Depsonar
MCPB · DEPSONAR.MCPB
Dependency audits, live CVE scans, migration detection and stack health across 9 languages.
Available components
Last scanned (4 hours ago)
Scores higher than 84% of MCPB servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security23
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs were checked across the 92 of 92 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- 30 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability73
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3136 tokens (~125/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management33
- Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 25 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
- Stability: unverified → 0.07 ▲ functional
- 26 Oct 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed mcpb/https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | mcpb |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
depsonar_actions GitHub Actions Audit ~99
Scan GitHub Actions workflow files for outdated or deprecated actions. Knows 30+ popular actions (actions/checkout, docker/build-push-action, cloudflare/wrangler-action, etc.). Examples: - "Check my GitHub Actions versions" - "Any deprecated actions in my workflows?"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Scan a specific project. Leave empty to scan all. |
No output schema declared.
No examples provided.
depsonar_alerts Check Alerts ~86
Show pending dependency alerts from the last background scan. This reads the cache file written by the background checker (no live scan, instant response). If no cache exists, suggests running depsonar_scan or setting up the background checker. Examples: - "Any dependency alerts?" - "Do any of my projects need updates?" - "Show depsonar alerts"
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
depsonar_audit Security Audit ~131
Scan projects for known security vulnerabilities (CVEs). Uses npm audit, cargo audit, pip-audit, composer audit, govulncheck. CRITICAL: Run this after any CVE announcement (e.g. Svelte CVE-2026-22775, devalue DoS). Examples: - "Audit all my projects for vulnerabilities" - "Security scan JobPin" - "Any CVEs in my SvelteKit projects?"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Audit a specific project. Leave empty to audit all. |
No output schema declared.
No examples provided.
depsonar_changelog Changelog & Breaking Changes ~105
Check changelogs and breaking changes before updating. Shows major/minor/patch breakdown with changelog URLs and release notes for breaking updates. Run this BEFORE depsonar_update to understand what will change. Examples: - "Show changelog for RoomPilot before updating" - "What breaking changes are pending in my project?" - "Check what changed in latest versions"
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | Project name or path to check changelogs for. |
No output schema declared.
No examples provided.
depsonar_check Check Outdated Dependencies ~93
Check a project for outdated dependencies. Supports Node.js, Python, Rust, Go, PHP, Ruby, and Dart/Flutter. Groups results by ecosystem for Node projects. Flags major version updates. Examples: - "Check JobPin for outdated deps" - "What needs updating in my Django project?"
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | Project name (e.g. 'my-app') or full absolute path. |
No output schema declared.
No examples provided.
depsonar_config Configure depsonar ~67
View or update configuration. Saved to ~/.depsonarrc.json. Examples: - "Show depsonar config" - "Set projects directory to ~/Code"
| Name | Type | Req | Description |
|---|---|---|---|
| projects_dir | string | – | Set root projects directory. |
| show | boolean | – | Show current config. |
No output schema declared.
No examples provided.
depsonar_cve CVE Advisory Check ~146
Check projects against known framework CVEs (Svelte, SvelteKit, devalue, Next.js, Vite, Express, Axios). Goes beyond npm audit by checking a curated database of framework-specific vulnerabilities. CRITICAL after any CVE announcement. Run immediately when new CVEs are published. Examples: - "Check my projects for known CVEs" - "Any Svelte CVEs affecting my code?" - "Show CVE database"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Check a specific project. Leave empty to check all. |
| show_db | boolean | – | Show the full CVE advisory database. |
No output schema declared.
No examples provided.
depsonar_deprecated Deprecated Package Check ~113
Detect deprecated, unmaintained, or replaced packages. Checks both npm deprecated flags and a curated list of known replacements (moment→dayjs, node-fetch→native fetch, request→undici, etc.). Examples: - "Any deprecated packages in my projects?" - "Check JobPin for deprecated deps" - "Find packages that should be replaced"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Check a specific project. Leave empty to check all. |
No output schema declared.
No examples provided.
depsonar_docker Docker Image Audit ~100
Scan Dockerfile and docker-compose files for outdated or EOL base images. Checks: node, python, ruby, php, golang, rust, nginx, postgres, redis, ubuntu, alpine. Examples: - "Check my Docker images" - "Any EOL images in my projects?"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Scan a specific project. Leave empty to scan all. |
No output schema declared.
