4da MCP server

Read from the package source without running it. The installed server may list more.

• agent_memory

  Cross-agent persistent memory. Actions: store (save a memory), recall (search by subject), recall_by_tags (search by tags), get_recent (memories since timestamp). What one agent learns, all agents can access.

• check_decision_alignment

  Check if a technology or pattern aligns with the developer's active decisions. Call BEFORE suggesting major tech changes. Returns alignment status, relevant decisions, and any conflicts.

• decision_memory

  Manage developer decisions. Actions: record (create new decision), list (query decisions), check_alignment (check if tech/pattern conflicts with decisions), update (modify a decision), supersede (replace old decision with new one).

• dependency_health

  Assess health of project dependencies — version freshness, deprecation status, known CVEs. Auto-detects stack from lock files. Covers npm, Rust, Python, and Go.

• developer_dna

  Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, engagement data, and learned preferences. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats.

• ecosystem_pulse

  Live ecosystem news relevant to your tech stack. Surfaces trending Hacker News discussions filtered by your detected technologies. Updated on server startup.

• get_actionable_signals

  Get actionable signals classified from recent content. Categorizes items into signal types: security_alert, breaking_change, tool_discovery, tech_trend, learning, competitive_intel. Each signal has a priority level (critical/high/medium/low) based on signal type, relevance score, and tech stack match. Use this to get prioritized, actionable intelligence from 4DA's feed.

• get_context

  Get the user's context - what 4DA knows about them. Returns information about: - Static Identity: User-declared role, tech stack, domains, interests, and exclusions - ACE Context (optional): Auto-detected technologies and active topics from recent activity - Learned Preferences (optional): Topic affinities learned from user behavior Use this to understand what the user is working on and interested

• get_relevant_content

  Get filtered relevant content from 4DA's personalized feed. Returns content items that match the user's interests, tech stack, and learned preferences. Items are scored based on: - Explicit interests declared by the user - Tech stack and domains - ACE-detected context (recent files, projects, git activity) - Learned preferences from past interactions Each item includes necessity fields (necessity_

• knowledge_gaps

  Detect knowledge gaps by cross-referencing your project dependencies with source items you haven't engaged with. Identifies things you should know about but might have missed.

• record_feedback

  Record user feedback on a content item. Feedback actions: - "click": User clicked/opened the item (moderate positive signal) - "save": User saved/bookmarked the item (strong positive signal) - "dismiss": User dismissed the item (weak negative signal) - "mark_irrelevant": User marked item as not relevant (strong negative signal) This feedback helps 4DA learn user preferences over time.

• upgrade_planner

  Ranked standalone upgrade recommendations for dependencies — call before upgrading, adding, or auditing any dependency to pick the safest order. Prioritizes by vulnerability severity (direct AND transitive), deprecation, and version distance. Splits quick wins (patch/minor) from breaking changes (major) and from transitive CVEs waiting on upstream. Run vulnerability_scan first for a CVE-aware plan

• vulnerability_scan

  Scan project dependencies for known vulnerabilities (CVEs) using OSV.dev.

• what_should_i_know

  Pre-task intelligence briefing. Given a task description and optional file paths, returns filtered advisories, decision windows, signal chains, relevant wisdom, and a delegation assessment. Call before starting any non-trivial task. If the task involves upgrading, adding, or auditing dependencies, follow with upgrade_planner for the ranked plan.

• Code scan105 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 2 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

4da: common questions

Is 4da MCP server safe?

Yes, by our scan: it is graded A (91/100). Read the 4da safety report

How do I install 4da?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does 4da need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is 4da maintained?

The last commit was 2 days ago (2026-09-21). The latest release is v5.0.2.

What can I use instead of 4da?

Servers from other publishers that do the same job: PostgreSQL CVE & Release Intelligence MCP server, npm Registry MCP Server and VulnCheck MCP server. Compare all 4da alternatives.