# Depsonar (mcpb · depsonar.mcpb)

Dependency audits, live CVE scans, migration detection and stack health across 9 languages.

- Trust score: 52/100 (low)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- mcpb · `depsonar.mcpb`: 52/100 (this document), [markdown](https://verifymcp.io/servers/com-soflution-depsonar/depsonar.md), [page](https://verifymcp.io/servers/com-soflution-depsonar/depsonar)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb`
- Transport: `stdio`
- SHA-256: `c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 23/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs were checked across the 92 of 92 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - 30 of 92 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 73/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3136 tokens (~125/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 96% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 25 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Depsonar MCP server?

Depsonar ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb`
- SHA-256: `c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c`

### Verify on macOS / Linux

```bash
echo "c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c  depsonar.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\depsonar.mcpb).Hash -eq "c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 52, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 51, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 50, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 49, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 48, +1)

- [functional improvement] Stability: unverified → 0.07

### 2026-10-26 (score 47)

First indexed and scored.

## MCP tools (25)

### `depsonar_alerts` (~86 tokens)

Check Alerts

Show pending dependency alerts from the last background scan. This reads the cache file written by the background checker (no live scan, instant response).

If no cache exists, suggests running depsonar_scan or setting up the background checker.

Examples:
  \- "Any dependency alerts?"
  \- "Do any of my projects need updates?"
  \- "Show depsonar alerts"

### `depsonar_check` (~93 tokens)

Check Outdated Dependencies

Check a project for outdated dependencies. Supports Node.js, Python, Rust, Go, PHP, Ruby, and Dart/Flutter.

Groups results by ecosystem for Node projects. Flags major version updates.

Examples:
  \- "Check JobPin for outdated deps"
  \- "What needs updating in my Django project?"

Input parameters:

- `project` (string, required): Project name (e.g. 'my-app') or full absolute path.

### `depsonar_update` (~172 tokens)

Update Dependencies

Update dependencies for a project. Works with any supported language.

Three safety levels:
\- patch: Bugfixes only (safest)
\- minor: New features, no breaking changes (default)
\- latest: Includes major breaking changes

Examples:
  \- "Update all deps in JobPin"
  \- "Update svelte in Showly to latest"
  \- "Update my Python project dependencies"

Input parameters:

- `dry_run` (boolean): Preview without changing anything.
- `level` (string): 'patch' (bugfixes), 'minor' (features, safe), 'latest' (major, review first)
- `packages` (string): Space-separated packages to update. Leave empty for all.
- `project` (string, required): Project name (e.g. 'my-app') or full absolute path.

### `depsonar_scan` (~147 tokens)

Scan All Projects

Scan all projects in your workspace. Auto-detects language (Node, Python, Rust, Go, PHP, Ruby, Dart) and framework.

Can filter by framework or language.

Examples:
  \- "Scan all my projects"
  \- "Which Python projects need updates?"
  \- "Show all SvelteKit projects status"

Input parameters:

- `directory` (string): Root directory to scan.
- `framework` (string): Filter: 'SvelteKit', 'Next.js', 'Django', etc.
- `language` (string): Filter: 'node', 'python', 'rust', 'go', 'php', 'ruby', 'dart', 'swift', 'kotlin'.

### `depsonar_update_all` (~116 tokens)

Update All Projects

Batch update across all projects. Defaults to dry_run=true (safe preview).

Can filter by framework or language.

Examples:
  \- "Update all my projects"
  \- "Update all SvelteKit projects, apply changes"
  \- "Preview updates for all Python projects"

Input parameters:

- `directory` (string)
- `dry_run` (boolean): Defaults to true (safe preview).
- `framework` (string): Only update this framework.
- `language` (string): Only update this language.
- `level` (string)

### `depsonar_health` (~71 tokens)

Health Report

Score a project from 0-100. Checks outdated deps, security issues, lockfile.

Examples:
  \- "How healthy is JobPin?"