No examples provided.
depsonar_docs Library Documentation (Context) ~305
Fetch up-to-date documentation, changelogs, and migration guides for any npm package directly from source (GitHub + npm registry). Use this BEFORE writing code that depends on a library, to get the latest API docs and avoid hallucinating outdated APIs. Sections available: - **readme**: Latest README with API docs, examples, setup instructions - **changelog**: Recent release notes (last 5 versions) with breaking changes - **migration**: Migration/upgrade guides (supports Svelte, Next.js, Tailwind, Vite, Stripe, Supabase, Better Auth, etc.) Combine with a query to focus on a specific topic (e.g. query="runes" for Svelte 5 migration docs). Examples: - "Get Svelte 5 docs focused on runes migration" - "Show me the Supabase JS changelog" - "What changed in Tailwind CSS v4?" - "Get Better Auth setup docs"
| Name | Type | Req | Description |
|---|---|---|---|
| package | string | yes | Package name to fetch docs for (e.g. 'svelte', '@supabase/supabase-js', 'tailwindcss'). |
| query | string | – | Optional: specific question or topic to focus docs on (e.g. 'runes migration', 'auth setup', 'streaming'). |
| sections | string | – | Which sections to fetch: 'all' (default), 'readme', 'changelog', or 'migration'. |
No output schema declared.
No examples provided.
depsonar_envcheck Environment & Config Check ~113
Validate project environments: .env/.env.example sync, lockfile freshness, tsconfig best practices, Svelte config (detects deprecated svelte-preprocess with Svelte 5, duplicate adapters, etc.), multiple lockfiles. Examples: - "Check my project environments" - "Any env issues in JobPin?" - "Validate all project configs"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Check a specific project. Leave empty to check all. |
No output schema declared.
No examples provided.
depsonar_health Health Report ~71
Score a project from 0-100. Checks outdated deps, security issues, lockfile. Examples: - "How healthy is JobPin?" - "Health report for my Rust project"
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | yes | Project name (e.g. 'my-app') or full absolute path. |
No output schema declared.
No examples provided.
depsonar_infra Full Infrastructure Report ~131
Complete infrastructure health check in one command. Combines: runtime versions, global toolchain, security audit, CVE advisories, Docker images, GitHub Actions, environment configs, secret scanning, license compliance, deprecated packages, and optionally dependency scan. This is the "run everything" command. Use when you want a full picture. Examples: - "Full infrastructure report" - "Check everything" - "How's my dev environment?"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| skip_deps | boolean | – | Skip dependency checks (faster, infra-only). |
No output schema declared.
No examples provided.
depsonar_install Install Dependencies ~77
Fresh install. Use clean=true to nuke node_modules/vendor first. Examples: - "Install deps for JobPin" - "Clean install my project"
| Name | Type | Req | Description |
|---|---|---|---|
| clean | boolean | – | Delete node_modules/vendor before install. |
| project | string | yes | Project name (e.g. 'my-app') or full absolute path. |
No output schema declared.
No examples provided.
depsonar_licenses License Compliance Check ~115
Check dependency licenses for commercial/SaaS compatibility. Flags: GPL/AGPL (copyleft, requires source disclosure), non-commercial (CC-BY-NC), unknown licenses. Important for SaaS products to avoid legal issues. Examples: - "Check license compliance for RoomPilot" - "Any GPL dependencies in my projects?" - "License audit all projects"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Check a specific project. Leave empty to check all. |
No output schema declared.
No examples provided.
depsonar_live_cve Live CVE Scan (osv.dev) ~150
Real-time vulnerability scan using the osv.dev API. Checks every installed package against the global OSV database (npm, PyPI, crates.io, Go, Packagist, RubyGems, Pub). Unlike depsonar_audit (which uses local tools like npm audit), this queries the live osv.dev database for the most up-to-date vulnerability data. No API key needed. Examples: - "Live CVE scan all my projects" - "Check RoomPilot for vulnerabilities with osv.dev" - "Real-time security scan"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Scan a specific project. Leave empty to scan all. |
No output schema declared.
No examples provided.
depsonar_migrate Framework Migration Detector ~128
Detect framework migration needs by scanning code for deprecated patterns. Currently supports: Svelte 4→5, Next.js 13→14→15. Finds exact file locations of code that needs to change, with migration instructions for each pattern. Examples: - "Check if my projects need Svelte 5 migration" - "Migration scan for all projects" - "What Svelte 4 patterns are still in my code?"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Check a specific project. Leave empty to check all. |
No output schema declared.
No examples provided.
depsonar_runtimes Check Runtime Versions ~170
Check installed runtime versions (Node.js, Python, Rust, Go, PHP, Ruby, Dart, Swift). Detects EOL and outdated versions. Also checks project version files (.nvmrc, .python-version, rust-toolchain.toml, engines.node). Examples: - "Check my runtime versions" - "Is my Node.js up to date?" - "Any runtime mismatches in my projects?"
| Name | Type | Req | Description |
|---|---|---|---|
| check_projects | boolean | – | Also check project-level version files (.nvmrc, .python-version, etc.). |
| directory | string | – | Project directory to scan for version files. |
| filter | string | – | Filter by runtime name: 'node', 'python', 'rust', 'go', 'php', 'ruby', 'dart', 'swift'. |
No output schema declared.
