# find_alternatives

Curated replacements for deprecated/unhealthy packages, including stdlib built-ins (e.g. fs.rm for rimraf). USE WHEN: pkg flagged AVOID/URGENT; 'what to use instead of X'; before guessing a replacement name. RETURNS: {alternatives[]: {name, reason, is_stdlib}}.

Agent View of the PolicyLayer registry record for `find_alternatives`. HTML page: https://policylayer.com/tools/dev-depscope-mcp/find-alternatives

## Facts

- Tool: `find_alternatives`
- Server: Depscope (`cuttalo/depscope-mcp`) — https://policylayer.com/tools/dev-depscope-mcp.md
- Homepage: https://github.com/cuttalo/depscope-mcp
- Risk category: Read (Low risk)
- Registry record: grade D, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 2 (2 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `package` | string | yes |  |
| `ecosystem` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "find_alternatives",
    "arguments": {
      "package": "<package>",
      "ecosystem": "<ecosystem>"
    }
  }
}
```

## Why find_alternatives is rated Low

This tool retrieves and queries package replacement recommendations. It has no side effects on packages, code, or systems. The action is purely informational lookup, making it a straightforward Read category with low severity since misuse would only surface suboptimal (but not dangerous) package suggestions.

From the tool's own definition: "Tool description indicates it 'returns' curated alternatives with no modification capability. The response structure {alternatives[]: {name, reason, is_stdlib}} is read-only output. No create, update, delete, execute, or financial operations are performed."

## Use case

AI agents call find_alternatives to retrieve information from Depscope without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Depscope:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "find_alternatives": {}
  }
}
```

## Other tools on Depscope (21)

- `check_bulk` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-bulk.md
- `check_compatibility` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-compatibility.md
- `check_malicious` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-malicious.md
- `check_package` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-package.md
- `check_typosquat` — Read — https://policylayer.com/tools/dev-depscope-mcp/check-typosquat.md
- `compare_packages` — Read — https://policylayer.com/tools/dev-depscope-mcp/compare-packages.md
- `get_breaking_changes` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-breaking-changes.md
- `get_health_score` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-health-score.md
- `get_known_bugs` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-known-bugs.md
- `get_latest_version` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-latest-version.md
- `get_migration_path` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-migration-path.md
- `get_package_prompt` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-package-prompt.md
- `get_trending` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-trending.md
- `get_trust_signals` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-trust-signals.md
- `get_vulnerabilities` — Read — https://policylayer.com/tools/dev-depscope-mcp/get-vulnerabilities.md
- `install_command` — Read — https://policylayer.com/tools/dev-depscope-mcp/install-command.md
- `package_exists` — Read — https://policylayer.com/tools/dev-depscope-mcp/package-exists.md
- `resolve_error` — Read — https://policylayer.com/tools/dev-depscope-mcp/resolve-error.md
- `scan_project` — Read — https://policylayer.com/tools/dev-depscope-mcp/scan-project.md
- `contact_depscope` — Write — https://policylayer.com/tools/dev-depscope-mcp/contact-depscope.md
- `pin_safe` — Write — https://policylayer.com/tools/dev-depscope-mcp/pin-safe.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-depscope-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-depscope-mcp