English Français العربية

Depscope

مجتمعي الصحة

Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.

الشيفرة المصدرية التوثيق

التثبيت

خطوات التثبيت موجودة في التوثيق أدناه. التوثيق

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. DepScope
  2. Quick start (MCP)
  3. What it does
  4. REST API
  5. Why
  6. Pricing
  7. Open source vs proprietary
  8. Links
  9. License

DepScope

Package Intelligence for AI Agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Live at depscope.dev · 8.4M+ packages · 42K+ vulnerabilities (99% EPSS-enriched) · zero auth · free

Quick start (MCP)

Claude Desktop / Cursor / Windsurf — remote
{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}
Claude Code / local — stdio
{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

The MCP server source is at cuttalo/depscope-mcp (AGPL-3.0).

What it does

22 MCP tools across 19 package ecosystems:

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

ToolPurpose
check_packageFull safety check: deprecation · vulnerabilities · health · recommendation
check_maliciousMalicious-package detector
check_typosquatTyposquat detection vs popular names
package_existsHallucination detector (404 = LLM invented it)
get_health_score0–100 health score with breakdown
get_vulnerabilitiesVulnerabilities + severity scoring
find_alternativesSuggested alternatives for deprecated/abandoned packages
get_breaking_changesMajor-version migration notes
get_known_bugsKnown issues for a package
compare_packagesSide-by-side comparison
check_compatibilityStack-level compatibility check
resolve_errorError message → likely cause + fix
install_commandVerified install command for the target ecosystem
get_latest_versionLatest stable version + maturity signal
pin_safeSuggested safe version pin
get_trust_signalsMulti-signal trust score
get_migration_pathStep-by-step upgrade plan
scan_projectBulk scan of dependency manifests
check_bulkFast pre-flight filter for batches
get_trendingTrending packages by ecosystem
get_package_promptCompact LLM-friendly summary
contact_depscopeReport a missing package or false positive

REST API

Same data, plain HTTPS — no MCP client needed.

curl https://depscope.dev/api/check/npm/lodash
curl https://depscope.dev/api/check/pypi/requests
curl https://depscope.dev/api/check/cargo/serde

Full reference: depscope.dev/integrate

Why

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it can hit an attacker's typosquat. DepScope verifies every package before install.

Read more: depscope.dev/why

Pricing

Free. No auth required. Generous rate limits.

If you need higher quotas, SLA, or on-prem deployment, contact us at depscope@cuttalo.com.

Open source vs proprietary

This repository is a landing page with documentation only.

This split lets us keep the client free, auditable, and community-extensible while sustaining the infrastructure that powers it.

License

This README and accompanying landing files: CC-BY-4.0. MCP client SDK: AGPL-3.0 (see cuttalo/depscope-mcp). Backend service: proprietary.

Built by Cuttalo srl · Italy 🇮🇹

الأسئلة الشائعة

ما هو Depscope؟

Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.

كيف أثبّت Depscope؟

اتبع خطوات التثبيت في توثيقه المعروض في هذه الصفحة وفي مستودعه.

هل Depscope مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون Depscope؟

ينشره cuttalo. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من القوائم المجتمعية awesome-mcp-servers ومستودع المشروع على GitHub. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.