@mhdd_24/api-dependency-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@mhdd_24/api-dependency-mcpscan the current repo for hardcoded service URLs"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@mhdd_24/api-dependency-mcp
Map service-to-service API dependencies.
Same architecture as @mhdd_24/sublime-mcp.
Full documentation: docs/WIKI.md
How it works (30 seconds)
You (chat) → MCP client → api-dependency-mcp → API Dependency APIs / CLIs / local toolsRelated MCP server: Merovingian MCP Server
Prerequisites
Requirement | Notes |
Node.js 18+ | ESM TypeScript MCP server |
Credentials / CLIs | See environment variables below |
Install
Option A — npm (after publish)
npm install -g @mhdd_24/api-dependency-mcpOption B — npx
npx @mhdd_24/api-dependency-mcpOption C — clone and build
git clone https://github.com/Mhdd-24/API-Dependency-MCP.git
cd API-Dependency-MCP
npm install
npm run build
node dist/index.jsConfigure Cursor
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"apidep": {
"command": "npx",
"args": ["-y", "@mhdd_24/api-dependency-mcp"],
"env": {
"PROJECT_ROOT": "..."
}
}
}
}Local development:
{
"command": "node",
"args": ["/absolute/path/to/API-Dependency-MCP/dist/index.js"]
}Environment variables
Variable | Description |
| Default project/repository root |
Tools
Tool | Description |
| Show API dependency scan root. |
| Find hardcoded service URLs/clients. |
| Build a dependency map from service:endpoint lines. |
License
ISC
Available Tools
3 toolsapidep_mapC
Build a dependency map from service:endpoint lines.
| Name | Required | Description | Default |
|---|---|---|---|
| entries | Yes | service->dependency lines |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. 'Build' suggests an analysis/computation operation, but the description does not state whether it is read-only, whether it produces side effects, what the output looks like, or any error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no filler. It front-loads the action and resource, and every word contributes to understanding the tool's basic function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, this is minimally viable: it states the action and input format. However, with no output schema and no annotations, it lacks clarity about the returned dependency map shape and any behavioral caveats, so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single 'entries' parameter. The description adds a slightly different input format hint ('service:endpoint' vs 'service->dependency'), but does not meaningfully deepen understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Build') and a specific resource ('dependency map'), and clearly identifies the input format ('service:endpoint lines'). It does not explicitly distinguish itself from siblings, but the name and action already convey a distinct purpose from apidep_status and apidep_scan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to choose this tool over apidep_status or apidep_scan, nor does it state any prerequisites or exclusions. The input format is implied, but no context is provided for when a dependency map is needed versus the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
apidep_scanC
Find hardcoded service URLs/clients.
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | Project root path | |
| limit | No | Max results |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. "Find" implies a non-mutating scan, but the description does not state that it only analyzes code, whether it modifies anything, how it traverses the project, or what the output represents.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word contributes to stating the tool's primary purpose, making it highly concise and easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations, no output schema, and only a terse one-line description. It does not clarify what a result looks like, whether the scan is recursive, what the default root is, or how it relates to the sibling tools, leaving important context missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains root and limit. The description itself adds no parameter-level meaning, which is acceptable given the high schema coverage, but it does not go beyond the structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: "Find hardcoded service URLs/clients." This makes the core operation clear, though it does not explicitly differentiate the tool from siblings like apidep_status or apidep_map.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus apidep_status or apidep_map, and no prerequisites or alternative conditions are mentioned. The only implied usage is that this tool scans for hardcoded URLs/clients, but no exclusionary context is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
apidep_statusC
Show API dependency scan root.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. 'Show' implies a read-only operation, but the description does not explain what 'root' means, what the output shape is, or whether the call fails when no scan has been performed. This is a significant gap given there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no filler and the verb is front-loaded. It is structurally clean, though the terseness contributes to the ambiguity around 'root.'
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool this is still thin: it does not explain what the returned root is, when to call the tool in the scan workflow, or how it relates to apidep_scan and apidep_map. An agent can invoke it but cannot interpret the result or choose it confidently over siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters and 100% description coverage by default, so the description has no parameter documentation burden. The baseline of 4 is appropriate here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb, 'Show,' and names a resource, 'API dependency scan root,' so it is not a tautology. However, 'root' is undefined — it could mean the root of a dependency tree, a root endpoint, or scan status — and there is no mention of how it differs from apidep_scan or apidep_map.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to call this tool versus its siblings. It does not state that this is a status/root query to be used after a scan, nor does it mention any conditions or sequencing. Usage must be inferred entirely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.0.0- First observed
apidep_map - First observed
apidep_scan - First observed
apidep_status
TDQS
Scored across 3 tools
Each tool has a clearly distinct role: status reports the scan root, scan discovers hardcoded URLs/clients, and map builds the dependency graph. There is no meaningful overlap between these operations.
All tools share the consistent 'apidep_' prefix and lowercase snake_case naming. The operation words—status, scan, map—are short and predictable within the server's domain.
With only three tools, the server is tightly scoped to the API dependency scanning workflow. Each tool serves a necessary purpose without redundant or filler operations.
The set covers the core workflow of showing the scan root, scanning for dependencies, and building a map. A minor gap is the lack of an explicit way to configure or update the scan root through the tool surface.
Related MCP Connectors
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Detects database migration table locks, terraform cost leaks, and OWASP API flaws.
Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.
Software component catalog: search your org's services, docs, APIs, dependencies, and ownership.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables comprehensive security scanning of code repositories to detect secrets, vulnerabilities, dependency issues, and configuration problems. Provides real-time security checks and best practice recommendations to help developers identify and prevent security issues.3 npm2MIT
- AlicenseAqualityDmaintenanceEnables AI agents to map cross-repository dependencies, detect breaking changes in API contracts, and assess impact across services.10MIT
- AlicenseBqualityBmaintenanceEnables static analysis and code smell detection by connecting to an external analysis API.131MIT
- AlicenseNot gradedqualityCmaintenanceEnables cross-repository architecture discovery and dependency routing across multi-service codebases, with automated scanning and batch AST indexing for AI agents to trace request lifecycles and navigate service boundaries.10 npmMIT