Connect DepScope and your agent gets 22 tools, among them check_bulk, check_compatibility, check_malicious. It answers at https://mcp.depscope.dev/mcp over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 10 September 2026; the last check, on 19 October 2026, succeeded.
Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
check_bulk | Fast pre-flight filter for a batch of (ecosystem, package) pairs. DB-only, <100ms for 100 items. USE WHEN: about to emit `npm install a b c …` or `pip install a b c …` — catches hallucinated names, stdlib, typos, and known-bad in ONE call. Inputs: items |
check_compatibility | Is this specific multi-package version combo verified to work together? USE WHEN: pinning a stack (next@15 + react@19 + node@22); before recommending a version matrix. RETURNS: {compatible, conflicts[], notes}. Inputs: packages |
check_malicious | Supply-chain malware check against OpenSSF/OSV. USE WHEN: about to suggest install of an unvetted/unfamiliar package; name came from a blog/tutorial. Call BEFORE check_package for untrusted pkgs. RETURNS: {is_malicious, threat_tier, source} Inputs: ecosystem, package |
check_package | Full machine-readable JSON report (~2k tokens). USE WHEN: you need to programmatically parse specific fields (CI gating, UI, sub-field extraction). Otherwise prefer get_package_prompt. RETURNS: {package, health:{score}, vulnerabilities[], l Inputs: ecosystem, package, version |
check_typosquat | Typosquat detector. USE WHEN: name differs from a well-known package by 1-2 chars (`lodsh`, `reqeusts`); copy-paste from unreliable source; downloads near zero but name looks familiar. RETURNS: {is_typosquat, likely_target, confidence}. Inputs: ecosystem, package |
compare_packages | Side-by-side comparison (health, vulns, downloads, maintainers, last release) of 2-10 packages in the same ecosystem. USE WHEN: 'X vs Y' / 'should I pick X or Y'. RETURNS: table-shaped JSON, one row per package. Inputs: ecosystem, packages |
contact_depscope | Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (`bug`), requesting a new pkg/ecosystem index (`listing`), disclosing a DepScope security issue (`security`), flagging a concrete mismatch in another t Inputs: kind, email, subject, body, name, company |
find_alternatives | Curated replacements for deprecated/unhealthy packages, including stdlib built-ins (e.g. `fs.rm` for rimraf). USE WHEN: pkg flagged AVOID/URGENT; 'what to use instead of X'; before guessing a replacement name. RETURNS: {alternatives[]: {nam Inputs: ecosystem, package |
get_breaking_changes | Breaking changes between two majors of the SAME package (`next@14`→`15`). USE WHEN: user is bumping a major; before recommending a major upgrade. Different from get_migration_path (same pkg vs. different pkg). RETURNS: {breaking_changes[]: Inputs: ecosystem, package, from_version, to_version |
get_health_score | Single 0-100 health score — cheapest go/no-go gate (>=70 safe). USE WHEN: CI gating or pkg already screened for malware/typos. NOT a first screen — run check_malicious + check_typosquat first. For a verbal verdict use get_package_prompt. RE Inputs: ecosystem, package |
get_known_bugs | Non-CVE known bugs for a specific package version. USE WHEN: unexpected behavior that is NOT a security issue; a pinned version misbehaves. RETURNS: {bugs[]: {title, fixed_in, workaround}}. Inputs: ecosystem, package, version |
get_latest_version | Latest published version + deprecation flag — the cheapest call. USE WHEN: only a version string matters (pinning a dep, answering 'what version of X'). If you also need health/vulns use check_package. RETURNS: {latest, deprecated, publishe Inputs: ecosystem, package |
get_migration_path | Prescriptive migration plan between DIFFERENT packages — rationale + literal code diff + breaking changes + effort minutes. USE WHEN: replacing `request`→`axios`, `moment`→`dayjs`, `flask`→`fastapi`, etc.; both endpoints known. RETURNS: {ra Inputs: ecosystem, from_package, to_package |
get_package_prompt | LLM-optimised package brief — plain text ~300 tokens (~75% cheaper than JSON). Verdict (SAFE/AVOID/URGENT/MALICIOUS) + health + vulns + alternatives + maintainer alerts. USE WHEN: you want to reason over a package and drop the output direct Inputs: ecosystem, package |
