About cuttalo/depscope
cuttalo/depscope is an MCP server in the Security category: mcp`.
Install
git clone https://github.com/cuttalo/depscopeThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (22)
check_bulkFast pre-flight filter for batches
Parameters not published.
check_compatibilityStack-level compatibility check
Parameters not published.
check_maliciousMalicious-package detector
Parameters not published.
check_packageFull safety check: deprecation · vulnerabilities · health · recommendation
Parameters not published.
check_typosquatTyposquat detection vs popular names
Parameters not published.
compare_packagesSide-by-side comparison
Parameters not published.
contact_depscopeReport a missing package or false positive
Parameters not published.
find_alternativesSuggested alternatives for deprecated/abandoned packages
Parameters not published.
get_breaking_changesMajor-version migration notes
Parameters not published.
get_health_score0–100 health score with breakdown
Parameters not published.
Show all 22 tools
get_known_bugsKnown issues for a package
Parameters not published.
get_latest_versionLatest stable version + maturity signal
Parameters not published.
get_migration_pathStep-by-step upgrade plan
Parameters not published.
get_package_promptCompact LLM-friendly summary
Parameters not published.
get_trendingTrending packages by ecosystem
Parameters not published.
get_trust_signalsMulti-signal trust score
Parameters not published.
get_vulnerabilitiesVulnerabilities + severity scoring
Parameters not published.
install_commandVerified install command for the target ecosystem
Parameters not published.
package_existsHallucination detector (404 = LLM invented it)
Parameters not published.
pin_safeSuggested safe version pin
Parameters not published.
resolve_errorError message → likely cause + fix
Parameters not published.
scan_projectBulk scan of dependency manifests
Parameters not published.
Ask AI
Ask AI about cuttalo/depscope
Powered by Claude · Grounded in docs
Security checks
- ✓README presentThe repository ships documentation.
5 checks have not been run yet.
README
DepScope
Package Intelligence for AI Agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.
→ Live at depscope.dev · 8.4M+ packages · 42K+ vulnerabilities (99% EPSS-enriched) · zero auth · free
Quick start (MCP)
Claude Desktop / Cursor / Windsurf — remote
{
"mcpServers": {
"depscope": {
"url": "https://mcp.depscope.dev/mcp"
}
}
}
Claude Code / local — stdio
{
"mcpServers": {
"depscope": {
"command": "npx",
"args": ["-y", "depscope-mcp"]
}
}
}
The MCP server source is at cuttalo/depscope-mcp (AGPL-3.0).
What it does
22 MCP tools across 19 package ecosystems:
npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia
| Tool | Purpose |
|---|---|
check_package |
Full safety check: deprecation · vulnerabilities · health · recommendation |
check_malicious |
Malicious-package detector |
check_typosquat |
Typosquat detection vs popular names |
package_exists |
Hallucination detector (404 = LLM invented it) |
get_health_score |
0–100 health score with breakdown |
get_vulnerabilities |
Vulnerabilities + severity scoring |
find_alternatives |
Suggested alternatives for deprecated/abandoned packages |
get_breaking_changes |
Major-version migration notes |
get_known_bugs |
Known issues for a package |
compare_packages |
Side-by-side comparison |
check_compatibility |
Stack-level compatibility check |
resolve_error |
Error message → likely cause + fix |
install_command |
Verified install command for the target ecosystem |
get_latest_version |
Latest stable version + maturity signal |
pin_safe |
Suggested safe version pin |
get_trust_signals |
Multi-signal trust score |
get_migration_path |
Step-by-step upgrade plan |
scan_project |
Bulk scan of dependency manifests |
check_bulk |
Fast pre-flight filter for batches |
get_trending |
Trending packages by ecosystem |
get_package_prompt |
Compact LLM-friendly summary |
contact_depscope |
Report a missing package or false positive |
REST API
Same data, plain HTTPS — no MCP client needed.
curl https://depscope.dev/api/check/npm/lodash
curl https://depscope.dev/api/check/pypi/requests
curl https://depscope.dev/api/check/cargo/serde
Full reference: depscope.dev/integrate
Why
LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it can hit an attacker's typosquat. DepScope verifies every package before install.
Read more: depscope.dev/why
Pricing
Free. No auth required. Generous rate limits.
If you need higher quotas, SLA, or on-prem deployment, contact us at depscope@cuttalo.com.
Open source vs proprietary
This repository is a landing page with documentation only.
-
MCP server (client SDK) — open source, AGPL-3.0: → cuttalo/depscope-mcp → npm: depscope-mcp
-
Backend (API + intelligence layer) — proprietary, hosted at
depscope.dev.
This split lets us keep the client free, auditable, and community-extensible while sustaining the infrastructure that powers it.
Links
- Homepage · depscope.dev
- API docs · depscope.dev/integrate
- MCP server source · cuttalo/depscope-mcp
- npm · depscope-mcp
- Glama listing · glama.ai/mcp/servers/cuttalo/depscope
- Awesome MCP · punkpeye/awesome-mcp-servers
License
This README and accompanying landing files: CC-BY-4.0. MCP client SDK: AGPL-3.0 (see cuttalo/depscope-mcp). Backend service: proprietary.
Built by Cuttalo srl · Italy 🇮🇹
README copy captured when this server was indexed; it may lag the repository. The original is authoritative.