Dependency Health MCP server
online · 100% uptimePackage alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates.
0 stars
Reviews
Write oneNobody has reviewed Dependency Health MCP yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Dependency Health MCP tools (3)
write = sends, deletes, buys or postsdeps_auditFreeHealth verdict for every package in a manifest or a list, in one call (≤25 packages): deprecated / archived / stale / active / unknown per package with the latest version, release and push ages, advisory counts and replacements, plus a summary. Use when reviewing a repository's package.json or requirements.txt before an upgrade, an audit or a fork decision.
package_healthFreeIs this package alive? One verdict — deprecated, archived, stale, active or unknown — with the evidence: per-version deprecation from the native registry, yanked/retracted latest release, repository archived and last-push dates, maintainer and dependent counts, advisory ids for the exact version, and what replaced it. Use when choosing, pinning or upgrading a dependency in npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet or Packagist.
runtime_eolFreeSupport and end-of-life dates for a runtime, OS, database or framework version from endoflife.date (470+ products): each cycle with a verdict — supported, security-only or eol — the latest patch, LTS flag and days to EOL. Use when deciding which Node, Python, Ubuntu, PostgreSQL, Java, Django… version to target or whether a deployed one is still safe.
Public scan report
scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 775ms20/20
- Tool poisoning3 tool descriptions checked15/15
- Auth qualityopen endpoint, read-only tools10/15
- Maintenancelast push 56 days ago12/15
- Maintainer identityregistry namespace matches repository owner6/10
How Dependency Health MCP compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 84/100
- higher than 68% of 48,243 servers
- Tools
- 3
- the typical server has 7
- Tools that change things
- 0%
- typical: 0%. Fewer write tools means less an agent can break
- Uptime
- 100%
- of our recent checks; the typical remote server answers 100%
- Response time
- 517 ms
- faster than 32% of 30,027 servers
What its tools let an agent do: 2 read · 1 run or deploy
Install Dependency Health MCP in Claude Code, Cursor or VS Code
claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp
What the publisher says
From the Dependency Health MCP repository's README, as published. We do not edit it. Read it on GitHub
Dependency Health MCP
Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates. Remote MCP server over Streamable HTTP at https://dephealth.dsh.sh/mcp. Free, no API key. Tools: packagehealth, depsaudit, runtime_eol. The tool list is fixed per version.
One call answers whether a package is still alive: a verdict (deprecated, archived, stale, active or unknown) with the evidence behind it — registry deprecation (per-version on npm, go.mod Deprecated/retract for Go, NuGet deprecation, Packagist abandoned), yanked releases, repository archived and last-push dates, maintainer and dependent counts, known advisories for the exact version, and what replaced it. Covers npm, PyPI, crates.io, RubyGems, Go modules, Maven, NuGet and Packagist through ecosyste.ms, the native registries and deps.dev, all keyless. depsaudit takes a whole package.json or requirements.txt (up to 25 packages) and runtimeeol reports endoflife.date support and EOL dates for runtimes and OSes. Free, no key, no account; every response lists the upstream calls it made.
Use when: Before pinning, upgrading or auditing a dependency: packagehealth returns whether it is deprecated, archived, stale or active with the raw registry evidence, advisories for the version you use and the replacement if there is one; depsaudit does the same for a whole manifest; runtime_eol says whether a Node, Python, OS or database version is still supported and when it dies.
Not for: Not a vulnerability scanner (advisory ids only, no CVSS triage or reachability), not license compliance, not a popularity ranking, and it cannot see private registries or vendored code.
Quick install (Claude Code): claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user
Live server: https://dephealth.dsh.sh
Docs
- Full reference: every tool with its JSON input schema and an example
- Install for any client: Claude Code, Cursor, VS Code, Claude Desktop, ChatGPT, Codex, Gemini CLI, Windsurf, Cline, Continue, Zed
- OpenAPI twin: the same tools as plain HTTP POST endpoints
- Registry server.json: machine-readable server record
- Server card: transport + tool card (also at https://dephealth.dsh.sh/.well-known/mcp.json, SEP-1960)
- ARD manifest: Agentic Resource Discovery entry (also at https://dephealth.dsh.sh/.well-known/ai-catalog.json)
Upstreams
- ecosyste.ms packages API: keyless
- deps.dev v3: keyless
- npm registry: keyless
- PyPI JSON API: keyless
- crates.io API: keyless
- RubyGems API: keyless
- Go module proxy: keyless
- NuGet registration index: keyless
- Packagist p2: keyless
- GitHub REST (fallback only): keyless
- endoflife.date API: keyless
Optional
- Health: liveness JSON
- Owner: ux-xd
Tools
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-10-29downgradeA → Bscore 84
Dependency Health MCP: common questions
- Is Dependency Health MCP server safe?
- Mostly: it is graded B (84/100). Read the Dependency Health MCP safety report
- How do I install Dependency Health MCP?
- It runs remotely at dephealth.dsh.sh. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Dependency Health MCP need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Dependency Health MCP maintained?
- The last commit was 64 days ago (2026-09-03). The latest release is v0.1.1.
- Is Dependency Health MCP up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- How does Dependency Health MCP compare with other MCP servers?
- safety score 84/100 (higher than 68% of 48,243 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.