DepScope is a Package Intelligence tool for AI agents, with the goal of preventing AI coding agents from installing "hallucinated packages," deprecated packages, or malicious packages. According to the official description, large language models often invent package names that look real but do not exist (for example fastapi-turbo, lodahs, tokio-stream-extras), and when an agent tries to install such packages, it may hit typosquatted packages set up by attackers. DepScope verifies every package before installation.
Purpose
- Provide package verification and intelligence query capabilities for AI coding agents, reducing the risk of installing hallucinated packages, deprecated packages, and malicious packages.
- Provide information such as package health, vulnerabilities, typosquats, malicious packages, alternatives, and breaking changes.
Main capabilities
- Covers 19 package ecosystems: npm, pypi, cargo, go, composer, maven, nuget, rubygems, pub, hex, swift, cocoapods, cpan, hackage, cran, conda, homebrew, jsr, julia.
- Provides 22 MCP tools.
- Data sources and intelligence types include: vulnerabilities (OSV, CISA KEV, EPSS), typosquats, malicious packages, alternatives, and breaking changes.
- The official description states the data scale is 8.4 million+ packages and 42,000+ vulnerabilities (99% enhanced by EPSS).
- Free, zero auth, and the official description states it provides generous rate limits.
How to use
- MCP remote method: suitable for Claude Desktop, Cursor, and Windsurf, and can connect to remote MCP.
- MCP stdio method: suitable for Claude Code / local.
- The MCP server source code is located at cuttalo/depscope-mcp (AGPL-3.0), and the npm package name is depscope-mcp.
- A regular HTTPS interface can also be used without an MCP client; the full reference is at depscope.dev/integrate.
- Official website:https://depscope.dev
Use cases
- AI coding agents (Claude, ChatGPT, Cursor, Windsurf, Copilot, Cline, etc.) performing package verification before installing or recommending dependencies.
- Developer or agent workflows that need to query package health, vulnerabilities, and security intelligence across multiple package ecosystems.
Limitations and notes
- This repository is only a landing page and documentation, and does not contain the full implementation.
- The MCP server (client SDK) is open source, AGPL-3.0; the backend (API + intelligence layer) is proprietary and hosted at depscope.dev.
- For higher quotas, SLA, or local deployment, contact depscope@cuttalo.com.
- The official description states it is free and requires zero auth, but no specific pricing plans or paid details are provided.
- Other feature details such as specific tool names, usage examples, and data coverage for each ecosystem are not provided in the materials.
- Built by Cuttalo srl (Italy).
