Dep Diff Mcp

digicatalyst-systems/dep-diff-mcp

Point this at a Dependabot PR or npm outdated output and get a ranked upgrade plan with breaking changes, CVE fixes, and migration links. The server exposes two tools: analyze_package_change for single packages and analyze_packages_bulk for up to 50 at once. It scrapes GitHub release notes, checks OSV.dev for security fixes, and returns a risk level (security, caution, review, likely-safe, safe) with semver classification. Handles npm and PyPI. Runs via npx with optional GitHub token for higher rate limits. Integrates with Claude Code, Cursor, and Claude Desktop. Good for turning lockfile diffs into actionable decisions without manually reading changelogs.

GitHub stars: 2
tools: 2
transport: STDIO, HTTP
last updated: Oct 30, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://dep-diff.digicatalyst.ca/mcp --name dep-diff-mcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http dep-diff-mcp https://dep-diff.digicatalyst.ca/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 2 tools

Verified live against the running server on Nov 6, 2026.

analyze_package_changeGiven one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user...4 params

Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user...

Parameters* required

ecosystem*string

Package ecosystemone of npm · pypi · github-actions

fromVersion*string

Current version (e.g. '18.2.0')

name*string

Package name (e.g. 'react', 'requests')

toVersion*string

Target version (e.g. '19.0.0')

analyze_packages_bulkAnalyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lock...1 params

Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lock...

Parameters* required

changes*array

List of package changes to analyze

Readme

dep-diff-mcp

MCP server that translates a lockfile diff into a human-readable upgrade plan.

Point your AI assistant (Cursor, Claude Desktop, Claude Code) at a Dependabot PR, npm outdated output, or any pair of package versions, and get back a ranked upgrade plan: semver class, breaking changes pulled from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear recommendation per package.

What it looks like

Ask your assistant, in plain language:

Is it safe to bump lodash from 4.17.20 to 4.17.21?

It calls analyze_package_change and gets back:

View the full README on GitHub

Details

Repository: github.com/digicatalyst-systems/dep-diff-mcp
Category: Developer Tools
Package: @digicatalyst/dep-diff-mcp
Transport: STDIO, HTTP
Registry: MCP registry, active
Prompts: 2
Tools verified: Nov 6, 2026

Related Developer Tools MCP servers

View all

Zread Mcpejfkdev/zread-mcpZread.ai MCP Server - 连接 zread.ai 文档平台的 MCP 服务器，让 AI 助手能够阅读 GitHub 仓库文档、搜索代码、与仓库 AI 对话。2stars

Batch Reviewhevangel/batch-review-mcpGit diff and markdown review with a web UI plus MCP stdio for AI agents.2stars

Content Distributionautomatelab-tech/content-distribution-mcpPublish content to DEV.to, Hashnode, GitHub Discussions, Reddit, Bluesky, LinkedIn, and Medium.2stars

Virtual Filesystemlu-zhengda/mcp-virtual-fsPostgreSQL-backed virtual filesystem for agents: session isolation, shared stores, POSIX ops, RLS.2stars

ScrapeBadgerscrape-badger/scrapebadger-mcpTwitter/X, Google, Facebook Marketplace, Yelp, GitHub and AutoScout24 for AI agents.2stars

Physboundjonesrobm/physboundPhysical Layer Linter: validates RF and radar calculations against hard physical limits.2stars