MCP Dependency Doctor

MCP Dependency Doctor

Let your AI agent audit npm dependencies safely: inventory, vulnerabilities, outdated and deprecated packages — read-only, never runs install.

Locally diagnose npm projects with package-lock.json: four MCP tools that read lockfiles, run npm audit, check for outdated versions, and inspect public package health. Zero setup, no API keys.

---

⚡ Quick Install

Cursor

Click the badge above or use this deeplink:

cursor://anysphere.cursor-deeplink/mcp/install?name=dependency-doctor&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm1jcC1kZXBlbmRlbmN5LWRvY3RvciJdfQ==

Claude Code (recommended)

claude mcp add dependency-doctor -- npx -y mcp-dependency-doctor

Or, if available in the marketplace:

/plugin marketplace add petrovicistefan/mcp-marketplace

Claude Desktop

Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows, ~/.config/Claude/claude_desktop_config.json on Linux):

{

"mcpServers": { "dependency-doctor": { "command": "npx", "args": ["-y", "mcp-dependency-doctor"] } } }

VS Code

Install in VS Code

Or create .vscode/mcp.json in your project:

{

"mcpServers": { "dependency-doctor": { "command": "npx", "args": ["-y", "mcp-dependency-doctor"] } } }

Any MCP Client (Manual)

Run directly with npx:

npx -y mcp-dependency-doctor

⭐ Star this repository to support the project and stay updated! → Give a star

---

---

📋 Table of Contents

• Why MCP Dependency Doctor?
• How It Compares
• Use Cases
• What It Checks
• Requirements
• Limitations
• Security & Privacy
• Hosted Path (Quotas via Control Plane)
• Roadmap and Commercial Boundary
• Development
• Contributing
• More MCP Servers by the Author

---

Why MCP Dependency Doctor?

AI coding agents can help you maintain dependencies, but only if they know what's installed, what's vulnerable, and what's deprecated. MCP Dependency Doctor gives them that visibility without running `npm install` or requiring external accounts.

Perfect for:

• Individual developers: let Claude or Cursor help you triage vulnerabilities, plan upgrades, and audit deprecated packages — all locally
• CI/PR checks (coming): catch risky dependencies in code review before they merge
• Security-conscious teams: read-only analysis, explicit network disclosure, no telemetry

All four tools are read-only and designed for AI agents: they return structured JSON reports that LLMs can interpret to answer questions like:

• *"What vulnerabilities affect this project?"*
• *"Which packages are deprecated and should we replace them?"*
• *"Show me the dependency tree with exact installed versions."*
• *"Are we using outdated major versions, and what's the upgrade path?"*

---

How It Compares

*As of October 2026. All projects are MIT-licensed and open-source. Corrections welcome.*

Our differentiators:

• Designed for AI agents: all four tools return JSON structured for LLM interpretation, not just CLI output
• Local lockfile inventory: parse exact versions and transitive dependencies without network access
• Read-only by design: never runs npm install, npm audit fix, or lifecycle scripts — safe to use on any project
• Explicit network disclosure: tools clearly state when they contact npm registries; inventory tool is fully offline
• Control-plane ready: hosted path for quotas and future team features (MVP)

---

Use Cases

1. Security Audit Before Major Refactor

Ask your AI to triage vulnerabilities and plan fixes.

Agent: "Audit this project's dependencies. List critical and high vulnerabilities, 

check which packages are deprecated, and suggest an upgrade order that minimizes breaking changes. Do not modify files."

The agent will:

1. Run dependency_audit to find vulnerabilities with severity, CVSS, and affected versions
2. Check package_health for each flagged package to detect deprecations
3. Use dependency_outdated to identify safe upgrade targets
4. Propose a remediation plan based on the combined data

2. Dependency Inventory for Onboarding

Understand what a new codebase depends on.

Agent: "Show me the full dependency tree with exact versions. 

Highlight any packages over 2 years old."

The agent uses dependency_inventory (fully local, no network) to read package-lock.json and report:

• All declared dependencies (prod + dev + optional)
• All transitive dependencies with exact installed versions
• Node engine requirements per package

3. Maintenance Signal for Abandoned Packages

Identify packages that haven't been updated in years.

Agent: "List all dependencies and check their last release date. 

Flag any that haven't been updated in over two years."

The agent calls package_health for each package to report:

• Latest version and publish date
• Deprecation warnings (if any)
• Node engine and peer dependency requirements
• Maintenance signal (automated age-based heuristic)

4. Pull Request Dependency Snapshot

Document what changed in a dependency update PR.

Agent: "Before and after versions of all packages affected by this update. 

Show vulnerabilities fixed and any new ones introduced."

Agents can run dependency_audit on both the base branch and the PR branch to produce a diff of resolved and introduced vulnerabilities.

---

What It Checks

MCP Dependency Doctor exposes four read-only MCP tools:

Tools

Detailed behavior:

Privacy defaults:

• dependency_inventory is fully offline: it only reads local files
• The other three tools disclose package names and versions to npm registries
• Registry authentication uses the user's npm configuration (respects .npmrc)
• package_health does not send npm credentials (queries public registry API)
• No telemetry, no cloud uploads, no external accounts

All tools accept `projectPath` (relative to MCP_PROJECT_ROOT). Paths are validated through realpath and confined to the project root; do not expose this server to untrusted remote clients.

Example agent prompt:

"Audit this project, inspect deprecated packages, and suggest an upgrade order. 

Do not change files."

---

Requirements

Node.js 22+ is required to run this server. The implementation uses zero-dependency Node.js ESM.

npm lockfile v2 or v3 is required for full inventory. Projects with:

• No package-lock.json → inventory tool will warn; audit/outdated tools still work
• Lockfile v1 (legacy) → inventory tool will warn; audit/outdated tools still work

npm must be installed on the system running the server (for dependency_audit and dependency_outdated tools).

Supported clients: any MCP client that supports stdio transport (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Cline, Zed, Gemini CLI, etc.).

---

Limitations

Protocol: This MVP uses legacy MCP stdio protocol revisions through 2025-11-25. The 2026-07-28 stateless protocol is not implemented. Official SDK migration and interoperability testing with real clients are planned.

Scope: npm projects only. pnpm, Yarn, and other ecosystems are not supported in this release.

Node/peer requirements: reported, not resolved. There is no full compatibility solver yet. The tools surface Node engine and peer dependency requirements as reported by package metadata, but do not validate compatibility or