All servers · Security

DepScout

io.github.yc-droid/depscout · v1.0.0

Measured by MCP Station

Description written by the publisher, not verified

Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.

Connect

claude mcp add --transport http depscout https://depscout.salesup.workers.dev/mcp

{
  "mcpServers": {
    "depscout": {
      "url": "https://depscout.salesup.workers.dev/mcp"
    }
  }
}

Tools as reported by the server

• check_package
  Check one open-source package (npm, PyPI, Go, Maven, crates.io or NuGet) for safety and freshness. Returns a malicious-package flag (from OSV MAL- and malware advisories), known vulnerabilities with severity and the version that fixes each, the minimum version that clears all of them, the latest sta
• check_dependencies
  Check up to 50 packages at exact versions (for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj) against OSV.dev in one batch. Returns a summary count and only the packages with problems: malicious-package flags first, then vulnerabilities by s
• check_lockfile
  Audit a whole lockfile or dependency file in one call, including transitive dependencies where the file records them. Paste the file content as-is: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, requirements.txt (== pins), poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, g
• get_vulnerability
  Look up one vulnerability or malicious-package advisory by ID (CVE, GHSA, PYSEC, GO, RUSTSEC, MAL and other OSV IDs) and return its summary, severity, CVSS vector, aliases, publish date, the affected packages with their affected and fixed version ranges, and key references. Use when the user mention

Website · JSON · Text for agents · Registry updated 2026-10-07