Dependency Fitness Mcp

tweedbeetle/dependency-fitness-mcp

Wraps the npm registry, deps.dev, OSV.dev, and GitHub into two MCP tools that answer whether an npm package is deprecated, yanked, or superseded. The check_package_fitness tool returns a structured verdict with a verified migration target when one exists, parsing deprecation notices and confirming the successor isn't itself deprecated before recommending it. The audit_dependencies tool batch checks up to 50 packages from a package.json for CI gates. Cross validates signals across all four sources and flags confidence downgrades when they disagree. Refuses to guess at migration targets, which keeps agents from writing dependencies to hallucinated or wrong packages. Runs via npx with optional GitHub token for rate limits.

tools: 2
transport: STDIO
last updated: Jun 8, 2026

View on GitHub

Tools

2 tools

Public tool metadata for what this MCP can expose to an agent.

check_package_fitnessSingle-package verdict. Input: `package` (e.g. `request`, `@babel/core`), optional `version` (exact, semver range, or dist-tag — omit for `latest`). Output: the full `Verdict` (structured) plus a human-readable summary.

Single-package verdict. Input: `package` (e.g. `request`, `@babel/core`), optional `version` (exact, semver range, or dist-tag — omit for `latest`). Output: the full `Verdict` (structured) plus a human-readable summary.

No parameter schema in public metadata yet.

audit_dependenciesBatch verdict for a CI / pre-merge gate. Input: `packages` (e.g. `["react@18.2.0", "request"]`) and/or the raw contents of a `package.json`. Output: a per-package verdict array plus a summary (how many deprecated / malicious / vulnerable / behind). Capped at 50 packages per call.

Batch verdict for a CI / pre-merge gate. Input: `packages` (e.g. `["react@18.2.0", "request"]`) and/or the raw contents of a `package.json`. Output: a per-package verdict array plus a summary (how many deprecated / malicious / vulnerable / behind). Capped at 50 packages per call.

No parameter schema in public metadata yet.

Readme

dependency-fitness-mcp — npm dependency fitness verdicts for coding agents

Is this npm package safe to depend on — and if not, what do I move to?

An MCP server that gives a coding agent a cross-validated fitness verdict for an npm package before it writes or upgrades a dependency:

{
  "deprecated": true,
  "yanked": false,
  "malicious": false,
  "superseded_by": { "latest": "14.0.0", "majors_behind": 13, "breaking_boundary": true },
  "safe_migration_target": {
    "package": "uuid",
    "version": "14.0.0",
    "rationale": "Maintainer's deprecation notice recommends 'uuid' (verified present and not deprecated).",
    "confidence": "high"
  },
  "confidence": "high",
  "last_verified": "2026-06-05T18:10:31Z"
}

It reconciles four free, sanctioned sources — the npm registry, Google's deps.dev, OSV.dev, and GitHub — into one confidence-scored answer, and infers a safe migration target when a package is deprecated or superseded.

Why this exists (and what it deliberately isn't)

View the full README on GitHub

Details

Repository: github.com/tweedbeetle/dependency-fitness-mcp
Package: dependency-fitness-mcp
Transport: STDIO
Registry: MCP registry, active