Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Depfender MCP Server scan the npm package express for security threats"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Add to your Cursor MCP settings:
{
"mcpServers": {
"depfender": {
"command": "npx",
"args": ["@depfenderdev/mcp"]
}
}
}claude mcp add depfender -- npx @depfenderdev/mcpAdd to your VS Code MCP settings (.vscode/mcp.json):
{
"mcpServers": {
"depfender": {
"command": "npx",
"args": ["@depfenderdev/mcp"]
}
}
}Related MCP server: GuardianMCP
scan_packageScans a package for data exfiltration and security threats.
Parameters:
package (required) — package name (e.g., lodash)
version (optional) — version to scan (defaults to latest)
ecosystem (optional) — package ecosystem: npm, pypi, cargo, maven (default: npm)
npm install
npm run buildVariable | Required | Description |
| Yes | Backend API URL (e.g., |
| Yes | Backend API secret ( |
Add to your MCP settings (e.g., Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"depfender": {
"command": "node",
"args": ["/path/to/mcp/dist/index.js"],
"env": {
"DEPFENDER_API_URL": "http://localhost:3000",
"DEPFENDER_API_KEY": "your-api-secret"
}
}
}
}npm test # Run all tests
npm run test:watch # Watch modeE2E tests require DEPFENDER_API_KEY and a running backend:
DEPFENDER_API_KEY=your-secret DEPFENDER_API_URL=http://localhost:3000 npm testnpm run dev # Run with tsx (no build needed)
npm run build # Compile TypeScriptGitHub Discussions — Questions and ideas
Twitter/X — Updates and announcements
Website — Full documentation
This server cannot be deployed
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
Protects AI coding agents from installing malicious open source packages. Every npm and PyPI package is checked against SafeDep’s real-time threat intelligence before installation.
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
