DepScope
Package Intelligence for AI Agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.
→ Live at depscope.dev · 8.4M+ packages · 42K+ vulnerabilities (99% EPSS-enriched) · zero auth · free
Quick start (MCP)
Claude Desktop / Cursor / Windsurf — remote
{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}Claude Code / local — stdio
{
"mcpServers": {
"depscope": {
"command": "npx",
"args": ["-y", "depscope-mcp"]
}
}
}The MCP server source is at cuttalo/depscope-mcp (AGPL-3.0).
What it does
22 MCP tools across 19 package ecosystems:
npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia
| Tool | Purpose |
|---|---|
check_package |
Full safety check: deprecation · vulnerabilities · health · recommendation |
check_malicious |
Malicious-package detector |
check_typosquat |
Typosquat detection vs popular names |
package_exists |
Hallucination detector (404 = LLM invented it) |
get_health_score |
0–100 health score with breakdown |
get_vulnerabilities |
Vulnerabilities + severity scoring |
find_alternatives |
Suggested alternatives for deprecated/abandoned packages |
get_breaking_changes |
Major-version migration notes |
get_known_bugs |
Known issues for a package |
compare_packages |
Side-by-side comparison |
check_compatibility |
Stack-level compatibility check |
resolve_error |
Error message → likely cause + fix |
install_command |
Verified install command for the target ecosystem |
get_latest_version |
Latest stable version + maturity signal |
pin_safe |
Suggested safe version pin |
get_trust_signals |
Multi-signal trust score |
get_migration_path |
Step-by-step upgrade plan |
scan_project |
Bulk scan of dependency manifests |
check_bulk |
Fast pre-flight filter for batches |
get_trending |
Trending packages by ecosystem |
get_package_prompt |
Compact LLM-friendly summary |
contact_depscope |
Report a missing package or false positive |