No examples provided.
depsonar_scan Scan All Projects ~147
Scan all projects in your workspace. Auto-detects language (Node, Python, Rust, Go, PHP, Ruby, Dart) and framework. Can filter by framework or language. Examples: - "Scan all my projects" - "Which Python projects need updates?" - "Show all SvelteKit projects status"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| framework | string | – | Filter: 'SvelteKit', 'Next.js', 'Django', etc. |
| language | string | – | Filter: 'node', 'python', 'rust', 'go', 'php', 'ruby', 'dart', 'swift', 'kotlin'. |
No output schema declared.
No examples provided.
depsonar_search_package Search npm Packages ~108
Search the npm registry for packages by name or keyword. Returns matching packages with name, latest version, and description. Use this to find the right package name before calling depsonar_docs. Examples: - "Search for Svelte authentication libraries" - "Find Stripe payment packages" - "What Tailwind utility packages exist?"
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Search query to find packages (e.g. 'svelte auth', 'stripe payment', 'tailwind merge'). |
No output schema declared.
No examples provided.
depsonar_secrets Secret Scanner ~131
Scan project files for exposed secrets, API keys, tokens, and credentials. Detects: AWS keys, GitHub tokens, Stripe keys, Supabase JWT, OpenAI/Anthropic keys, private keys, database URLs, generic API key patterns. Also checks that .env files are properly gitignored. Examples: - "Scan my projects for exposed secrets" - "Any leaked API keys in JobPin?" - "Secret scan all projects"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | Root directory to scan. |
| project | string | – | Scan a specific project. Leave empty to scan all. |
No output schema declared.
No examples provided.
depsonar_setup_checker Setup Background Checker ~144
Install or remove the background dependency checker. On macOS, uses launchd (native, lightweight). On Linux, uses cron. The checker runs on schedule, scans all projects, writes results to ~/.depsonar-cache.json, then exits. Zero RAM between runs, zero AI tokens, zero cost. Results are shown by depsonar_alerts. Examples: - "Setup background dependency checking" - "Check my deps every 12 hours" - "Remove the background checker"
| Name | Type | Req | Description |
|---|---|---|---|
| interval_hours | number | – | How often to check (in hours). Default: every 6 hours. |
| uninstall | boolean | – | Remove the scheduled check. |
No output schema declared.
No examples provided.
depsonar_toolchain Check Global Toolchain ~118
Check versions of globally installed tools: npm, pnpm, yarn, bun, composer, cargo, pip, typescript, git, docker, homebrew, vercel-cli, supabase-cli, wrangler. Shows installed vs latest version and update commands. Examples: - "Check my global tools" - "Is pnpm up to date?" - "Show all CLI tool versions"
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by category: 'Package Managers', 'Build Tools', 'Dev Tools', 'CLI Tools'. |
No output schema declared.
No examples provided.
depsonar_update Update Dependencies ~172
Update dependencies for a project. Works with any supported language. Three safety levels: - patch: Bugfixes only (safest) - minor: New features, no breaking changes (default) - latest: Includes major breaking changes Examples: - "Update all deps in JobPin" - "Update svelte in Showly to latest" - "Update my Python project dependencies"
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview without changing anything. |
| level | string | – | 'patch' (bugfixes), 'minor' (features, safe), 'latest' (major, review first) |
| packages | string | – | Space-separated packages to update. Leave empty for all. |
| project | string | yes | Project name (e.g. 'my-app') or full absolute path. |
No output schema declared.
No examples provided.
depsonar_update_all Update All Projects ~116
Batch update across all projects. Defaults to dry_run=true (safe preview). Can filter by framework or language. Examples: - "Update all my projects" - "Update all SvelteKit projects, apply changes" - "Preview updates for all Python projects"
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | – |
| dry_run | boolean | – | Defaults to true (safe preview). |
| framework | string | – | Only update this framework. |
| language | string | – | Only update this language. |
| level | string | – | – |
No output schema declared.
No examples provided.
How do I install the Depsonar MCP server?
Depsonar ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c; the commands to do that are on this page. If it does not match, do not open it.
mcpb · depsonar.mcpb
Download bundleCheck the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.
SHA-256
c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c
macOS / Linux
echo "c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c depsonar.mcpb" | shasum -a 256 -c
Windows (PowerShell)
(Get-FileHash -Algorithm SHA256 .\depsonar.mcpb).Hash -eq "c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c"
Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.
What is the Depsonar MCP server?
Depsonar is an MCP server listed in the public MCP registry as com.soflution/depsonar. Dependency audits, live CVE scans, migration detection and stack health across 9 languages. This page covers its MCPB bundle (https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb).
Is the Depsonar MCP server safe to use?
Depsonar scores 52 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Depsonar MCP server expose?
Depsonar exposes 25 tools: depsonar_alerts, depsonar_check, depsonar_update, depsonar_scan, depsonar_update_all, and 20 more. Their descriptions and schemas cost roughly 3,136 tokens of context every time the server is loaded.
What licence is the Depsonar MCP server under?
Depsonar declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.