# Depscope MCP server

Agent View of the PolicyLayer registry record for Depscope: identity, probed posture, risk grade, and all 22 tools classified. HTML page: https://policylayer.com/tools/dev-depscope-mcp

## Facts

- Server id: `cuttalo/depscope-mcp`
- Homepage: https://github.com/cuttalo/depscope-mcp
- Registry record: grade D, identity unverified
- Lifecycle: active
- Auth posture: open
- Rate-limited: no
- Tools: 22 (22 with introspected schema)
- Tool categories present: Read, Write
- Context-window cost: 4348 tokens per request — https://policylayer.com/token-cost/dev-depscope-mcp
- Tags: dev depscope mcp
- Record last modified: 2026-08-13T16:05:14.619Z

## Tools (22)

| Tool | Category | Risk | Record |
| --- | --- | --- | --- |
| `check_bulk` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/check-bulk.md |
| `check_compatibility` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/check-compatibility.md |
| `check_malicious` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/check-malicious.md |
| `check_package` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/check-package.md |
| `check_typosquat` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/check-typosquat.md |
| `compare_packages` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/compare-packages.md |
| `find_alternatives` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/find-alternatives.md |
| `get_breaking_changes` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-breaking-changes.md |
| `get_health_score` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-health-score.md |
| `get_known_bugs` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-known-bugs.md |
| `get_latest_version` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-latest-version.md |
| `get_migration_path` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-migration-path.md |
| `get_package_prompt` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-package-prompt.md |
| `get_trending` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-trending.md |
| `get_trust_signals` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-trust-signals.md |
| `get_vulnerabilities` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/get-vulnerabilities.md |
| `install_command` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/install-command.md |
| `package_exists` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/package-exists.md |
| `resolve_error` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/resolve-error.md |
| `scan_project` | Read | Low | https://policylayer.com/tools/dev-depscope-mcp/scan-project.md |
| `contact_depscope` | Write | Medium | https://policylayer.com/tools/dev-depscope-mcp/contact-depscope.md |
| `pin_safe` | Write | Medium | https://policylayer.com/tools/dev-depscope-mcp/pin-safe.md |

