depsonar (Soflutionltd/depsonar) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 25 tools. No publisher has claimed this listing.

Caution

74/100

depsonar

Item: depsonar
Rating: 74
Author: M8ven

Comprehensive dependency audit MCP server supporting 9 languages and 23 tools for scanning, updating, security auditing, and migration detection.

→ Soflutionltd/depsonar · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

Soflutionltd

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

25 tools verified — handlers match their declared behaviour

20 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// tools this server exposes25 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

depsonar_alerts

Show pending dependency alerts from the last background scan. This reads the cache file written by the background checker (no live scan, instant response). If no cache exists, suggests running depsonar_scan or setting up the background checker. Examples: - "Any dependency alerts?" - "Do any of…

depsonar_check

Check a project for outdated dependencies. Supports Node.js, Python, Rust, Go, PHP, Ruby, and Dart/Flutter. Groups results by ecosystem for Node projects. Flags major version updates. Examples: - "Check JobPin for outdated deps" - "What needs updating in my Django project?"

depsonar_update

Update dependencies for a project. Works with any supported language. Three safety levels: - patch: Bugfixes only (safest) - minor: New features, no breaking changes (default) - latest: Includes major breaking changes Examples: - "Update all deps in JobPin" - "Update svelte in Showly to latest…

depsonar_scan

Scan all projects in your workspace. Auto-detects language (Node, Python, Rust, Go, PHP, Ruby, Dart) and framework. Can filter by framework or language. Examples: - "Scan all my projects" - "Which Python projects need updates?" - "Show all SvelteKit projects status"

depsonar_update_all

Batch update across all projects. Defaults to dry_run=true (safe preview). Can filter by framework or language. Examples: - "Update all my projects" - "Update all SvelteKit projects, apply changes" - "Preview updates for all Python projects"

depsonar_health

Score a project from 0-100. Checks outdated deps, security issues, lockfile. Examples: - "How healthy is JobPin?" - "Health report for my Rust project"

depsonar_install

Fresh install. Use clean=true to nuke node_modules/vendor first. Examples: - "Install deps for JobPin" - "Clean install my project"

depsonar_setup_checker

Install or remove the background dependency checker. On macOS, uses launchd (native, lightweight). On Linux, uses cron. The checker runs on schedule, scans all projects, writes results to ~/.depsonar-cache.json, then exits. Zero RAM between runs, zero AI tokens, zero cost. Results are shown by dep…

depsonar_config

View or update configuration. Saved to ~/.depsonarrc.json. Examples: - "Show depsonar config" - "Set projects directory to ~/Code"

depsonar_audit

Scan projects for known security vulnerabilities (CVEs). Uses npm audit, cargo audit, pip-audit, composer audit, govulncheck. CRITICAL: Run this after any CVE announcement (e.g. Svelte CVE-2026-22775, devalue DoS). Examples: - "Audit all my projects for vulnerabilities" - "Security scan JobPin…

depsonar_runtimes

Check installed runtime versions (Node.js, Python, Rust, Go, PHP, Ruby, Dart, Swift). Detects EOL and outdated versions. Also checks project version files (.nvmrc, .python-version, rust-toolchain.toml, engines.node). Examples: - "Check my runtime versions" - "Is my Node.js up to date?" - "Any…

depsonar_toolchain

Check versions of globally installed tools: npm, pnpm, yarn, bun, composer, cargo, pip, typescript, git, docker, homebrew, vercel-cli, supabase-cli, wrangler. Shows installed vs latest version and update commands. Examples: - "Check my global tools" - "Is pnpm up to date?" - "Show all CLI to…

depsonar_docker

Scan Dockerfile and docker-compose files for outdated or EOL base images. Checks: node, python, ruby, php, golang, rust, nginx, postgres, redis, ubuntu, alpine. Examples: - "Check my Docker images" - "Any EOL images in my projects?"

depsonar_actions

Scan GitHub Actions workflow files for outdated or deprecated actions. Knows 30+ popular actions (actions/checkout, docker/build-push-action, cloudflare/wrangler-action, etc.). Examples: - "Check my GitHub Actions versions" - "Any deprecated actions in my workflows?"

