depguard

depguard is an MCP (Model Context Protocol) security server designed specifically for AI coding agents, with the core goal of solving the lack of supply chain integrity auditing in the npm ecosystem. Its author comes from the industrial software field and brings the auditing mindset of "events can be recorded and recovered" to JavaScript dependency management: verify before installation, audit existing dependencies, and generate SBOMs usable by security teams.

[Purpose] depguard mainly serves scenarios that require security checks before installing npm packages, especially when AI coding agents are about to install dependencies, audit projects, or review code. It exposes 14 tools through the MCP protocol, allowing AI agents to automatically call them at these key points.

[Main Capabilities]

• Pre-installation guard: performs a three-step sequential check before npm install—whether the package exists on npm, whether the name is typosquatting (calculating Levenshtein distance against 100+ popular packages), and a full security audit.
• Static code analysis (tarball scanning): downloads the package tarball, extracts JS files, and scans for 18+ malicious patterns across 6 major categories; performs behavior matching, comparing the package's declared purpose with its actual runtime behavior.
• Install script analysis: performs static pattern matching on preinstall/install/postinstall scripts without executing any scripts.
• Vulnerability audit: integrates and deduplicates the npm Registry and GitHub Advisory DB advisory databases, filters by installed version range, and annotates the source.
• Remediation suggestions: each vulnerability result includes currentVersion, fixVersion, and action (upgrade or no-fix-available); depguard_remediate aggregates by severity weight and groups transitive dependencies by the direct dependency that introduces them.
• Dead dependency detection: scans import/require/export from in .js/.ts/.mjs/.cjs/.jsx/.tsx, identifies config-type dependencies, binaries in npm scripts, @types/* paired with their runtime peer, marks untracked devDependencies as "possibly unused," and reports estimated disk savings.
• Native alternative suggestions: before recommending a package,first checks Node.js native APIs, such as fetch (18+), crypto.randomUUID() (19+), structuredClone() (17+), and 20+ others, with example code and minimum Node versions.
• License compatibility: judged by the hierarchy Public Domain → Permissive → Weak Copyleft → Strong Copyleft → Network; a dependency's license must be equivalent or more permissive to be compatible.
• SBOM generation: natively generates CycloneDX 1.6, which can be consumed directly by Dependency-Track, Trivy, Grype, and OWASP DT; PURLs follow the Package URL specification, and SHA-512 integrity hashes are extracted from package-lock.json and converted from base64 to hex according to the CycloneDX schema; --include-vex can inline CVSS ratings and fixed versions.
• SARIF output: audit, audit-project, and audit-workspace support --format sarif, outputting SARIF v2.1.0, including stable GHSA rule IDs, propagated CVSS severities, and stable partialFingerprints.
• Scoring and decision-making: each package is scored 0-100 across five dimensions; shouldUse >=60 recommends installation, 40-59 means caution, and <40 recommends writing from scratch; static analysis caps the security score and is not affected by popularity.
• AI hallucination protection: provided as one of the tool capabilities.
• tokenSavings field: every MCP response includes this field, quantifying the LLM tokens saved compared with manual research, with no configuration required.

[Usage] As an MCP server, it exposes 14 tools over stdio. It can be added to any MCP-compatible client (Claude Code, Claude Desktop, Cursor, Windsurf, Continue.dev, Cline, Roo Code, etc.). The documentation provides a one-line installation command for Claude Code and a generic MCP configuration example. Optionally set GITHUB_TOKEN (withoutNo scope required, used only for identification) Raise the GitHub Advisory API rate limit from 60/h to 5,000/h; automatically picked up if provided by the gh CLI or GitHub Actions.

[Use cases]

• Automatic security checks by AI coding agents before installing dependencies.
• Dependency security audits of a project or workspace.
• Meeting compliance requirements for the EU Cyber Resilience Act (CRA), U.S. Executive Order 14028/OMB M-22-18, SOC 2, FedRAMP, and vendor procurement.
• Defending against fake interview/take-home test malware.
• Integrating with GitHub Code Scanning via SARIF output.

[Limitations and design]

• All processing is done locally, with no telemetry and no usage reporting; audit results are cached in memory (5-minute TTL) and on disk at ~/.depguard/cache/ (24-hour TTL), and cleaned up at startup.
• Zero runtime dependencies, no exceptions thrown on network errors, and degraded results with warnings are returned.
• TypeScript strict, 100% offline testing.
• False-positive avoidance is a hard constraint for every detection rule.
• License is Apache-2.0.
• Specific installation commands, the complete tool list, and detailed configuration examples require consulting the project repository documentation; the official text does not provide a one-by-one description of all 14 tools or some configuration details.