Open Source Dependency Check MCP Server

📦 Open Source Dependency Check MCP Server

Open Source Dependency Check MCP Server is an MCP server that lets Claude, ChatGPT, Cursor, VS Code and other AI agents check open source packages before a team adopts them. Its 19 read-only tools cover npm, PyPI and crates.io packages (profiles, versions, downloads, dependency trees, licences, advisories, look-alike names and OpenSSF Scorecards) and the support lifecycle of languages, frameworks, databases and operating systems from endoflife.date.

Ask Claude "is lodash 4.17.15 safe to use?" and it calls oss_check_package_risk: the known advisories rated by CVSS score, a verdict from the highest risk level, and the versions to move to instead. Follow up with "and does its dependency tree contain any GPL code?" for a licence review of the whole tree. Answers come in seconds inside your editor or chat, with no registry account or API key.

npm is a registered trademark of npm, Inc. This server is not affiliated with or endorsed by npm, Inc., the Python Software Foundation or the Rust Foundation.

Quick start

1. Copy your API token from Apify Console > Settings > API & Integrations.
2. Add https://mrbridge--oss-intel-mcp.apify.actor/mcp to your AI client with the header Authorization: Bearer <token>. The Connect section below has a ready-made snippet for each client.
3. Ask a question such as "is Node.js 18 still supported, and what should we upgrade to?"

What this server exposes

This server answers questions about open source packages and software lifecycles. It covers npm, PyPI and crates.io packages through their public registry APIs (package profiles, search on npm and crates.io, download counts on npm and crates.io) and through deps.dev (release history, licences, security advisories, declared and resolved dependencies, dependents, supply-chain findings, look-alike names and the OpenSSF Scorecard of the source repository). Support dates of languages, frameworks, databases and operating systems come from endoflife.date. There are 19 read-only tools, including the search and fetch pair for ChatGPT. You need no key or account for any source, only your Apify token. This server is not affiliated with npm, Inc., the Python Software Foundation, crates.io, the Rust Foundation, Google, the OpenSSF or endoflife.date.

Tools

Tool	What it answers	Billed event
oss_search_packages	Search open source packages	tool-read
oss_get_package	Get an open source package profile	tool-read
oss_compare_packages	Compare open source packages side by side	tool-action
oss_get_download_stats	Get package download statistics	tool-read
oss_list_versions	List the release history of a package	tool-read
oss_get_version	Get one package version: licence, advisories, provenance	tool-action
oss_get_requirements	List the declared dependencies of a package version	tool-read
oss_get_dependency_tree	Get the resolved dependency tree of a package version	tool-read
oss_check_dependency_licenses	Check the licences of a dependency tree	tool-action
oss_get_dependents	Count the packages that depend on a package	tool-read
oss_check_package_risk	Check whether a package version is safe to use	tool-read
oss_find_similarly_named_packages	Find packages with similar names (typosquatting check)	tool-read
oss_get_project_scorecard	Get the OpenSSF Scorecard of a source repository	tool-read
oss_search_eol_products	Find products tracked by endoflife.date	tool-read
oss_get_product_lifecycle	Get the support lifecycle of a product	tool-read
oss_check_version_support	Check whether a product version is still supported	tool-read
oss_list_upcoming_eol	List product versions reaching end of life soon	tool-read
search	Search	tool-read
fetch	Fetch	tool-read

oss_search_packages: Search open source packages

Use this when you need to find npm packages or Rust crates by topic or keywords, for example a CSV parser or an HTTP client. Returns name, latest version, description, last publish date, downloads and a link, ranked by the registry. Do not use for PyPI (PyPI offers no search API, pass an exact name to oss_get_package) or for details of one known package (oss_get_package). Parameters: query (words, e.g. "csv parser", npm qualifiers such as "keywords:cli" work), ecosystem ("npm" or "cargo"), limit (1 to 50, default 10), offset (under 1,000), response_format ("detailed" adds keywords, homepage, repository and npm score details).