depsonar_envcheck

Validate project environments: .env/.env.example sync, lockfile freshness, tsconfig best practices, Svelte config (detects deprecated svelte-preprocess with Svelte 5, duplicate adapters, etc.), multiple lockfiles. Examples: - "Check my project environments" - "Any env issues in JobPin?" - "Va…

depsonar_infra

Complete infrastructure health check in one command. Combines: runtime versions, global toolchain, security audit, CVE advisories, Docker images, GitHub Actions, environment configs, secret scanning, license compliance, deprecated packages, and optionally dependency scan. This is the "run everythin…

depsonar_cve

Check projects against known framework CVEs (Svelte, SvelteKit, devalue, Next.js, Vite, Express, Axios). Goes beyond npm audit by checking a curated database of framework-specific vulnerabilities. CRITICAL after any CVE announcement. Run immediately when new CVEs are published. Examples: - "Chec…

depsonar_deprecated

Detect deprecated, unmaintained, or replaced packages. Checks both npm deprecated flags and a curated list of known replacements (moment→dayjs, node-fetch→native fetch, request→undici, etc.). Examples: - "Any deprecated packages in my projects?" - "Check JobPin for deprecated deps" - "Find pa…

depsonar_secrets

Scan project files for exposed secrets, API keys, tokens, and credentials. Detects: AWS keys, GitHub tokens, Stripe keys, Supabase JWT, OpenAI/Anthropic keys, private keys, database URLs, generic API key patterns. Also checks that .env files are properly gitignored. Examples: - "Scan my projects…

depsonar_licenses

Check dependency licenses for commercial/SaaS compatibility. Flags: GPL/AGPL (copyleft, requires source disclosure), non-commercial (CC-BY-NC), unknown licenses. Important for SaaS products to avoid legal issues. Examples: - "Check license compliance for RoomPilot" - "Any GPL dependencies in m…

depsonar_live_cve

Real-time vulnerability scan using the osv.dev API. Checks every installed package against the global OSV database (npm, PyPI, crates.io, Go, Packagist, RubyGems, Pub). Unlike depsonar_audit (which uses local tools like npm audit), this queries the live osv.dev database for the most up-to-date vuln…

depsonar_changelog

Check changelogs and breaking changes before updating. Shows major/minor/patch breakdown with changelog URLs and release notes for breaking updates. Run this BEFORE depsonar_update to understand what will change. Examples: - "Show changelog for RoomPilot before updating" - "What breaking chang…

depsonar_migrate

Detect framework migration needs by scanning code for deprecated patterns. Currently supports: Svelte 4→5, Next.js 13→14→15. Finds exact file locations of code that needs to change, with migration instructions for each pattern. Examples: - "Check if my projects need Svelte 5 migration" - "Migr…

depsonar_docs

Fetch up-to-date documentation, changelogs, and migration guides for any npm package directly from source (GitHub + npm registry). Use this BEFORE writing code that depends on a library, to get the latest API docs and avoid hallucinating outdated APIs. Sections available: - **readme**: Latest READ…

depsonar_search_package

Search the npm registry for packages by name or keyword. Returns matching packages with name, latest version, and description. Use this to find the right package name before calling depsonar_docs. Examples: - "Search for Svelte authentication libraries" - "Find Stripe payment packages" - "Wh…

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configDEPUP_PROJECTS_DIR

// quality suggestions

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — depsonar_setup_checker deletes at line 1216 (unlinkSync(plistPath))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

8 calls in production code run through a shell (src/services/toolchain.ts:16, src/services/audit.ts:31, src/services/audit.ts:47)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/soflutionltd/depsonar?variant=verified)](https://m8ven.ai/mcp/soflutionltd/depsonar)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: e4d59f7ca810554ab3f2b1621dd8783a1b7903d0

code hash: b3fda14a46ddee3fde56d5a6138ceb73d85362c06aecfb858f4a929be94fe2f7

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client