get_trending | Live trending packages with rank-delta and weekly growth %. USE WHEN: 'what is rising in npm/PyPI/Cargo right now'; recommendation not biased by training-data cutoff. RETURNS: {items[]: {name, rank, rank_delta, weekly_growth_pct}}. Inputs: ecosystem, scope, limit |
get_trust_signals | One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release velocity, publish security), and SLSA/Sigstore provenance. USE WHEN: deep-vetti Inputs: ecosystem, package |
get_vulnerabilities | CVE/OSV advisories affecting the latest (or specified) version. USE WHEN: security-sensitive project; user asks 'any CVEs in X'; you already know the pkg exists. RETURNS: {vulnerability_count, vulnerabilities[]: {id, severity, cvss, fixed_i Inputs: ecosystem, package |
install_command | Canonical install command(s) across every package manager of the ecosystem (npm/pnpm/yarn/bun, pip/uv/poetry, cargo, go, composer, maven+gradle, nuget, …). USE WHEN: emitting an install line and you want correct flags. RETURNS: {primary, va Inputs: ecosystem, package, version |
package_exists | Boolean registry existence check. USE WHEN: about to emit a package name in an install command but unsure it exists; verifying a name generated from training data. RETURNS: {exists}. Inputs: ecosystem, package |
pin_safe | Highest version below the chosen CVE severity tier, respecting a semver constraint. USE WHEN: writing a package.json/requirements.txt line; resolving dependabot by lowest-risk patched version. RETURNS: {recommended_version, walk_log[]}. Inputs: ecosystem, package, min_severity, constraint, include_prerelease |
resolve_error | Map error OR free-text query to a verified fix. USE WHEN: user pastes a concrete error/stack (ENOENT, ImportError, build failure) — pass `error`. OR user describes a symptom ('webpack slow', 'pip stuck') — pass `query`. Always prefer this o Inputs: error, query, context, limit |
scan_project | Audit a project's dependencies in one shot. Returns a single-sentence `verdict` (e.g. "DO NOT INSTALL — 1 hallucinated: fastapi-turbo") that an agent can paste into its reply, plus per-package health/vulns/recommendation. Detects hallucinat Inputs: ecosystem, packages |
Every block below points at https://mcp.depscope.dev/mcp. Pick your client and copy.
claude mcp add --transport http depscope https://mcp.depscope.dev/mcp
{
"mcpServers": {
"depscope": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.depscope.dev/mcp"]
}
}
}{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}{
"servers": {
"depscope": {
"type": "http",
"url": "https://mcp.depscope.dev/mcp"
}
}
}{
"context_servers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}{
"mcpServers": {
"depscope": {
"serverUrl": "https://mcp.depscope.dev/mcp"
}
}
}{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}name: DepScope
version: 0.0.1
schema: v1
mcpServers:
- name: DepScope
type: streamable-http
url: https://mcp.depscope.dev/mcp{
"mcpServers": {
"depscope": {
"httpUrl": "https://mcp.depscope.dev/mcp"
}
}
}{
"mcpServers": {
"depscope": {
"type": "http",
"url": "https://mcp.depscope.dev/mcp"
}
}
}{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}goose://extension?url=https%3A%2F%2Fmcp.depscope.dev%2Fmcp&type=streamable_http&id=depscope&name=DepScope
It answered our last check on 19 October 2026 in 154 ms. Over 6 checks since 10 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
Yes. It is published by depscope.dev and served from mcp.depscope.dev, the vendor's own domain: https://mcp.depscope.dev/mcp.
22, as returned by the server's own tools/list on 11 September 2026: check_bulk, check_compatibility, check_malicious, check_package, check_typosquat, compare_packages, contact_depscope, find_alternatives, and 14 more.
It answered our last check on 19 October 2026 in 154 ms. Over 6 checks since 10 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://mcp.depscope.dev/mcp. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: dev.depscope. Endpoint host: mcp.depscope.dev. ARD identifier: urn:air:dev.depscope:mcp:mcp.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.