Dep Oracle MCP server

Read from the package source without running it. The installed server may list more.

• dep_oracle_blast_radius

  Analyze the blast radius (import impact) of a package within a project. Scans all JS/TS source files to find how many files import the given package. Returns the count of affected files, their paths, and the percentage of the codebase impacted. Useful for understanding the risk if a dependency is compromised or needs replacement.

• dep_oracle_compare

  Compare two packages side-by-side by computing trust scores for both. Returns the full trust report for each package including scores, metrics, zombie status, and trend direction. Useful for evaluating alternatives or choosing between competing libraries.

• dep_oracle_report

  Generate a JSON report for a project. Runs a full scan and outputs the results as formatted JSON. Optionally writes the report to a file. Returns the JSON content or the path to the generated file.

• dep_oracle_scan

  Perform a full dependency security scan on a project directory. Parses the manifest (package.json, requirements.txt, etc.), collects data from registries and GitHub, computes trust scores for every dependency, detects zombies, typosquats, and calculates blast radius. Returns a complete ScanResult JSON with per-package trust reports and an overall project score.

• dep_oracle_suggest_migration

  Get migration suggestions for a given package. Looks up the package in a curated knowledge base of common replacements and returns alternatives with descriptions and difficulty ratings. Useful for replacing deprecated, abandoned, or low-trust packages (e.g. moment -> dayjs, request -> got, lodash -> es-toolkit).

• dep_oracle_trust_score

  Calculate the trust score for a single package. Queries the registry, GitHub, OSV vulnerability database, and other sources to produce a weighted score (0-100) across 6 dimensions: security, maintainer, activity, popularity, funding, and license. Returns a TrustReport JSON with the overall score, per-dimension metrics, zombie status, and alternative suggestions.

• dep_oracle_typosquat_check

  Check whether a package name is a potential typosquat of a popular package. Uses Levenshtein distance, homoglyph detection, and pattern analysis to identify suspicious package names that closely resemble well-known packages. Returns a risk assessment with similar package names and the edit distance.

• dep_oracle_zombies

  Detect zombie (abandoned/unmaintained) dependencies in a project. Parses the manifest, queries registry and GitHub for each dependency, and flags packages that show signs of abandonment: deprecated, no commits in 12+ months, no active maintainers, etc. Returns an array of zombie packages with severity levels and reasons.

• Code scan23 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 199 days ago4/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

75/100

higher than 40% of 915 Security servers

Tools

8

the typical Security server has 6

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

45

more than 38% of 248 Security servers with a package

Dep Oracle: common questions

Is Dep Oracle MCP server safe?

Mostly: it is graded B (75/100). Read the Dep Oracle safety report

How do I install Dep Oracle?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Dep Oracle need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Dep Oracle maintained?

The last commit was 236 days ago (2026-03-13). The latest release is v1.3.0.

What can I use instead of Dep Oracle?

Servers from other publishers that do the same job: Wireshark MCP server, Dep Scope MCP server and npm Registry MCP Server.

How does Dep Oracle compare with other Security MCP servers?

safety score 75/100 (higher than 40% of 915 Security servers); tools 8 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.