Skip to main content
Glama

Deps MCP Server

Open-source MCP server owned by Pawan Gunjkar (pawangunjkar@gmail.com · GitHub). MIT licensed.

Developers ask which package is vulnerable without opening npm, Maven, or the GitHub advisory site. The server detects the project type, runs the ecosystem audit, and can look up a GitHub Security Advisory for one package.

Sibling servers: github-mcp, db-mcp, agent-trace-mcp.

Project information

Item

Value

Package

pawangunjkar-deps-mcp

Runtime

Python 3.10+, FastMCP, stdio

Ecosystems

npm (npm audit), Maven (dependency:tree), Python manifests

Advisories

GitHub Advisory API (npm, maven, pip, nuget)

Writes

None. This server does not upgrade or install packages

Related MCP server: Dependency Checker MCP Server

Architecture

flowchart TB
  subgraph L1["Layer 1 — Editor"]
    IDE["Cursor or Claude Desktop"]
  end

  subgraph L2["Layer 2 — MCP"]
    SRV["deps-mcp"]
  end

  subgraph L3["Layer 3 — Project files"]
    NPM["package.json"]
    MVN["pom.xml"]
    PY["pyproject.toml or requirements.txt"]
  end

  subgraph L4["Layer 4 — Advisories"]
    GH["GitHub Advisory API"]
  end

  IDE -->|"deps_detect"| SRV
  IDE -->|"deps_npm_audit"| SRV
  IDE -->|"deps_maven_tree"| SRV
  SRV --> NPM
  SRV --> MVN
  SRV --> PY
  IDE -->|"deps_github_advisory"| SRV
  SRV --> GH
flowchart LR
  ROOT["Project root"] --> DET["deps_detect"]
  DET --> NPM["deps_npm_audit"]
  DET --> MVN["deps_maven_tree"]
  DET --> PY["deps_python_packages"]
  NPM --> ADV["deps_github_advisory"]
  MVN --> ADV

Tools

Tool

What it does

deps_detect

Finds npm, Maven, and Python manifests

deps_npm_audit

Runs npm audit --json and returns the first 40 vulnerable packages

deps_maven_tree

Runs mvn dependency:tree

deps_python_packages

Lists requirements.txt or shows pyproject.toml

deps_github_advisory

Looks up GHSA/CVE rows for one package

Set GITHUB_TOKEN for higher advisory rate limits. Set DEPS_ROOT when the chat does not pass a path.

Cursor

{
  "mcpServers": {
    "deps": {
      "command": "uv",
      "args": ["run", "--directory", "C:/AI_Workspaces/Anti_Workspace/deps-mcp", "server.py"],
      "env": {
        "DEPS_ROOT": "C:/AI_Workspaces/Anti_Workspace/enterprise-commerce-agents",
        "GITHUB_TOKEN": ""
      }
    }
  }
}

Available Tools

5 tools
deps_detectB

Detect npm, Maven, and Python manifests in a project directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It discloses the core function but not recursion behavior, what happens when no manifests are found, or whether the scan is recursive. The output schema covers return values, so basic behavior is clear but deeper context is absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, verb-first, with zero waste. Every word earns its place and the core function is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and an output schema, so the essentials are covered. Missing is usage context relative to the sibling analysis tools and behavioral details like recursion depth or empty-result handling. Acceptable for a simple tool but leaves routing to agent inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single 'path' parameter is undocumented in the schema itself. The phrase 'in a project directory' implies that path refers to the directory to scan, providing modest compensation. For a single obvious parameter this is adequate, though it remains implicit rather than explicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Detect' and precisely names the resource (npm, Maven, and Python manifests in a project directory), which clearly states the tool's function. It distinguishes itself from the sibling audit/tree tools in substance (discovery vs. analysis), though it doesn't explicitly name that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this discovery tool versus the sibling tools like deps_npm_audit, deps_maven_tree, or deps_python_packages. An agent has no hint that this tool is a manifest-detection first step that likely precedes those deeper analysis tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deps_github_advisoryC

Look up GitHub security advisories. ecosystem is npm, maven, pip, or nuget.

ParametersJSON Schema
NameRequiredDescriptionDefault
packageYes
ecosystemYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavior-disclosure burden. It implies a read operation with 'Look up' but does not mention output format, limits, error behavior, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The purpose is front-loadedament and the ecosystem clarification earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A tool with two required parameters and no annotations needs more context to be called reliably. The description covers allowed ecosystems but leaves 'package' under-specified and provides no usage or behavioral context beyond the bare lookup action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does add value for 'ecosystem' by enumerating supported values (npm, maven, pip, nuget). However, 'package' receives no explanation, and schema coverage is 0%, so only half the parameters are meaningfully described.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('Look up') and a specific resource ('GitHub security advisories'). It is unambiguous about what the tool does, but it does not explicitly differentiate it from sibling tools like deps_npm_audit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus the sibling tools. The description only lists allowed ecosystems, which gives context for inputs but not for tool selection or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deps_maven_treeC

