Local MCP capabilities provider for Expo
Nothing to run from here
Depsonar is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
80/100
trust score
25
tools declared
local
runs on your machine
39
downloads
What it does
Dependency audits, live CVE scans, migration detection and stack health across 9 languages.
Quickstart
Install it the way its author documents:
1. Download depsonar.mcpb and open it in Claude Desktop or another client that installs MCP bundles (.mcpb)
2. Its sha256 is c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c
The full guide: https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb
Publishernot claimed
SOAll 6 servers
soflution6 servers
6 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Depsonar as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Install it the way its author documents:
1. Download depsonar.mcpb and open it in Claude Desktop or another client that installs MCP bundles (.mcpb)
2. Its sha256 is c58295214af62404d0e37aaa684eedf21fd555316087f4288ead6528c07bec7c
The full guide: https://github.com/Soflutionltd/depsonar/releases/download/v4.0.1/depsonar.mcpb
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
Show pending dependency alerts from the last background scan. This reads the cache file written by the background checker (no live scan, instant response). If no cache exists, suggests running depsonar_scan or setting up the background checker. Examples: - "Any dependency alerts?" - "Do any…
No parameter schema on file.
Check a project for outdated dependencies. Supports Node.js, Python, Rust, Go, PHP, Ruby, and Dart/Flutter. Groups results by ecosystem for Node projects. Flags major version updates. Examples: - "Check JobPin for outdated deps" - "What needs updating in my Django project?"
No parameter schema on file.
Update dependencies for a project. Works with any supported language. Three safety levels: - patch: Bugfixes only (safest) - minor: New features, no breaking changes (default) - latest: Includes major breaking changes Examples: - "Update all deps in JobPin" - "Update svelte in Showly to…
No parameter schema on file.
Scan all projects in your workspace. Auto-detects language (Node, Python, Rust, Go, PHP, Ruby, Dart) and framework. Can filter by framework or language. Examples: - "Scan all my projects" - "Which Python projects need updates?" - "Show all SvelteKit projects status"
No parameter schema on file.
Batch update across all projects. Defaults to dry_run=true (safe preview). Can filter by framework or language. Examples: - "Update all my projects" - "Update all SvelteKit projects, apply changes" - "Preview updates for all Python projects"
No parameter schema on file.
Score a project from 0-100. Checks outdated deps, security issues, lockfile. Examples: - "How healthy is JobPin?" - "Health report for my Rust project"
No parameter schema on file.
Fresh install. Use clean=true to nuke node_modules/vendor first. Examples: - "Install deps for JobPin" - "Clean install my project"
No parameter schema on file.
Install or remove the background dependency checker. On macOS, uses launchd (native, lightweight). On Linux, uses cron. The checker runs on schedule, scans all projects, writes results to ~/.depsonar-cache.json, then exits. Zero RAM between runs, zero AI tokens, zero cost. Results are shown by…
No parameter schema on file.
View or update configuration. Saved to ~/.depsonarrc.json. Examples: - "Show depsonar config" - "Set projects directory to ~/Code"
No parameter schema on file.
Scan projects for known security vulnerabilities (CVEs). Uses npm audit, cargo audit, pip-audit, composer audit, govulncheck. CRITICAL: Run this after any CVE announcement (e.g. Svelte CVE-2026-22775, devalue DoS). Examples: - "Audit all my projects for vulnerabilities" - "Security scan…
No parameter schema on file.
Check installed runtime versions (Node.js, Python, Rust, Go, PHP, Ruby, Dart, Swift). Detects EOL and outdated versions. Also checks project version files (.nvmrc, .python-version, rust-toolchain.toml, engines.node). Examples: - "Check my runtime versions" - "Is my Node.js up to date?" -…
No parameter schema on file.
Check versions of globally installed tools: npm, pnpm, yarn, bun, composer, cargo, pip, typescript, git, docker, homebrew, vercel-cli, supabase-cli, wrangler. Shows installed vs latest version and update commands. Examples: - "Check my global tools" - "Is pnpm up to date?" - "Show all CLI…
No parameter schema on file.
Scan Dockerfile and docker-compose files for outdated or EOL base images. Checks: node, python, ruby, php, golang, rust, nginx, postgres, redis, ubuntu, alpine. Examples: - "Check my Docker images" - "Any EOL images in my projects?"
No parameter schema on file.
Scan GitHub Actions workflow files for outdated or deprecated actions. Knows 30+ popular actions (actions/checkout, docker/build-push-action, cloudflare/wrangler-action, etc.). Examples: - "Check my GitHub Actions versions" - "Any deprecated actions in my workflows?"
No parameter schema on file.
Validate project environments: .env/.env.example sync, lockfile freshness, tsconfig best practices, Svelte config (detects deprecated svelte-preprocess with Svelte 5, duplicate adapters, etc.), multiple lockfiles. Examples: - "Check my project environments" - "Any env issues in JobPin?" -…
No parameter schema on file.