  \- "Health report for my Rust project"

Input parameters:

- `project` (string, required): Project name (e.g. 'my-app') or full absolute path.

### `depsonar_install` (~77 tokens)

Install Dependencies

Fresh install. Use clean=true to nuke node_modules/vendor first.

Examples:
  \- "Install deps for JobPin"
  \- "Clean install my project"

Input parameters:

- `clean` (boolean): Delete node_modules/vendor before install.
- `project` (string, required): Project name (e.g. 'my-app') or full absolute path.

### `depsonar_setup_checker` (~144 tokens)

Setup Background Checker

Install or remove the background dependency checker. On macOS, uses launchd (native, lightweight). On Linux, uses cron.

The checker runs on schedule, scans all projects, writes results to ~/.depsonar-cache.json, then exits. Zero RAM between runs, zero AI tokens, zero cost.

Results are shown by depsonar_alerts.

Examples:
  \- "Setup background dependency checking"
  \- "Check my deps every 12 hours"
  \- "Remove the background checker"

Input parameters:

- `interval_hours` (number): How often to check (in hours). Default: every 6 hours.
- `uninstall` (boolean): Remove the scheduled check.

### `depsonar_config` (~67 tokens)

Configure depsonar

View or update configuration. Saved to ~/.depsonarrc.json.

Examples:
  \- "Show depsonar config"
  \- "Set projects directory to ~/Code"

Input parameters:

- `projects_dir` (string): Set root projects directory.
- `show` (boolean): Show current config.

### `depsonar_audit` (~131 tokens)

Security Audit

Scan projects for known security vulnerabilities (CVEs). Uses npm audit, cargo audit, pip-audit, composer audit, govulncheck.

CRITICAL: Run this after any CVE announcement (e.g. Svelte CVE-2026-22775, devalue DoS).

Examples:
  \- "Audit all my projects for vulnerabilities"
  \- "Security scan JobPin"
  \- "Any CVEs in my SvelteKit projects?"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Audit a specific project. Leave empty to audit all.

### `depsonar_runtimes` (~170 tokens)

Check Runtime Versions

Check installed runtime versions (Node.js, Python, Rust, Go, PHP, Ruby, Dart, Swift). Detects EOL and outdated versions. Also checks project version files (.nvmrc, .python-version, rust-toolchain.toml, engines.node).

Examples:
  \- "Check my runtime versions"
  \- "Is my Node.js up to date?"
  \- "Any runtime mismatches in my projects?"

Input parameters:

- `check_projects` (boolean): Also check project-level version files (.nvmrc, .python-version, etc.).
- `directory` (string): Project directory to scan for version files.
- `filter` (string): Filter by runtime name: 'node', 'python', 'rust', 'go', 'php', 'ruby', 'dart', 'swift'.

### `depsonar_toolchain` (~118 tokens)

Check Global Toolchain

Check versions of globally installed tools: npm, pnpm, yarn, bun, composer, cargo, pip, typescript, git, docker, homebrew, vercel-cli, supabase-cli, wrangler.

Shows installed vs latest version and update commands.

Examples:
  \- "Check my global tools"
  \- "Is pnpm up to date?"
  \- "Show all CLI tool versions"

Input parameters:

- `category` (string): Filter by category: 'Package Managers', 'Build Tools', 'Dev Tools', 'CLI Tools'.

### `depsonar_docker` (~100 tokens)

Docker Image Audit

Scan Dockerfile and docker-compose files for outdated or EOL base images. Checks: node, python, ruby, php, golang, rust, nginx, postgres, redis, ubuntu, alpine.

Examples:
  \- "Check my Docker images"
  \- "Any EOL images in my projects?"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Scan a specific project. Leave empty to scan all.

### `depsonar_actions` (~99 tokens)

GitHub Actions Audit

Scan GitHub Actions workflow files for outdated or deprecated actions. Knows 30+ popular actions (actions/checkout, docker/build-push-action, cloudflare/wrangler-action, etc.).

