English Français العربية

DepScope

Registre officiel Outils de développement

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

Code source Site web Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "depscope": {
            "type": "http",
            "url": "https://mcp.depscope.dev/mcp"
        }
    }
}
NPM package depscope-mcp
Claude Code 
claude mcp add depscope -- npx -y depscope-mcp@0.9.0
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "depscope": {
            "command": "npx",
            "args": [
                "-y",
                "depscope-mcp@0.9.0"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. DepScope MCP Server
  2. What's new in v0.9.0
  3. Why this exists
  4. Quick start
  5. Tools (22)
  6. Ecosystems (19)
  7. Pricing
  8. License
  9. Links

DepScope MCP Server

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

  • The 19-ecosystem coverage list
  • An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
  • Three pillars: token-saving, energy-saving, security
  • Standard invocation flow: check_malicious → check_typosquat → check_package → install_command

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}
Local (stdio via npx)
{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Tools (22)

ToolPurpose
check_packageFull package check: deprecated/CVE/health/recommendation
get_health_score0-100 score with breakdown (maintenance/popularity/security/maturity/community)
get_vulnerabilitiesOpen CVEs from OSV + KEV/EPSS
package_existsHallucination detector (404 = LLM invented it)
find_alternativesCurated alternatives for deprecated/abandoned packages
get_typosquatSuspicious name similarity check
get_breaking_changesMigration plan between versions
get_bugsKnown bugs from GitHub issues
compare_packagesSide-by-side health/license/vuln comparison
resolve_errorMap error message → likely cause + fix
search_errorsFind similar error reports across ecosystems
check_compatStack compatibility check
get_latest_versionLatest stable + maturity signal
... and 9 morefull list in tools.js

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

Questions fréquentes

Qu'est-ce que DepScope ?

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

Comment installer DepScope ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour DepScope ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

DepScope est-il open source ?

Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.

Qui maintient DepScope ?

Il est publié par cuttalo. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.