Dependency Health MCP
Server Details
Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates.
- Status
- Healthy
- Uptime
- 100.0% over 21 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- Repository
- ux-xd/dephealth-mcp
- GitHub Stars
- 0
- Server Listing
- Dependency Health MCP
TDQS
Scored across 3 tools
package_health and deps_audit both produce health verdicts and can look similar, but the descriptions clearly separate a single deep-dive from a batch manifest scan. runtime_eol is entirely distinct. An agent should rarely pick the wrong tool if it reads the descriptions.
All names are lowercase snake_case compounds with a target object plus a focus/attribute (deps_audit, package_health, runtime_eol), which is readable and predictable. There is a slight inconsistency in that audit implies an action while health/EOL are attributes, but no mixed casing or verb-style chaos.
Three tools is a compact but appropriate scope for a dependency-health server: batch audit, single-package evidence, and runtime EOL. Each tool earns its place and the count is within the ideal 3-15 range.
The core domain is covered well: bulk manifest health, deep single-package checks, and runtime/OS/DB/framework EOL. Minor gaps exist such as no built-in chunking or pagination for manifests larger than 25 packages, but agents can work around that by passing lists.
Available Tools
3 toolsdeps_auditARead-onlyIdempotentInspect
Health verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.
| Name | Required | Description | Default |
|---|---|---|---|
| manifest | No | Raw package.json (dependencies, devDependencies, peer, optional) or requirements.txt text; other formats are reported as unparsed. | |
| packages | No | Explicit list of packages; combine with or instead of `manifest`. | |
| task_context | Yes | One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need. | |
| manifest_kind | No | auto |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, open-world, non-destructive behavior. The description adds useful behavioral context: the 25-package call limit, the one-call nature, and a clear inventory of what the response contains. No contradiction with the annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence front-loads the core behavior and output detail, and the second gives a practical use case. It avoids repeating schema content unnecessarily.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no output schema, the description plus schema covers the required task_context, input formats, package limits, and response contents sufficiently for correct invocation. It lacks explicit edge-case discussion in the description itself, but the schema covers unparsed formats and package limits, so the definition is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so the baseline is 3. The description only loosely references manifest types and package lists, and does not add substantial meaning beyond what the schema already documents for the other parameters. The mention of package.json/requirements.txt slightly helps for the undocumented manifest_kind parameter, but not enough to push above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: producing a health verdict for every package in a manifest or list, with concrete output categories such as deprecated/archived/stale/active/unknown and version/age/advisory details. The 'in one call (≤25 packages)' scope clearly distinguishes it from a single-package sibling like package_health, and the manifest focus differentiates it from runtime_eol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases: reviewing a repository's package.json or requirements.txt before an upgrade, audit, or fork decision. It does not explicitly name alternatives or state when not to use it, but the bulk-audit framing implies the intended context clearly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
package_healthARead-onlyIdempotentInspect
Is this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name as the registry spells it: "@scope/name", "requests", "serde", "rails", "github.com/gorilla/mux", "org.apache.commons:commons-lang3", "Newtonsoft.Json", "monolog/monolog" | |
| version | No | The exact version you use or intend to pin; enables per-version advisories and deprecation. Omit for the latest. | |
| ecosystem | Yes | npm | pypi | cargo (crates.io) | rubygems | go (module path) | maven (group:artifact) | nuget | packagist (vendor/package) | |
| task_context | Yes | One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so no mutation warning is needed. The description adds useful context about the kind of evidence returned and how the result is tuned to the exact version, which is informative beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the core question and verdict are stated immediately, followed by a dense but organized evidence list. Every sentence adds value, and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, output verdict, evidence categories, ecosystems, and a clear usage trigger. With no output schema, the description does a good job explaining what callers will receive, though it could briefly mention expected behavior for malformed input or unsupported packages.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description provides useful context about the version-dependent evidence, but it does not add substantial meaning beyond the schema's own parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states what the tool does: it returns a package health verdict (deprecated, archived, stale, active, or unknown) along with supporting evidence. It is specific about the resource (package health across multiple ecosystems) but does not explicitly differentiate itself from the sibling tools deps_audit and runtime_eol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use it when choosing, pinning, or upgrading a dependency across a long list of ecosystems. It does not mention when not to use it or name alternatives, so it stops short of a full when/when-not comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_eolARead-onlyIdempotentInspect
Support and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.
| Name | Required | Description | Default |
|---|---|---|---|
| cycle | No | One release cycle to report, e.g. "22" for Node 22, "3.12" for Python, "24.04" for Ubuntu. Omit for every cycle. | |
| product | Yes | endoflife.date product name or alias: "nodejs" (or "node"), "python", "ubuntu", "postgresql", "django", "java", "rails", "go", "php", "redis" | |
| task_context | Yes | One sentence on what the user is ultimately trying to do (the task this call serves). Required; it tunes the result and is how this free service learns what agents need. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and non-destructive behavior. The description adds meaningful behavioral context by naming the data source (endoflife.date, 470+ products) and the exact output contents per cycle, including verdict, latest patch, LTS flag, and days to EOL. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the core purpose and output, then immediately gives practical usage guidance with concrete examples.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only lookup with no output schema, the description covers the purpose, output fields, supported product categories, and required task_context parameter. It could be more complete by explicitly contrasting with sibling tools or noting error behavior, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, documenting product, cycle, and task_context with examples and constraints. The description adds some useful product examples and explains that task_context tunes the result, but it does not substantially expand on what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning support and end-of-life dates for runtimes, OSes, databases, and frameworks, and enumerates the output details (verdict, latest patch, LTS flag, days to EOL). It does not explicitly distinguish itself from sibling tools like deps_audit or package_health, so it falls just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete 'Use when' scenarios: deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django version to target, or checking whether a deployed version is still safe. It provides clear context but does not mention when not to use it or name alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
- First observed
deps_audit - First observed
package_health - First observed
runtime_eol
Related MCP Connectors
Is this dependency current, licensed, deprecated, or already carrying a CVE?
Abandonment checks for WordPress, npm and PyPI packages, priced per call.
GitHub repo maintainability verdicts—maintained, slowing, at-risk, abandoned—via MCP.
Check exact npm/PyPI upgrades for evidence-backed breaking changes; query APIs and components.
Related MCP Servers
- AlicenseAqualityCmaintenanceChecks whether software dependencies (npm packages, GitHub Actions, MCP servers, Docker images) are alive, dormant, abandoned, archived, or deleted using dated observations from lastseen.dev.440 PyPIMIT
- FlicenseAqualityCmaintenancePackage intelligence for AI coding agents that checks npm and PyPI package health, deprecation, vulnerabilities, bundle size, and compares alternatives.5-
- AlicenseAqualityCmaintenanceChecks npm and PyPI packages for outdated versions, deprecation status, and breaking changes with cited sources, enabling AI agents to verify dependency freshness.13 npmISC
- FlicenseNot gradedqualityDmaintenanceProvides product lifecycle, release cycle, and End of Life (EOL) date information from endoflife.date.-
Glama MCP Gateway
Add one secure layer between your agents and this server.