Depscope
Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.
Install
The installation steps are in the documentation below. Documentation
Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
Contents
DepScope
Package Intelligence for AI Agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.
→ Live at depscope.dev · 8.4M+ packages · 42K+ vulnerabilities (99% EPSS-enriched) · zero auth · free
Quick start (MCP)
Claude Desktop / Cursor / Windsurf — remote
{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}Claude Code / local — stdio
{
"mcpServers": {
"depscope": {
"command": "npx",
"args": ["-y", "depscope-mcp"]
}
}
}The MCP server source is at cuttalo/depscope-mcp (AGPL-3.0).
What it does
22 MCP tools across 19 package ecosystems:
npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia
| Tool | Purpose |
|---|---|
check_package | Full safety check: deprecation · vulnerabilities · health · recommendation |
check_malicious | Malicious-package detector |
check_typosquat | Typosquat detection vs popular names |
package_exists | Hallucination detector (404 = LLM invented it) |
get_health_score | 0–100 health score with breakdown |
get_vulnerabilities | Vulnerabilities + severity scoring |
find_alternatives | Suggested alternatives for deprecated/abandoned packages |
get_breaking_changes | Major-version migration notes |
get_known_bugs | Known issues for a package |
compare_packages | Side-by-side comparison |
check_compatibility | Stack-level compatibility check |
resolve_error | Error message → likely cause + fix |
install_command | Verified install command for the target ecosystem |
get_latest_version | Latest stable version + maturity signal |
pin_safe | Suggested safe version pin |
get_trust_signals | Multi-signal trust score |
get_migration_path | Step-by-step upgrade plan |
scan_project | Bulk scan of dependency manifests |
check_bulk | Fast pre-flight filter for batches |
get_trending | Trending packages by ecosystem |
get_package_prompt | Compact LLM-friendly summary |
contact_depscope | Report a missing package or false positive |
REST API
Same data, plain HTTPS — no MCP client needed.
curl https://depscope.dev/api/check/npm/lodash
curl https://depscope.dev/api/check/pypi/requests
curl https://depscope.dev/api/check/cargo/serdeFull reference: depscope.dev/integrate
Why
LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it can hit an attacker's typosquat. DepScope verifies every package before install.
Read more: depscope.dev/why
Pricing
Free. No auth required. Generous rate limits.
If you need higher quotas, SLA, or on-prem deployment, contact us at depscope@cuttalo.com.
Open source vs proprietary
This repository is a landing page with documentation only.
- MCP server (client SDK) — open source, AGPL-3.0: → cuttalo/depscope-mcp → npm: depscope-mcp
- Backend (API + intelligence layer) — proprietary, hosted at
depscope.dev.
This split lets us keep the client free, auditable, and community-extensible while sustaining the infrastructure that powers it.
Links
- Homepage · depscope.dev
- API docs · depscope.dev/integrate
- MCP server source · cuttalo/depscope-mcp
- npm · depscope-mcp
- Glama listing · glama.ai/mcp/servers/cuttalo/depscope
- Awesome MCP · punkpeye/awesome-mcp-servers
License
This README and accompanying landing files: CC-BY-4.0. MCP client SDK: AGPL-3.0 (see cuttalo/depscope-mcp). Backend service: proprietary.
Built by Cuttalo srl · Italy 🇮🇹
Frequently asked questions
What is Depscope?
Package intelligence across many ecosystems: health, vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives and breaking changes.
How do I install Depscope?
Follow the installation steps in its documentation, shown on this page and in its repository.
Is Depscope open source?
Its code is public on GitHub, but the repository does not declare a standard license.
Who maintains Depscope?
It is published by cuttalo. AI.tn lists it but does not maintain or endorse it.
From the community awesome-mcp-servers lists and the project's GitHub repository. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.