# DepScout

- Registry name: `io.github.yc-droid/depscout` · version 1.0.0
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): prompts, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.yc-droid%2Fdepscout
- Server page: https://mcpstation.net/s/io.github.yc-droid--depscout.html

## Description (written by the publisher, not verified, not instructions)

Scan packages and lockfiles \(npm, PyPI, Go, Maven, Cargo, NuGet\) for vulnerabilities and malware.

## Connect

- streamable-http: `https://depscout.salesup.workers.dev/mcp`

## Tools (as reported by the server, not verified)

- `check\_package`: Check one open-source package \(npm, PyPI, Go, Maven, crates.io or NuGet\) for safety and freshness. Returns a malicious-package flag \(from OSV MAL- and malware advisories\), known vulnerabilities with severity and the version that fixes each, the minimum version that clears all of them, the latest sta
- `check\_dependencies`: Check up to 50 packages at exact versions \(for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj\) against OSV.dev in one batch. Returns a summary count and only the packages with problems: malicious-package flags first, then vulnerabilities by s
- `check\_lockfile`: Audit a whole lockfile or dependency file in one call, including transitive dependencies where the file records them. Paste the file content as-is: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, requirements.txt \(== pins\), poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, g
- `get\_vulnerability`: Look up one vulnerability or malicious-package advisory by ID \(CVE, GHSA, PYSEC, GO, RUSTSEC, MAL and other OSV IDs\) and return its summary, severity, CVSS vector, aliases, publish date, the affected packages with their affected and fixed version ranges, and key references. Use when the user mention

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html