## Tool descriptions

- `check_bulk` — Fast pre-flight filter for a batch of (ecosystem, package) pairs. DB-only, <100ms for 100 items. USE WHEN: about to emit npm install a b c … or pip install a b c … — catches hallucinated names, stdlib, typos, and known-bad in ONE call. N…
- `check_compatibility` — Is this specific multi-package version combo verified to work together? USE WHEN: pinning a stack (next@15 + react@19 + node@22); before recommending a version matrix. RETURNS: {compatible, conflicts[], notes}.
- `check_malicious` — Supply-chain malware check against OpenSSF/OSV. USE WHEN: about to suggest install of an unvetted/unfamiliar package; name came from a blog/tutorial. Call BEFORE check_package for untrusted pkgs. RETURNS: {is_malicious, threat_tier, sour…
- `check_package` — Full machine-readable JSON report (~2k tokens). USE WHEN: you need to programmatically parse specific fields (CI gating, UI, sub-field extraction). Otherwise prefer get_package_prompt. RETURNS: {package, health:{score}, vulnerabilities[]…
- `check_typosquat` — Typosquat detector. USE WHEN: name differs from a well-known package by 1-2 chars (lodsh, reqeusts); copy-paste from unreliable source; downloads near zero but name looks familiar. RETURNS: {is_typosquat, likely_target, confidence}.
- `compare_packages` — Side-by-side comparison (health, vulns, downloads, maintainers, last release) of 2-10 packages in the same ecosystem. USE WHEN: 'X vs Y' / 'should I pick X or Y'. RETURNS: table-shaped JSON, one row per package.
- `find_alternatives` — Curated replacements for deprecated/unhealthy packages, including stdlib built-ins (e.g. fs.rm for rimraf). USE WHEN: pkg flagged AVOID/URGENT; 'what to use instead of X'; before guessing a replacement name. RETURNS: {alternatives[]: {na…
- `get_breaking_changes` — Breaking changes between two majors of the SAME package (next@14→15). USE WHEN: user is bumping a major; before recommending a major upgrade. Different from get_migration_path (same pkg vs. different pkg). RETURNS: {breaking_changes[]: {…
- `get_health_score` — Single 0-100 health score — cheapest go/no-go gate (>=70 safe). USE WHEN: CI gating or pkg already screened for malware/typos. NOT a first screen — run check_malicious + check_typosquat first. For a verbal verdict use get_package_prompt.…
- `get_known_bugs` — Non-CVE known bugs for a specific package version. USE WHEN: unexpected behavior that is NOT a security issue; a pinned version misbehaves. RETURNS: {bugs[]: {title, fixed_in, workaround}}.
- `get_latest_version` — Latest published version + deprecation flag — the cheapest call. USE WHEN: only a version string matters (pinning a dep, answering 'what version of X'). If you also need health/vulns use check_package. RETURNS: {latest, deprecated, publi…
- `get_migration_path` — Prescriptive migration plan between DIFFERENT packages — rationale + literal code diff + breaking changes + effort minutes. USE WHEN: replacing request→axios, moment→dayjs, flask→fastapi, etc.; both endpoints known. RETURNS: {rationale, …
- `get_package_prompt` — LLM-optimised package brief — plain text ~300 tokens (~75% cheaper than JSON). Verdict (SAFE/AVOID/URGENT/MALICIOUS) + health + vulns + alternatives + maintainer alerts. USE WHEN: you want to reason over a package and drop the output dir…
- `get_trending` — Live trending packages with rank-delta and weekly growth %. USE WHEN: 'what is rising in npm/PyPI/Cargo right now'; recommendation not biased by training-data cutoff. RETURNS: {items[]: {name, rank, rank_delta, weekly_growth_pct}}.
- `get_trust_signals` — One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release velocity, publish security), and SLSA/Sigstore provenance. USE WHEN: deep-ve…
- `get_vulnerabilities` — CVE/OSV advisories affecting the latest (or specified) version. USE WHEN: security-sensitive project; user asks 'any CVEs in X'; you already know the pkg exists. RETURNS: {vulnerability_count, vulnerabilities[]: {id, severity, cvss, fixe…
- `install_command` — Canonical install command(s) across every package manager of the ecosystem (npm/pnpm/yarn/bun, pip/uv/poetry, cargo, go, composer, maven+gradle, nuget, …). USE WHEN: emitting an install line and you want correct flags. RETURNS: {primary,…
- `package_exists` — Boolean registry existence check. USE WHEN: about to emit a package name in an install command but unsure it exists; verifying a name generated from training data. RETURNS: {exists}.
- `resolve_error` — Map error OR free-text query to a verified fix. USE WHEN: user pastes a concrete error/stack (ENOENT, ImportError, build failure) — pass error. OR user describes a symptom ('webpack slow', 'pip stuck') — pass query. Always prefer this ov…
- `scan_project` — Audit a project's dependencies in one shot. Returns a single-sentence verdict (e.g. "DO NOT INSTALL — 1 hallucinated: fastapi-turbo") that an agent can paste into its reply, plus per-package health/vulns/recommendation. Detects hallucina…
- `contact_depscope` — Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (bug), requesting a new pkg/ecosystem index (listing), disclosing a DepScope security issue (security), flagging a concrete mismatch in another tool…
- `pin_safe` — Highest version below the chosen CVE severity tier, respecting a semver constraint. USE WHEN: writing a package.json/requirements.txt line; resolving dependabot by lowest-risk patched version. RETURNS: {recommended_version, walk_log[]}.

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-depscope-mcp · API: https://policylayer.com/registry/api · Recommended policies for every tool: https://policylayer.com/policies/dev-depscope-mcp