Examples:
  \- "Check my GitHub Actions versions"
  \- "Any deprecated actions in my workflows?"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Scan a specific project. Leave empty to scan all.

### `depsonar_envcheck` (~113 tokens)

Environment & Config Check

Validate project environments: .env/.env.example sync, lockfile freshness, tsconfig best practices, Svelte config (detects deprecated svelte-preprocess with Svelte 5, duplicate adapters, etc.), multiple lockfiles.

Examples:
  \- "Check my project environments"
  \- "Any env issues in JobPin?"
  \- "Validate all project configs"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Check a specific project. Leave empty to check all.

### `depsonar_infra` (~131 tokens)

Full Infrastructure Report

Complete infrastructure health check in one command. Combines: runtime versions, global toolchain, security audit, CVE advisories, Docker images, GitHub Actions, environment configs, secret scanning, license compliance, deprecated packages, and optionally dependency scan.

This is the "run everything" command. Use when you want a full picture.

Examples:
  \- "Full infrastructure report"
  \- "Check everything"
  \- "How's my dev environment?"

Input parameters:

- `directory` (string): Root directory to scan.
- `skip_deps` (boolean): Skip dependency checks (faster, infra-only).

### `depsonar_cve` (~146 tokens)

CVE Advisory Check

Check projects against known framework CVEs (Svelte, SvelteKit, devalue, Next.js, Vite, Express, Axios). Goes beyond npm audit by checking a curated database of framework-specific vulnerabilities.

CRITICAL after any CVE announcement. Run immediately when new CVEs are published.

Examples:
  \- "Check my projects for known CVEs"
  \- "Any Svelte CVEs affecting my code?"
  \- "Show CVE database"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Check a specific project. Leave empty to check all.
- `show_db` (boolean): Show the full CVE advisory database.

### `depsonar_deprecated` (~113 tokens)

Deprecated Package Check

Detect deprecated, unmaintained, or replaced packages. Checks both npm deprecated flags and a curated list of known replacements (moment→dayjs, node-fetch→native fetch, request→undici, etc.).

Examples:
  \- "Any deprecated packages in my projects?"
  \- "Check JobPin for deprecated deps"
  \- "Find packages that should be replaced"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Check a specific project. Leave empty to check all.

### `depsonar_secrets` (~131 tokens)

Secret Scanner

Scan project files for exposed secrets, API keys, tokens, and credentials. Detects: AWS keys, GitHub tokens, Stripe keys, Supabase JWT, OpenAI/Anthropic keys, private keys, database URLs, generic API key patterns.

Also checks that .env files are properly gitignored.

Examples:
  \- "Scan my projects for exposed secrets"
  \- "Any leaked API keys in JobPin?"
  \- "Secret scan all projects"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Scan a specific project. Leave empty to scan all.

### `depsonar_licenses` (~115 tokens)

License Compliance Check

Check dependency licenses for commercial/SaaS compatibility. Flags: GPL/AGPL (copyleft, requires source disclosure), non-commercial (CC-BY-NC), unknown licenses.

Important for SaaS products to avoid legal issues.

Examples:
  \- "Check license compliance for RoomPilot"
  \- "Any GPL dependencies in my projects?"
  \- "License audit all projects"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Check a specific project. Leave empty to check all.

### `depsonar_live_cve` (~150 tokens)

Live CVE Scan (osv.dev)

Real-time vulnerability scan using the osv.dev API. Checks every installed package against the global OSV database (npm, PyPI, crates.io, Go, Packagist, RubyGems, Pub).

Unlike depsonar_audit (which uses local tools like npm audit), this queries the live osv.dev database for the most up-to-date vulnerability data. No API key needed.

Examples:
  \- "Live CVE scan all my projects"
  \- "Check RoomPilot for vulnerabilities with osv.dev"
  \- "Real-time security scan"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Scan a specific project. Leave empty to scan all.

### `depsonar_changelog` (~105 tokens)

Changelog & Breaking Changes

Check changelogs and breaking changes before updating. Shows major/minor/patch breakdown with changelog URLs and release notes for breaking updates.

