# contact_depscope

Inbound ticket: bug/listing/security/anomaly/partnership. USE WHEN: reporting wrong data (bug), requesting a new pkg/ecosystem index (listing), disclosing a DepScope security issue (security), flagging a concrete mismatch in another tool's output vs. authoritative source (anomaly — provide tool_called+observed+expected), or partnership/press (partnership). RETURNS: {ticket_id} or {anomaly_id}.

Agent View of the PolicyLayer registry record for `contact_depscope`. HTML page: https://policylayer.com/tools/dev-depscope-mcp/contact-depscope

## Facts

- Tool: `contact_depscope`
- Server: Depscope (`cuttalo/depscope-mcp`) — https://policylayer.com/tools/dev-depscope-mcp.md
- Homepage: https://github.com/cuttalo/depscope-mcp
- Risk category: Write (Medium risk)
- Registry record: grade D, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 12
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `body` | string | no | Message body (10-8000 chars). Be specific: include package name, ecosystem, error trace, repro steps when applicable. |
| `kind` | string | no | Ticket category. `anomaly` routes to structured anomaly triage (requires tool_called/observed/expected). |
| `name` | string | no | Sender display name (optional). |
| `email` | string | no | Reply-to email of the requester (required for bug/listing/security/partnership). |
| `company` | string | no | Company / organization (optional). |
| `package` | string | no | For kind=anomaly: package name involved, if any. |
| `subject` | string | no | Short subject line (3-200 chars). |
| `version` | string | no | For kind=anomaly: package version involved, if any. |
| `expected` | string | no | For kind=anomaly: what you expected to see (1-1500 chars). Be concrete. |
| `observed` | string | no | For kind=anomaly: what DepScope returned (1-1500 chars). |
| `ecosystem` | string | no | For kind=anomaly: ecosystem of the involved package, if any. |
| `tool_called` | string | no | For kind=anomaly: DepScope tool that produced the anomaly (e.g. check_package, get_migration_path). |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "contact_depscope",
    "arguments": {}
  }
}
```

## Why contact_depscope is rated Medium

This tool creates a support/reporting ticket (bug, listing, security disclosure, anomaly, or partnership request) and returns a ticket or anomaly ID. It creates a new record reversibly (a ticket can be voided/closed), making it a Write operation. Blast radius is low since it only submits an inbound report to DepScope staff and does not modify any package data or execute code.

From the tool's own definition: "Inbound ticket: bug/listing/security/anomaly/partnership... RETURNS: {ticket_id} or {anomaly_id}"

Risk signals: Accepts raw HTML/template content (body) · High parameter count (13 properties)

## Use case

AI agents use contact_depscope to create or update resources in Depscope, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Depscope environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Depscope:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "contact_depscope": {
      "limits": [
        {
          "counter": "contact_depscope_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Depscope (21)

- `check_bulk` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-bulk.md
- `check_compatibility` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-compatibility.md
- `check_malicious` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-malicious.md
- `check_package` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-package.md
- `check_typosquat` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-typosquat.md
- `compare_packages` — Read — https://policylayer.com/tools/dev-depscope-mcp/compare-packages.md
- `find_alternatives` — Read — https://policylayer.com/tools/dev-depscope-mcp/find-alternatives.md
- `get_breaking_changes` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-breaking-changes.md
- `get_health_score` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-health-score.md
- `get_known_bugs` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-known-bugs.md
- `get_latest_version` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-latest-version.md
- `get_migration_path` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-migration-path.md
- `get_package_prompt` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-package-prompt.md
- `get_trending` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-trending.md
- `get_trust_signals` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-trust-signals.md
- `get_vulnerabilities` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-vulnerabilities.md
- `install_command` — Read — https://policylayer.com/tools/dev-depscope-mcp/install-command.md
- `package_exists` — Read — https://policylayer.com/tools/dev-depscope-mcp/package-exists.md
- `resolve_error` — Read — https://policylayer.com/tools/dev-depscope-mcp/resolve-error.md
- `scan_project` — Read — https://policylayer.com/tools/dev-depscope-mcp/scan-project.md
- `pin_safe` — Write — https://policylayer.com/tools/dev-depscope-mcp/pin-safe.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-depscope-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-depscope-mcp