MCP.Market

DepScope MCP server

not responding
by depscope.dev·dev.depscope/mcp·v0.9.24
No reviews yet

Package intelligence MCP for AI agents — 22 tools, 19 ecosystems, AGPL SDK, free.

C59/100grade C
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
C59/100

full report

Adoption
Growing

0 stars49 downloads/wk

Reviews

Write one

Nobody has reviewed DepScope yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

DepScope tools

Tool list not cached yet. `describe` through the gateway fetches it live.

Public scan report

scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it

1 high
  • Code scan4 source files scanned25/25
  • Live reliabilityremote unreachable: Streamable HTTP error: Error POSTing to endpoint: {"status":410,"error":"gone","service":"DepScope","message":"DepScope has been retired. Greetings from Italy!","messaggio":"DepScope si è spento. Salu0/20
  • –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 144 days ago8/15
  • Maintainer identitynamespace and repository owner differ; website matches verified namespace5/10

Findings (1)

  • highRemote endpoint did not respondreliability.unreachable

    Streamable HTTP error: Error POSTing to endpoint: {"status":410,"error":"gone","service":"DepScope","message":"DepScope has been retired. Greetings from Italy!","messaggio":"DepScope si è spento. Salu

Overall 59/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How DepScope compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
59/100
higher than 14% of 48,255 servers
Uptime
0%
of our recent checks; the typical remote server answers 100%
Response time
68 ms
faster than 90% of 30,031 servers
Downloads a week
49
more than 41% of 12,191 servers with a package

Install DepScope in Claude Code, Cursor or VS Code

claude mcp add --transport http mcp https://mcp.depscope.dev/mcp
Add to Cursor

What the publisher says

From the DepScope repository's README, as published. We do not edit it. Read it on GitHub

DepScope MCP Server

Package intelligence MCP server for AI agents. Stops AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot) from installing hallucinated, deprecated, or malicious packages across 19 ecosystems.

→ Backed by depscope.dev — 1.2M+ packages indexed, 19,000+ vulnerabilities tracked, real-time.

What's new in v0.9.0

The MCP server now sends a system-prompt directive to your AI client at handshake (server.instructions). Claude Code, Cursor, Windsurf and other MCP clients receive a proactive-invocation brief automatically — manual rule files (CLAUDE.md, .cursorrules, .windsurfrules) are now optional. Existing rules still work; they're just redundant.

What the model sees at every session start:

  • The 19-ecosystem coverage list
  • An "INVOKE PROACTIVELY" directive with explicit triggers (install, version bump, lockfile change, "module not found" errors, library comparison)
  • Three pillars: token-saving, energy-saving, security
  • Standard invocation flow: checkmalicious → checktyposquat → checkpackage → installcommand

For Claude Code there is also a companion plugin that bundles the MCP server with a skill carrying rich frontmatter triggers:

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

All npm versions <0.9.0 are now deprecated. Run npm update -g depscope-mcp if you installed globally.

Why this exists

LLMs frequently invent package names that look real but don't exist (fastapi-turbo, lodahs, tokio-stream-extras). When an agent tries to install one, it might hit an attacker's typosquat. DepScope verifies every package before install.

Quick start

Claude Desktop / Cursor / Windsurf (remote MCP)

Add to your MCP config:

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

Local (stdio via npx)

{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Tools (22)

Ecosystems (19)

npm · pypi · cargo · go · composer · maven · nuget · rubygems · pub · hex · swift · cocoapods · cpan · hackage · cran · conda · homebrew · jsr · julia

Pricing

Free. No auth required. Generous rate limits. The MCP server is open-source (AGPL-3.0); the backend (depscope.dev API) is proprietary.

License

AGPL-3.0-or-later. Backend is proprietary; this client is open.

Links

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

DepScope: common questions

Is DepScope MCP server safe?
With care: it is graded C, so read the findings first (59/100). Read the DepScope safety report
How do I install DepScope?
It runs remotely at mcp.depscope.dev. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does DepScope need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is DepScope maintained?
The last commit was 183 days ago (2026-05-05). The latest release is v0.9.24.
Is DepScope up?
0% of our last 28 checks got an answer. We check remote servers about four times a day.
How does DepScope compare with other MCP servers?
safety score 59/100 (higher than 14% of 48,255 servers); uptime 0% (of our recent checks; the typical remote server answers 100%); response time 68 ms (faster than 90% of 30,031 servers). Full comparison.