Solves the problem of AI agents recommending outdated or vulnerable npm and PyPI packages by exposing a single tool, check_dependency_freshness, that hits a live verdict API. You pass it an ecosystem and package name, and it returns maintenance status (active, slowing, stale, abandoned), latest version, release recency, deprecation flags, CVE counts from OSV, and hand-curated alternatives for dead packages. Closes the 6 to 18 month gap between when a package dies and when the model's training cutoff reflects it. Install via npx or point at the repo. Speaks JSON-RPC over stdio and supports custom API backends via environment variables.
MCP server exposing live npm / PyPI dependency-health verdicts so AI coding agents can check a package before recommending it — closing the 6–18 month staleness gap in model training data.
check_dependency_freshness| Input | Type |
|---|---|
ecosystem | "npm" | "pypi" |
package | string |
Returns a concise human-readable summary and structured content:
maintenance signal (active/slowing/stale/abandoned/unknown),
latest version, last release/commit age, deprecation/yank/archived flags,
known CVE count (OSV), and a hand-verified alternative if the package is
dead.
It calls ${FRESHDEPS_API_BASE}/api/verdict (default
https://freshdeps.vercel.app).
Once published:
{
"mcpServers": {
"freshdeps": { "command": "npx", "args": ["-y", "freshdeps-mcp"] }
}
}
From this repo (before publish):
{
"mcpServers": {
"freshdeps": {
"command": "node",
"args": ["/absolute/path/to/code/mcp/server.js"]
}
}
}
npm install
FRESHDEPS_API_BASE=http://localhost:3100 node server.js
The server speaks JSON-RPC over stdio (StdioServerTransport).
| Var | Purpose |
|---|---|
FRESHDEPS_API_BASE | backend base URL (default prod) |
GOATCOUNTER_CODE | optional fire-and-forget usage analytics |
com.exploit-intel/eip-mcp
dmontgomery40/pentest-mcp
pantheon-security/notebooklm-mcp-secure
cyanheads/pentest-mcp-server
io.github.akhilucky/ai-firewall-mcp