Skip to content
Agentmart
Submit a tool

DepScout

Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.

Connector by yc-droid · GitHub account verified by the MCP Registry

IndexedLicense unknownRemote (HTTP)
Write a review

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/yc-droid-depscout

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://depscout.salesup.workers.dev/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
4 read · 0 write · 0 deleteRead-only
Secrets
None asked for
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 4

From the running server's own tool list (tools/list) on Oct 25, 2026.

Read 4 · Look things up without changing anything.

  • check_dependencies
  • check_lockfile
  • check_package
  • get_vulnerability

Network hosts it talks to 1

  • depscout.salesup.workers.dev · found in remote endpoint, install command

Files it touches

  • Any path the agent passes to its tools

Tools (4)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • check_dependenciesCheck a dependency listread-only

    Check up to 50 packages at exact versions (for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj) against OSV.dev in one batch. Returns a summary count and only the packages with problems: malicious-package flags first, then vulnerabilities by severity with the version that fixes each and the minimum upgrade target. Use when the user pastes a dependency file or list, or asks to "audit my dependencies" or "check my package.json / requirements.txt", or which dependencies are vulnerable or outdated. Entries without an exact version are skippe…

  • check_lockfileAudit a lockfileread-only

    Audit a whole lockfile or dependency file in one call, including transitive dependencies where the file records them. Paste the file content as-is: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, requirements.txt (== pins), poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, go.mod, packages.lock.json (NuGet) or gradle.lockfile. Up to 3,000 packages are checked against OSV.dev. Returns a summary and only the packages with problems: malicious-package flags first, then vulnerabilities by severity with the minimum upgrade target. Use when the user pastes or attaches a lockf…

  • check_packageCheck a packageread-only

    Check one open-source package (npm, PyPI, Go, Maven, crates.io or NuGet) for safety and freshness. Returns a malicious-package flag (from OSV MAL- and malware advisories), known vulnerabilities with severity and the version that fixes each, the minimum version that clears all of them, the latest stable version, whether the given version is outdated or deprecated, licences, last release date, and the linked repository's OpenSSF Scorecard. If no version is given, the latest version is checked. Use when the user asks "is <package> safe?", "is it malware?", "which version should I use?", "should I…

  • get_vulnerabilityGet vulnerability detailsread-only

    Look up one vulnerability or malicious-package advisory by ID (CVE, GHSA, PYSEC, GO, RUSTSEC, MAL and other OSV IDs) and return its summary, severity, CVSS vector, aliases, publish date, the affected packages with their affected and fixed version ranges, and key references. Use when the user mentions a specific advisory or CVE ID ("what is CVE-2021-44228?", "am I affected by this GHSA?") and wants to know what it is, what is affected or which version fixes it. Only covers advisories in OSV.dev.

Signals

Last release
Oct 7, 2026 (22 days ago)

Details

Registry name
io.github.yc-droid/depscout
Version
1.0.0
Auth
Auth not stated
License
License unknown
Website
depscout.salesup.workers.dev/
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registry

More from yc-droid

Cite this page

DepScout MCP server. Agent Mart. https://agentmart.dev/connectors/yc-droid-depscout (last updated 2026-10-24)