Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Depfender MCP Server scan the npm package express for security threats"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Add to your Cursor MCP settings:
{
"mcpServers": {
"depfender": {
"command": "npx",
"args": ["@depfenderdev/mcp"]
}
}
}claude mcp add depfender -- npx @depfenderdev/mcpAdd to your VS Code MCP settings (.vscode/mcp.json):
{
"mcpServers": {
"depfender": {
"command": "npx",
"args": ["@depfenderdev/mcp"]
}
}
}Related MCP server: GuardianMCP
scan_packageScans a package for data exfiltration and security threats.
Parameters:
package (required) — package name (e.g., lodash)
version (optional) — version to scan (defaults to latest)
ecosystem (optional) — package ecosystem: npm, pypi, cargo, maven (default: npm)
npm install
npm run buildVariable | Required | Description |
| Yes | Backend API URL (e.g., |
| Yes | Backend API secret ( |
Add to your MCP settings (e.g., Claude Desktop claude_desktop_config.json):
{
"mcpServers": {
"depfender": {
"command": "node",
"args": ["/path/to/mcp/dist/index.js"],
"env": {
"DEPFENDER_API_URL": "http://localhost:3000",
"DEPFENDER_API_KEY": "your-api-secret"
}
}
}
}npm test # Run all tests
npm run test:watch # Watch modeE2E tests require DEPFENDER_API_KEY and a running backend:
DEPFENDER_API_KEY=your-secret DEPFENDER_API_URL=http://localhost:3000 npm testnpm run dev # Run with tsx (no build needed)
npm run build # Compile TypeScriptGitHub Discussions — Questions and ideas
Twitter/X — Updates and announcements
Website — Full documentation
This server cannot be deployed
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Protects AI coding agents from installing malicious open source packages. Every npm and PyPI package is checked against SafeDep’s real-time threat intelligence before installation.
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
