How do I install DepScope?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does DepScope need an API key?

No required environment variable is listed on this record.

When was DepScope last checked?

Last checked 2026-11-08. Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

DepScope MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://mcp.depscope.dev/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http dev.depscope-mcp https://mcp.depscope.dev/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "dev.depscope-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://mcp.depscope.dev/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 0.9.24
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

DepScope MCP Server

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

The 19-ecosystem coverage list
An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
Three pillars: token-saving, energy-saving, security
Standard invocation flow: check_malicious → check_typosquat → check_package → install_command

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

Local (stdio via npx)

{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Tools (22)

Tool	Purpose
`check_package`	Full package check: deprecated/CVE/health/recommendation
`get_health_score`	0-100 score with breakdown (maintenance/popularity/security/maturity/community)
`get_vulnerabilities`	Open CVEs from OSV + KEV/EPSS
`package_exists`	Hallucination detector (404 = LLM invented it)
`find_alternatives`	Curated alternatives for deprecated/abandoned packages
`get_typosquat`	Suspicious name similarity check
`get_breaking_changes`	Migration plan between versions
`get_bugs`	Known bugs from GitHub issues
`compare_packages`	Side-by-side health/license/vuln comparison
`resolve_error`	Map error message → likely cause + fix
`search_errors`	Find similar error reports across ecosystems
`check_compat`	Stack compatibility check
`get_latest_version`	Latest stable + maturity signal
... and 9 more	full list in `tools.js`

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

DepScope

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install DepScope?

Does DepScope need an API key?

What transport does DepScope use?

When was DepScope last checked?

Documentation

DepScope MCP Server

What's new in v0.9.0

Why this exists

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Local (stdio via npx)

Tools (22)

Ecosystems (19)

Pricing

License

Links