Run this BEFORE depsonar_update to understand what will change.

Examples:
  \- "Show changelog for RoomPilot before updating"
  \- "What breaking changes are pending in my project?"
  \- "Check what changed in latest versions"

Input parameters:

- `project` (string, required): Project name or path to check changelogs for.

### `depsonar_migrate` (~128 tokens)

Framework Migration Detector

Detect framework migration needs by scanning code for deprecated patterns. Currently supports: Svelte 4→5, Next.js 13→14→15.

Finds exact file locations of code that needs to change, with migration instructions for each pattern.

Examples:
  \- "Check if my projects need Svelte 5 migration"
  \- "Migration scan for all projects"
  \- "What Svelte 4 patterns are still in my code?"

Input parameters:

- `directory` (string): Root directory to scan.
- `project` (string): Check a specific project. Leave empty to check all.

### `depsonar_docs` (~305 tokens)

Library Documentation (Context)

Fetch up-to-date documentation, changelogs, and migration guides for any npm package directly from source (GitHub + npm registry).

Use this BEFORE writing code that depends on a library, to get the latest API docs and avoid hallucinating outdated APIs.

Sections available:
\- **readme**: Latest README with API docs, examples, setup instructions
\- **changelog**: Recent release notes (last 5 versions) with breaking changes
\- **migration**: Migration/upgrade guides (supports Svelte, Next.js, Tailwind, Vite, Stripe, Supabase, Better Auth, etc.)

Combine with a query to focus on a specific topic (e.g. query="runes" for Svelte 5 migration docs).

Examples:
  \- "Get Svelte 5 docs focused on runes migration"
  \- "Show me the Supabase JS changelog"
  \- "What changed in Tailwind CSS v4?"
  \- "Get Better Auth setup docs"

Input parameters:

- `package` (string, required): Package name to fetch docs for (e.g. 'svelte', '@supabase/supabase-js', 'tailwindcss').
- `query` (string): Optional: specific question or topic to focus docs on (e.g. 'runes migration', 'auth setup', 'streaming').
- `sections` (string): Which sections to fetch: 'all' (default), 'readme', 'changelog', or 'migration'.

### `depsonar_search_package` (~108 tokens)

Search npm Packages

Search the npm registry for packages by name or keyword. Returns matching packages with name, latest version, and description.

Use this to find the right package name before calling depsonar_docs.

Examples:
  \- "Search for Svelte authentication libraries"
  \- "Find Stripe payment packages"
  \- "What Tailwind utility packages exist?"

Input parameters:

- `query` (string, required): Search query to find packages (e.g. 'svelte auth', 'stripe payment', 'tailwind merge').

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-soflution-depsonar/depsonar#diagnostics

## Score history

- 2026-11-05: 52
- 2026-11-04: 51
- 2026-11-03: 51
- 2026-11-02: 50
- 2026-11-01: 50
- 2026-10-31: 49
- 2026-10-30: 49
- 2026-10-29: 48
- 2026-10-28: 48
- 2026-10-27: 47
- 2026-10-26: 47

## Common questions

### What is the Depsonar MCP server?

Depsonar is an MCP server listed in the public MCP registry as com.soflution/depsonar. Dependency audits, live CVE scans, migration detection and stack health across 9 languages. This page covers its MCPB bundle (https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb).

### Is the Depsonar MCP server safe to use?

Depsonar scores 52 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Depsonar MCP server expose?

Depsonar exposes 25 tools: depsonar_alerts, depsonar_check, depsonar_update, depsonar_scan, depsonar_update_all, and 20 more. Their descriptions and schemas cost roughly 3,136 tokens of context every time the server is loaded.

### What licence is the Depsonar MCP server under?

Depsonar declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/Soflutionltd/depsonar
- Changelog RSS feed: https://verifymcp.io/servers/com-soflution-depsonar/depsonar.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-soflution-depsonar/depsonar.json
- HTML version of this page: https://verifymcp.io/servers/com-soflution-depsonar/depsonar