English Français العربية

Depscope

Communauté Santé

Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.

Code source Documentation

Installation

Les étapes d'installation sont dans la documentation ci-dessous. Documentation

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. DepScope
  2. Quick start (MCP)
  3. What it does
  4. REST API
  5. Why
  6. Pricing
  7. Open source vs proprietary
  8. Links
  9. License

DepScope

Package Intelligence for AI Agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Live at depscope.dev · 8.4M+ packages · 42K+ vulnerabilities (99% EPSS-enriched) · zero auth · free

Quick start (MCP)

Claude Desktop / Cursor / Windsurf — remote
{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}
Claude Code / local — stdio
{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

The MCP server source is at cuttalo/depscope-mcp (AGPL-3.0).

What it does

22 MCP tools across 19 package ecosystems:

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

ToolPurpose
check_packageFull safety check: deprecation · vulnerabilities · health · recommendation
check_maliciousMalicious-package detector
check_typosquatTyposquat detection vs popular names
package_existsHallucination detector (404 = LLM invented it)
get_health_score0–100 health score with breakdown
get_vulnerabilitiesVulnerabilities + severity scoring
find_alternativesSuggested alternatives for deprecated/abandoned packages
get_breaking_changesMajor-version migration notes
get_known_bugsKnown issues for a package
compare_packagesSide-by-side comparison
check_compatibilityStack-level compatibility check
resolve_errorError message → likely cause + fix
install_commandVerified install command for the target ecosystem
get_latest_versionLatest stable version + maturity signal
pin_safeSuggested safe version pin
get_trust_signalsMulti-signal trust score
get_migration_pathStep-by-step upgrade plan
scan_projectBulk scan of dependency manifests
check_bulkFast pre-flight filter for batches
get_trendingTrending packages by ecosystem
get_package_promptCompact LLM-friendly summary
contact_depscopeReport a missing package or false positive

REST API

Same data, plain HTTPS — no MCP client needed.

curl https://depscope.dev/api/check/npm/lodash
curl https://depscope.dev/api/check/pypi/requests
curl https://depscope.dev/api/check/cargo/serde

Full reference: depscope.dev/integrate

Why

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it can hit an attacker's typosquat. DepScope verifies every package before install.

Read more: depscope.dev/why

Pricing

Free. No auth required. Generous rate limits.

If you need higher quotas, SLA, or on-prem deployment, contact us at depscope@cuttalo.com.

Open source vs proprietary

This repository is a landing page with documentation only.

This split lets us keep the client free, auditable, and community-extensible while sustaining the infrastructure that powers it.

License

This README and accompanying landing files: CC-BY-4.0. MCP client SDK: AGPL-3.0 (see cuttalo/depscope-mcp). Backend service: proprietary.

Built by Cuttalo srl · Italy 🇮🇹

Questions fréquentes

Qu'est-ce que Depscope ?

Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.

Comment installer Depscope ?

Suivez les étapes d'installation de sa documentation, affichée sur cette page et dans son dépôt.

Depscope est-il open source ?

Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.

Qui maintient Depscope ?

Il est publié par cuttalo. AI.tn le référence sans le maintenir ni le recommander.

Issu des listes communautaires awesome-mcp-servers et du dépôt GitHub du projet. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.