English Français العربية

DepScope

Official registry Developer tools

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

Source code Website Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "depscope": {
            "type": "http",
            "url": "https://mcp.depscope.dev/mcp"
        }
    }
}
NPM package depscope-mcp
Claude Code 
claude mcp add depscope -- npx -y depscope-mcp@0.9.0
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "depscope": {
            "command": "npx",
            "args": [
                "-y",
                "depscope-mcp@0.9.0"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. DepScope MCP Server
  2. What's new in v0.9.0
  3. Why this exists
  4. Quick start
  5. Tools (22)
  6. Ecosystems (19)
  7. Pricing
  8. License
  9. Links

DepScope MCP Server

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

  • The 19-ecosystem coverage list
  • An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
  • Three pillars: token-saving, energy-saving, security
  • Standard invocation flow: check_malicious → check_typosquat → check_package → install_command

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}
Local (stdio via npx)
{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Tools (22)

ToolPurpose
check_packageFull package check: deprecated/CVE/health/recommendation
get_health_score0-100 score with breakdown (maintenance/popularity/security/maturity/community)
get_vulnerabilitiesOpen CVEs from OSV + KEV/EPSS
package_existsHallucination detector (404 = LLM invented it)
find_alternativesCurated alternatives for deprecated/abandoned packages
get_typosquatSuspicious name similarity check
get_breaking_changesMigration plan between versions
get_bugsKnown bugs from GitHub issues
compare_packagesSide-by-side health/license/vuln comparison
resolve_errorMap error message → likely cause + fix
search_errorsFind similar error reports across ecosystems
check_compatStack compatibility check
get_latest_versionLatest stable + maturity signal
... and 9 morefull list in tools.js

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

Frequently asked questions

What is DepScope?

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

How do I install DepScope?

It runs as a remote server. In Claude Code: claude mcp add --transport http depscope 'https://mcp.depscope.dev/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does DepScope need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is DepScope open source?

Its code is public on GitHub, but the repository does not declare a standard license.

Who maintains DepScope?

It is published by cuttalo. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.