Dep Diff MCP server

• analyze_package_changeFree

  Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.

• analyze_packages_bulkFree

  Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lockfile diff, or batch upgrade. Returns: total count, breakdown by semver class, total security fixes found, packages with breaking changes, and per-package details. Limit 50 packages per call (chunk larger lists).

• Code scan9 source files scanned25/25
• Live reliabilityremote reachable in 415ms20/20
• Tool poisoning2 tool descriptions checked15/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancelast push 5 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Dep Diff: common questions

Is Dep Diff MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the Dep Diff safety report

How do I install Dep Diff?

It runs remotely at dep-diff.digicatalyst.ca. Add it to Claude Code, Claude Desktop or Cursor with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Dep Diff need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Dep Diff maintained?

The last commit was 5 days ago (2026-09-15). The latest release is v0.3.2.

Is Dep Diff up?

100% of our last 4 checks got an answer. We check remote servers about four times a day.

What can I use instead of Dep Diff?

Servers from other publishers that do the same job: Hotin MCP server, Actions Deprecation Lint 2026 MCP server and gha-doctor MCP server. Compare all Dep Diff alternatives.