MCP.Market

Dep Scope MCP server

by FlorianBruniaux·io.github.FlorianBruniaux/dep-scope·v0.4.2·19 stars
No reviews yet

Symbol-level npm dependency analysis: scan verdicts, native alternatives, migration prompts.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

19 stars190 downloads/wk

Reviews

Write one

Nobody has reviewed Dep Scope yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Dep Scope tools (5)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_package

    Analyze symbol-level usage of a specific npm package: which symbols are imported, from which files, verdict, and native alternatives.

  • find_duplicates

    Find duplicate or overlapping libraries in a project (e.g. moment + date-fns both installed, multiple icon libraries).

  • generate_migration_prompt

    Generate a ready-to-use LLM migration prompt for a specific package. Returns the markdown content with symbol-by-symbol replacement instructions.

  • get_migration_candidates

    List all packages that can be migrated to native JS alternatives (RECODE_NATIVE) or consolidated (CONSOLIDATE). Returns packages with their alternatives and file locations.

  • scan_project

    Scan all npm dependencies in a project and get symbol-level verdicts (KEEP, REMOVE, RECODE_NATIVE, CONSOLIDATE, PEER_DEP, INVESTIGATE).

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan124 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 26 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Dep Scope compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 915 Security servers
Tools
5
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
19
more than 93% of 587 Security servers
Downloads a week
190
more than 73% of 249 Security servers with a package

What its tools let an agent do: 4 read · 1 create

Install Dep Scope in Claude Code, Cursor or VS Code

Runs npx -y @florianbruniaux/dep-scope on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add dep-scope -- npx -y @florianbruniaux/dep-scope
Add to Cursor

What the publisher says

From the Dep Scope repository's README, as published. We do not edit it. Read it on GitHub

dep-scope

Florian BRUNIAUX · AI Founding Engineer @ Méthode Aristote 13 years from developer to CTO / VP Eng · Blog ↗ · Projects ↗

Symbol-level dependency analysis + LLM-ready migration prompts for TypeScript/JavaScript projects.

"Knip tells you what's unused. dep-scope tells you how you use what you keep, and generates the prompt to remove it."

When to use dep-scope

Good use cases:

  • Legacy project audit: Finding lodash functions that now have native equivalents
  • Library consolidation: Do we really need 3 icon libraries?
  • Migration: Generate a context-aware prompt and let Claude Code do the refactoring
  • Curiosity: "Which symbols from this 50KB library do we actually use?"

Not the right tool if:

  • You just want unused deps → use Knip instead
  • Your codebase is already well-maintained → dep-scope will mostly say "KEEP"

Quick Example

$ dep-scope scan

═══════════════════════════════════════════
  dep-scope Analysis Report
═══════════════════════════════════════════

Summary:
  Total dependencies: 45
  ✓ Keep:          38
  ↻ Recode Native: 3
  ✗ Remove:        2
  ⊕ Peer Dep:      4

Action Items:
  Remove (unused):
    ✗ moment
    ✗ has-flag

  Recode to native:
    ↻ lodash.debounce (1 symbol) → custom debounce function
    ↻ array-includes (1 symbol) → Array.prototype.includes
    ↻ left-pad (1 symbol) → String.prototype.padStart

How it compares

Recommendation: Use Knip for unused detection, dep-scope for deeper analysis and migration. They work well together (dep-scope auto-detects Knip if installed).

Installation

CLI (global):

npm install -g @florianbruniaux/dep-scope

Without installation:

npx @florianbruniaux/dep-scope scan

MCP Server (AI editors — no CLI needed):

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Dep Scope: common questions

Is Dep Scope MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Dep Scope safety report
How do I install Dep Scope?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Dep Scope need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Dep Scope maintained?
The last commit was 65 days ago (2026-09-01). The latest release is v0.4.2.
What can I use instead of Dep Scope?
Servers from other publishers that do the same job: npm Registry MCP Server, pkgxray MCP server and quantakrypto pqc-tools MCP server. Compare all Dep Scope alternatives.
How does Dep Scope compare with other Security MCP servers?
safety score 92/100 (higher than 95% of 915 Security servers); tools 5 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Dep Scope

Same job from other publishers: the closest match first, then the best rated.

All Dep Scope alternatives →
  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    B
  • pkgxray
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
    B
  • quantakrypto pqc-tools
    Scan code for quantum-vulnerable cryptography and get NIST post-quantum migration guidance.
    B
  • Npm Sentinel
    Advanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.
    A
  • Dependency Auditor
    CVE scanning for npm/pip/cargo dependencies via OSV
    More from 4hmetuyar →
    A