English Français العربية

DepScope

السجل الرسمي أدوات المطورين

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "depscope": {
            "type": "http",
            "url": "https://mcp.depscope.dev/mcp"
        }
    }
}
NPM package depscope-mcp
Claude Code 
claude mcp add depscope -- npx -y depscope-mcp@0.9.0
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "depscope": {
            "command": "npx",
            "args": [
                "-y",
                "depscope-mcp@0.9.0"
            ]
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. DepScope MCP Server
  2. What's new in v0.9.0
  3. Why this exists
  4. Quick start
  5. Tools (22)
  6. Ecosystems (19)
  7. Pricing
  8. License
  9. Links

DepScope MCP Server

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

  • The 19-ecosystem coverage list
  • An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
  • Three pillars: token-saving, energy-saving, security
  • Standard invocation flow: check_malicious → check_typosquat → check_package → install_command

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}
Local (stdio via npx)
{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Tools (22)

ToolPurpose
check_packageFull package check: deprecated/CVE/health/recommendation
get_health_score0-100 score with breakdown (maintenance/popularity/security/maturity/community)
get_vulnerabilitiesOpen CVEs from OSV + KEV/EPSS
package_existsHallucination detector (404 = LLM invented it)
find_alternativesCurated alternatives for deprecated/abandoned packages
get_typosquatSuspicious name similarity check
get_breaking_changesMigration plan between versions
get_bugsKnown bugs from GitHub issues
compare_packagesSide-by-side health/license/vuln comparison
resolve_errorMap error message → likely cause + fix
search_errorsFind similar error reports across ecosystems
check_compatStack compatibility check
get_latest_versionLatest stable + maturity signal
... and 9 morefull list in tools.js

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

الأسئلة الشائعة

ما هو DepScope؟

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

كيف أثبّت DepScope؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج DepScope إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل DepScope مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون DepScope؟

ينشره cuttalo. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.