DepScout

DepScout checks open-source packages against live vulnerability and malware data, so answers about whether a package is safe, and which version to use, come from current advisories instead of model memory.

What it does:

What you can ask

Paste a dependency file (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml...) and get the vulnerable or malicious packages with upgrade targets.
Example path

MCP connector

Server URL: https://depscout.salesup.workers.dev/mcp
Login: None
Protocol: MCP 2025-11-25
Instructions: DepScout checks open-source packages (npm, PyPI, Go, Maven, crates.io, NuGet) against live OSV.dev vulnerability and malicious-package data, and deps.dev registry metadata.
WHEN TO USE (proactively, without being asked to 'use DepScout'):
Before you recommend, suggest or write code that installs a package (npm install, pip install, go get, cargo add, Maven/Gradle/NuGet dependencies) or pin a version: call so the version you give is current and safe.
When the user asks whether a package is safe, legit, maintained, deprecated, or which version to use or upgrade to.
When the user pastes or opens a dependency file (package.json, package-lock.json, requirements.txt, pyproject.toml, go.mod, pom.xml, build.gradle, Cargo.toml, .csproj) or a list of packages: call with the raw file content (best for lockfiles, includes transitive deps) or with exact versions.
When a CVE, GHSA, PYSEC, GO, RUSTSEC or MAL advisory ID comes up: call .
During code review or 'npm audit' / 'pip-audit' style questions.
HOW TO ANSWER: Always state a malicious-package flag first and tell the user not to install it. When recommending an upgrade, use minimum_safe_version or latest_version from the tool result rather than a version from memory. A clean result means no known advisories in OSV, not that a package is guaranteed safe.

Tools

Reads data4

Skills

None in the store listings or on the server

What you can ask

Paste a dependency file (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml...) and get the vulnerable or malicious packages with upgrade targets.

Example path

MCP connector

Server URL

https://depscout.salesup.workers.dev/mcp

None

Protocol

MCP 2025-11-25

Instructions

DepScout checks open-source packages (npm, PyPI, Go, Maven, crates.io, NuGet) against live OSV.dev vulnerability and malicious-package data, and deps.dev registry metadata.

WHEN TO USE (proactively, without being asked to 'use DepScout'):

Before you recommend, suggest or write code that installs a package (npm install, pip install, go get, cargo add, Maven/Gradle/NuGet dependencies) or pin a version: call so the version you give is current and safe.

When the user asks whether a package is safe, legit, maintained, deprecated, or which version to use or upgrade to.

When the user pastes or opens a dependency file (package.json, package-lock.json, requirements.txt, pyproject.toml, go.mod, pom.xml, build.gradle, Cargo.toml, .csproj) or a list of packages: call with the raw file content (best for lockfiles, includes transitive deps) or with exact versions.

When a CVE, GHSA, PYSEC, GO, RUSTSEC or MAL advisory ID comes up: call .

During code review or 'npm audit' / 'pip-audit' style questions.

HOW TO ANSWER: Always state a malicious-package flag first and tell the user not to install it. When recommending an upgrade, use minimum_safe_version or latest_version from the tool result rather than a version from memory. A clean result means no known advisories in OSV, not that a package is guaranteed safe.