Depguard MCP server

by CloudCorpRecords·io.github.CloudCorpRecords/depguard·v0.4.0

No reviews yet

PR dependency early warning: install scripts, typosquats, downgrades, and lockfile drift.

A92/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A92/100

not scanned yet

Adoption

Growing

0 stars188 downloads/wk

Reviews

Write one

Nobody has reviewed Depguard yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Depguard tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How Depguard compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 92/100; higher than 90% of 48,273 servers
Downloads a week: 188; more than 74% of 11,915 servers with a package

Release history: 2 versions in the registry since 2026-10-23, latest 2026-10-26, typically one every 3 days.

Install Depguard in Claude Code, Cursor or VS Code

Runs npx -y @reneturcios/depguard on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add depguard -- npx -y @reneturcios/depguard

Add to Cursor

What the publisher says

From the Depguard repository's README, as published. We do not edit it. Read it on GitHub

depguard

PR-time and dependency-change early warning for npm repos. The Shai-Hulud / ChainDrop worm family backdoored 500+ npm packages in 2026, executing at install time through preinstall dropper scripts and propagating through the dependency graph. depguard is the diff-time check: given a repo and a base (a git ref or a second manifest set), it diffs package.json and the lockfiles, and grades every added, removed, and changed dependency with evidence, before the change merges.

The base verdict is fully offline and deterministic. Registry checks (version age, publisher change, provenance, deprecation) run only behind an explicit --online flag or the matching MCP parameter, and a failed lookup never changes the local verdict.

What it checks

Lockfiles: package-lock.json is parsed fully (v1 legacy tree and v2/v3 packages map). yarn.lock and pnpm-lock.yaml are parsed best-effort for resolved entries and versions.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Depguard: common questions

Is Depguard MCP server safe?: Yes, by our scan: it is graded A (92/100). Read the Depguard safety report
How do I install Depguard?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Depguard need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Depguard maintained?: The last commit was 10 days ago (2026-10-23). The latest release is v0.4.0.
How does Depguard compare with other MCP servers?: safety score 92/100 (higher than 90% of 48,273 servers); downloads a week 188 (more than 74% of 11,915 servers with a package). Full comparison.