Complete infrastructure health check in one command. Combines: runtime versions, global toolchain, security audit, CVE advisories, Docker images, GitHub Actions, environment configs, secret scanning, license compliance, deprecated packages, and optionally dependency scan. This is the "run…
No parameter schema on file.
Check projects against known framework CVEs (Svelte, SvelteKit, devalue, Next.js, Vite, Express, Axios). Goes beyond npm audit by checking a curated database of framework-specific vulnerabilities. CRITICAL after any CVE announcement. Run immediately when new CVEs are published. Examples: -…
No parameter schema on file.
Detect deprecated, unmaintained, or replaced packages. Checks both npm deprecated flags and a curated list of known replacements (moment→dayjs, node-fetch→native fetch, request→undici, etc.). Examples: - "Any deprecated packages in my projects?" - "Check JobPin for deprecated deps" - "Find…
No parameter schema on file.
Scan project files for exposed secrets, API keys, tokens, and credentials. Detects: AWS keys, GitHub tokens, Stripe keys, Supabase JWT, OpenAI/Anthropic keys, private keys, database URLs, generic API key patterns. Also checks that .env files are properly gitignored. Examples: - "Scan my…
No parameter schema on file.
Check dependency licenses for commercial/SaaS compatibility. Flags: GPL/AGPL (copyleft, requires source disclosure), non-commercial (CC-BY-NC), unknown licenses. Important for SaaS products to avoid legal issues. Examples: - "Check license compliance for RoomPilot" - "Any GPL dependencies in…
No parameter schema on file.
Real-time vulnerability scan using the osv.dev API. Checks every installed package against the global OSV database (npm, PyPI, crates.io, Go, Packagist, RubyGems, Pub). Unlike depsonar_audit (which uses local tools like npm audit), this queries the live osv.dev database for the most up-to-date…
No parameter schema on file.
Check changelogs and breaking changes before updating. Shows major/minor/patch breakdown with changelog URLs and release notes for breaking updates. Run this BEFORE depsonar_update to understand what will change. Examples: - "Show changelog for RoomPilot before updating" - "What breaking…
No parameter schema on file.
Detect framework migration needs by scanning code for deprecated patterns. Currently supports: Svelte 4→5, Next.js 13→14→15. Finds exact file locations of code that needs to change, with migration instructions for each pattern. Examples: - "Check if my projects need Svelte 5 migration" -…
No parameter schema on file.
Fetch up-to-date documentation, changelogs, and migration guides for any npm package directly from source (GitHub + npm registry). Use this BEFORE writing code that depends on a library, to get the latest API docs and avoid hallucinating outdated APIs. Sections available: - readme: Latest…
No parameter schema on file.
Search the npm registry for packages by name or keyword. Returns matching packages with name, latest version, and description. Use this to find the right package name before calling depsonar_docs. Examples: - "Search for Svelte authentication libraries" - "Find Stripe payment packages" -…
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Depsonar or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
BTrust score 80 / 100
Release 4.0.1 · scanned 30 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score91
Client score80
Findings11 threat · 0 capability
Capabilitycritical
Coveragesource
Verificationrepo
Surface digest66e0c3f206eae1d605a4856c008a896faf08cfaa53b10d61d60fd6fe0ae5a7d8
Score vectorthreat 91 → client 80
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | critical | capability blast radius (critical) — client exposure if the model is manipulated | −10 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (25 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| depsonar_alerts | no tags | |
| depsonar_check | no tags | |
| depsonar_update | state-write | state-write: declares readOnlyHint: false |
| depsonar_scan | no tags | |
| depsonar_update_all | state-write | state-write: declares readOnlyHint: false |
| depsonar_health | no tags | |
| depsonar_install | state-write | state-write: declares readOnlyHint: false |
| depsonar_setup_checker | state-write | state-write: declares readOnlyHint: false |
| depsonar_config | state-write | state-write: declares readOnlyHint: false |
| depsonar_audit | no tags | |
| depsonar_runtimes | no tags | |
| depsonar_toolchain | no tags | |
| depsonar_docker | no tags | |
| depsonar_actions | no tags | |
| depsonar_envcheck | no tags | |
| depsonar_infra | no tags | |
| depsonar_cve | no tags | |
| depsonar_deprecated | no tags | |
| depsonar_secrets | no tags | |
| depsonar_licenses | no tags | |
| depsonar_live_cve | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| depsonar_changelog | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| depsonar_migrate | no tags | |
| depsonar_docs | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| depsonar_search_package | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digest66e0c3f206eae1d6
Scanned2026-10-30
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
It installs from its repository rather than from a versioned package, so the command cannot be pinned to a release. The history below is for reading; the current release on file is 4.0.1.
4.0.1
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Depsonar can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.