DepScope is a package intelligence MCP server providing 22 tools across 19 ecosystems, helping AI agents make safe, informed dependency decisions by preventing hallucinations, catching vulnerabilities, and stopping supply-chain attacks.

Security & Safety

• Malware detection — Check packages against OpenSSF/OSV malicious package lists

• Typosquat detection — Identify if a package name is a typosquat (e.g. lodsh vs lodash)

• Vulnerability lookup — Retrieve CVEs/OSV advisories with CVSS scores and fix versions

• Bulk pre-flight check — Batch validate multiple packages at once (existence, typosquats, malicious flags)

Package Intelligence

• Full health report — Machine-readable JSON with score, vulnerabilities, maintainers, and recommendation

• LLM-optimized brief — Plain-text summary with ~75% fewer tokens and a SAFE/AVOID/URGENT/MALICIOUS verdict

• Health score — Quick 0–100 score for go/no-go decisions

• Package existence check — Boolean guard against hallucinated package names

• Latest version — Latest published version and deprecation status

• Install commands — Canonical install commands across package managers

Vulnerability & Version Management

• Pin safe version — Find the highest version below a chosen CVE severity tier within semver constraints

• Breaking changes — List breaking changes between two major versions

• Migration path — Prescriptive plan (with code diffs) for switching to a replacement package

• Known bugs — Non-CVE bugs for a specific package version

Project & Stack Analysis

• Scan project — Audit a full dependency list with per-package health and prioritized actions (REMOVE NOW / URGENT / REPLACE / REVIEW)

• Compare packages — Side-by-side comparison of 2–10 packages (health, vulns, downloads, maintainers)

• Check compatibility — Verify if a multi-package version combination works together

• Find alternatives — Curated replacements for deprecated or unhealthy packages

Trust, Discovery & Support

• Trust signals — Maintainer bus factor, OpenSSF Scorecard, quality metrics, and SLSA/Sigstore provenance

• Resolve errors — Map error messages or stack traces to verified fixes

• Trending packages — Live trending packages with rank-delta and weekly growth metrics

• Submit tickets — Report bugs, security findings, anomalies, or partnership inquiries

Provides package intelligence for the CocoaPods ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the Composer ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the Homebrew ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the JSR (JavaScript Registry) ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the Julia ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the npm ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the NuGet ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the PyPI ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the RubyGems ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.

Provides package intelligence for the Swift ecosystem, including vulnerability checks, health scores, alternatives, and lockfile ingestion.