MCP server

DepScout

io.github.yc-droid/depscout

Checked 25 Oct 2026, 20:29 UTC · Connected to it and listed its tools

Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.

Website

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

4

Token cost

About 1,492 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

25 Oct 2026, 20:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http depscout https://depscout.salesup.workers.dev/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.depscout]
url = "https://depscout.salesup.workers.dev/mcp"

Gemini CLI

{"mcpServers":{"depscout":{"httpUrl":"https://depscout.salesup.workers.dev/mcp"}}}

Cursor

{"mcpServers":{"depscout":{"url":"https://depscout.salesup.workers.dev/mcp"}}}

VS Code

{"servers":{"depscout":{"type":"http","url":"https://depscout.salesup.workers.dev/mcp"}}}

Antigravity

agy mcp add depscout https://depscout.salesup.workers.dev/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"depscout","server_url":"https://depscout.salesup.workers.dev/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"depscout","server_url":"https://depscout.salesup.workers.dev/mcp"}

Tools

• check_dependencies ~455 tokens
  Check up to 50 packages at exact versions (for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj) against OSV.dev in one batch. Returns a summary count and only the packages with problems: malicious-package flags first, then vulnerabilities by s
• check_lockfile ~353 tokens
  Audit a whole lockfile or dependency file in one call, including transitive dependencies where the file records them. Paste the file content as-is: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, requirements.txt (== pins), poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, g
• check_package ~450 tokens
  Check one open-source package (npm, PyPI, Go, Maven, crates.io or NuGet) for safety and freshness. Returns a malicious-package flag (from OSV MAL- and malware advisories), known vulnerabilities with severity and the version that fixes each, the minimum version that clears all of them, the latest sta
• get_vulnerability ~234 tokens
  Look up one vulnerability or malicious-package advisory by ID (CVE, GHSA, PYSEC, GO, RUSTSEC, MAL and other OSV IDs) and return its summary, severity, CVSS vector, aliases, publish date, the affected packages with their affected and fixed version ranges, and key references. Use when the user mention

Browse

• GitHub tools
• Droid tools
• GitHub and code hosting
• Security scanning

Related MCP servers

• Security Intel MCP
  CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
• Devstack
  Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
• CVE Risk Check
  Triage a CVE: how severe it is, whether it is exploited, and how likely exploitation is.
• ZEN SecDB
  ZEN SecDB MCP server for CVE intelligence, CVSS/EPSS scoring, advisories, SSVC, and package audits.
• ScorpTech x402 API
  112 x402 pay-per-call tools: web data, security/OSINT, SEC and public data, Solana/EVM lookups
• Sectora
  Threat intel + your scans/findings/Shield posture. CVE, EPSS, KEV, package vuln lookup, DAST.
• PkgGuard
  Dependency scan for agents: known CVEs and malicious packages via OSV.dev. By Crypto Money Maker
• Agent Harbor pay-per-call tools
  Pay-per-call company, SEC, recall, package and domain lookups, PDF to markdown, site audits (x402)

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.yc-droid/depscout.svg)](https://aptlynx.net/servers/io.github.yc-droid/depscout)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents