Skip to content
Agentmart
Submit a tool

Best MCP servers for dependency management

We found 127 MCP servers for dependency management in the catalog; these are the 15 that rank highest. The order comes from our rank, which weighs adoption, freshness, documentation and publisher identity. Nobody can pay for a place on this list. stalemap, flowR and SkillTotal lead it. SkillTotal is published by the company that makes it. flowR has the most GitHub stars here (105). 15 of the 15 had activity in the last 30 days. Remote servers need no local install; local ones run on your machine and can reach local files. Each entry lists why it made the list and links to its install page.

Updated Oct 26, 2026 · Built from catalog data; how we rank and grade

Top 15 of 127

  1. 1
    stalemap

    Umair

    Tells coding agents which npm dependencies changed after their training cutoff, and what changed.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 100Last active Oct 21, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  2. 2
    flowR

    flowr-analysis

    Static dataflow analysis, program slicing, linting, and dependency extraction for R code.

    • Most GitHub stars here (105)
    • Active in the last 30 days
    • Open source (GPL-3.0)

    ★ 105↓ 331/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  3. 3
    SkillTotal

    skilltotal.aiOfficial

    Deterministic security scan of MCP servers, agent skills and npm/PyPI packages.

    • Published by the vendor
    • Most weekly downloads here (1.7K)
    • Active in the last 30 days

    ★ 15↓ 1.7K/wkLast active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  4. 4
    PkgGuard

    youraitools.co

    Dependency scan for agents: known CVEs and malicious packages via OSV.dev.

    • Runs locally or as a remote server
    • Active in the last 30 days
    • Open source (MIT)

    ↓ 419/wkLast active Oct 22, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2

  5. 5
    agent-bom

    koda-ai-studio

    Scan AI/MCP dependencies, descriptor injection, risky tool inputs and authentication configuration.

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 35↓ 737/wkLast active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  6. 6
    agent-bom

    msaad00

    Scan AI/MCP dependencies, descriptor injection, risky tool inputs and authentication configuration.

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 35↓ 737/wkLast active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  7. 7
    mcpm

    getmcpm

    MCP security guard + package manager: trust-scored installs, blocks prompt injection and rug-pulls.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 3↓ 448/wkLast active Oct 23, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  8. 8
    Commit — Supply Chain Risk Scoring

    piiiico

    Supply chain risk scoring for npm, PyPI, Cargo, and Go.

    • Runs locally or as a remote server
    • Active in the last 30 days
    • Open source (MIT)

    ★ 8Last active Oct 6, 2026Local (stdio), Remote (HTTP)Claude Code, VS Code, Codex, Cursor +2

  9. 9
    lurq

    jadenryu

    Verify npm packages before your AI agent installs them: hallucinations, advisories, API drift.

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 8Last active Oct 23, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  10. 10
    Supply Chain Guard

    homeofe

    Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.

    • Active in the last 30 days
    • Open source (Apache-2.0)

    ★ 7Last active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  11. 11
    Dependency Auditor

    GuardBee

    CVE scanning for npm/pip/cargo dependencies via OSV

    • Active in the last 30 days
    • Open source (MIT)

    ★ 1↓ 647/wkLast active Oct 22, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  12. 12
    Pkgtruth

    hxckya

    Catches hallucinated and slopsquatted npm and PyPI packages before an agent installs them.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 4Last active Oct 19, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  13. 13
    NPMScan

    salemalem

    Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

    • Remote server, no local install
    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 24, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf

  14. 14
    AIShield Security Scanner

    lm203688

    Scans MCP servers for tool poisoning, prompt injection and supply chain risks.

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 24, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

  15. 15
    npm Registry MCP Server

    YawLabs

    npm registry MCP server — package intelligence, security audits, dependency analysis

    • Active in the last 30 days
    • Open source (MIT)

    ★ 2Last active Oct 15, 2026Local (stdio)Claude Code, Codex, VS Code, Cursor +2

Related