-06-18 · 22 tools

DepScope

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from