Run mvn dependency:tree for a pom.xml in this directory or one level down.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It only states the command to run but does not disclose potential side effects (e.g., downloading dependencies, requiring network), failure modes, or whether it modifies files. The output is not described, relying on the output schema which is not visible here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the primary action. It wastes no words, though it could be longer to include essential usage details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that executes a command, the description lacks critical context: prerequisites (Maven installation), error handling, output format, and clear parameter usage. It is incomplete for an agent to invoke correctly, especially given the zero schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter 'path' with 0% description coverage. The description does not mention this parameter at all, leaving the agent without guidance on how to set it. The description's mention of directory scope might relate, but it is not explicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (run mvn dependency:tree) and the resource (pom.xml) with a specific location scope (this directory or one level down). This distinguishes it from sibling tools that target other ecosystems (npm, Python, GitHub advisories).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. It implies Maven usage via the command, but does not name any sibling tools or provide exclusion criteria. There is no guidance on when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deps_npm_auditA

Run npm audit --json and return severity counts plus the first 40 packages.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It is transparent about executing 'npm audit --json' and explicitly notes that only the first 40 packages are returned, which is a meaningful limitation. It does not mention network access or error behavior, but the core behavior is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence conveys the command, the output format, and the truncation limit. There is no filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the output schema covers return structure, the description omits the meaning of the sole parameter and provides no explicit usage guidance. For such a simple tool this is a notable gap; an agent would not know what path value to provide.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter, 'path', with 0% schema description coverage, and the description does not explain what 'path' means, whether it points to a directory, package.json, or something else. The description fails to compensate for the schema's lack of documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the specific command ('npm audit --json') and clearly states what it returns: severity counts plus the first 40 packages. This is a concrete verb+resource description that also differentiates it from sibling tools like deps_maven_tree or deps_python_packages by focusing on npm-specific auditing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for npm dependency audits, and the sibling names hint at alternatives for other ecosystems, but it never explicitly states when to use this tool versus deps_detect or deps_github_advisory. Context is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

deps_python_packagesC

List declared Python packages from requirements.txt or show pyproject.toml.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full behavioral disclosure. It only says 'List' or 'show', implying a read operation, but does not clarify that it reads local files, what happens if the files are missing, or whether any network calls are involved. No side effects or permissions are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no extraneous words, which is efficient. However, it is so brief that it omits necessary details, and the structure could be improved by front-loading an explanation of the parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although the tool is simple with one optional parameter and an output schema exists, the description lacks usage context, parameter semantics, and clarity on the pyproject.toml behavior. An agent would be uncertain what to pass as path and what the response will contain, making the description incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'path' parameter is entirely unexplained. The description does not mention what path refers to (directory, file path, etc.) or how the default empty string behaves. With 0% schema description coverage, the description adds no meaning to the parameter, leaving the agent to guess.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb 'List' and resource 'Python packages', and clearly differentiates from siblings that target npm, Maven, and GitHub advisories. The phrase 'show pyproject.toml' introduces slight ambiguity about whether it displays the file or lists packages from it, but the overall purpose is evident.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the sibling tools, nor any mention of prerequisites or alternatives. The description does not indicate that it is specifically for Python projects or how it complements deps_detect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv1.0.0
    • First observeddeps_detect
    • First observeddeps_github_advisory
    • First observeddeps_maven_tree
    • First observeddeps_npm_audit
    • First observeddeps_python_packages

TDQS

B3.3/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a distinct purpose: manifest detection, npm audit, Maven dependency tree, Python package listing, and GitHub advisory lookup. No overlap or ambiguity between tools.

Naming Consistency5/5

All tools use a consistent 'deps_' prefix followed by a verb_noun pattern (e.g., deps_npm_audit, deps_maven_tree). Naming is uniform and predictable.

Tool Count5/5

With 5 tools covering detection, language-specific inspection, and advisory lookup, the count is well-scoped for a dependency scanning server—neither sparse nor bloated.

Completeness3/5

The surface covers detection and some language-specific commands, but lacks unified vulnerability scanning across all ecosystems (e.g., no Python audit, no Maven audit) and no update/fix operations. Advisory lookup partially fills this, but gaps remain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Automatically scans project dependencies (npm, Composer) for security vulnerabilities using the OSV.dev database, providing real-time alerts and detailed remediation guidance directly in your IDE.
    1
    6 npm
    1
    MIT
  • A
    license
    B
    quality
    C
    maintenance
    Enables security scanning for npm dependencies by checking manifest and lockfiles against the OSV.dev and Socket.dev vulnerability databases. It provides tools to detect vulnerabilities in specific packages and retrieve detailed technical reports for identified security issues.
    3
    15 npm
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables users to scan software packages for data exfiltration and security threats directly within their IDE across npm, PyPI, Cargo, and Maven ecosystems. This tool helps ensure the safety of project dependencies by identifying potential risks before they are integrated.
    MIT