Parameter	Type	Required	Example
query	string	yes	"csv parser"
ecosystem	string	yes	"npm"
limit	integer	no	10
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, query, packages[], pagination, notes[], attributions[] }. Upstream: npm registry, crates.io. Cache: hourly (1 hour). Read-only.

oss_get_package: Get an open source package profile

Use this when you need the profile of one npm, PyPI or crates.io package: latest version, description, licence, homepage and repository, deprecation or yank, runtime requirement, dependency count, downloads (npm weekly, crates.io 90 days and all time), npm install scripts, PyPI vulnerability count of the latest release, and a link to its end-of-life data when endoflife.date tracks it. Do not use for a specific older version (oss_get_version), release history (oss_list_versions) or finding a package by topic (oss_search_packages). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "express", "requests", "serde", or a purl or registry URL), response_format ("detailed" adds keywords, classifiers, categories and technical flags such as TypeScript types, package size and module type).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
response_format	"concise" or "detailed"	no	"concise"

Returns { package, notes[], next_calls[], attributions[] }. Upstream: npm registry, npm downloads API, PyPI, crates.io, endoflife.date. Cache: hourly (1 hour). Read-only.

oss_compare_packages: Compare open source packages side by side

Use this when you need to compare 2 to 5 packages of the same registry to choose one: latest version, licence, deprecation, downloads, runtime dependencies, runtime requirement and links in one table, plus the most downloaded and the one with the fewest dependencies. Do not use for one package (oss_get_package), for packages of different registries (call oss_get_package for each) or for security findings (oss_check_package_risk). Parameters: ecosystem ("npm", "pypi", "cargo"), packages (2 to 5 names, e.g. ["express", "fastify", "koa"]), response_format ("detailed" keeps the descriptions).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
packages	array of string	yes	["express","fastify","koa"]
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, packages[], leaders, notes[], attributions[] }. Upstream: npm registry, npm downloads API, PyPI, crates.io, deps.dev. Cache: hourly (1 hour). Read-only.

oss_get_download_stats: Get package download statistics

Use this when you need how often an npm package or a Rust crate is downloaded: total for a period, average per day, trend between the first and second half of the period, and the daily series on request (npm). crates.io gives the last 90 days and all-time totals. Do not use for PyPI (its API publishes no download counts) or for how many packages depend on this one (oss_get_dependents). Parameters: ecosystem ("npm" or "cargo"), package (e.g. "axios"), period (npm: "last-day", "last-week", "last-month", "last-year", default "last-month"), daily (true adds the daily series, npm only), response_format.

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
period	"last-day" or "last-week" or "last-month" or "last-year"	no	"last-month"
daily	boolean	no	false
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, period, total, start, end, average_per_day, trend_percent, all_time, daily[], notes[], attributions[] }. Upstream: npm downloads API, crates.io. Cache: daily (1 day). Read-only.

oss_list_versions: List the release history of a package

Use this when you need the versions of an npm, PyPI or crates.io package, newest first, with publish dates, the default version and deprecated releases, plus release statistics: number of versions, first and latest publish, releases in the last 365 days and the median gap between the last 20 releases. Do not use for the licence or advisories of one version (oss_get_version) or the profile of the package (oss_get_package). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "django"), include_prereleases (default true), limit (1 to 100, default 20), offset, response_format ("detailed" adds deprecation reasons, 50 versions per page at most).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
include_prereleases	boolean	no	false
limit	integer	no	20
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, default_version, statistics, versions[], pagination, notes[], attributions[] }. Upstream: deps.dev. Cache: hourly (1 hour). Read-only.

oss_get_version: Get one package version: licence, advisories, provenance

Use this when you need the facts of one version of an npm, PyPI or crates.io package: licences (SPDX), publish date, default and deprecated flags, security advisories that affect it directly (id, title, CVSS 3 score, CVE aliases, links), build provenance and attestations, and the source repository. Do not use for vulnerabilities in the dependencies of the version (oss_check_package_risk and oss_check_dependency_licenses cover the tree) or for in-depth CVE research (use a vulnerability database server). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "lodash"), version (e.g. "4.17.15", default: the default version), response_format ("detailed" adds all links, registries, PyPI project status and CVSS vectors).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version, defaulted_to_default_version, published_at, is_default, is_deprecated, deprecated_reason, licenses[], advisories_total, advisories[], provenance, source_repository, registry_url, deps_dev_url, links[], registries[], project_status, notes[], next_calls[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_get_requirements: List the declared dependencies of a package version

Use this when you need what one version of an npm, PyPI or crates.io package declares as dependencies: name, version constraint and kind (runtime, peer, optional, dev, build), with counts per kind and the runtime constraint (Python version, npm os and cpu). Do not use for the resolved transitive tree (oss_get_dependency_tree) or licences (oss_check_dependency_licenses). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "react"), version (default: the default version), include_dev (default false), limit (1 to 100, default 50), offset, response_format ("detailed" adds PyPI markers and extras, Cargo targets and features).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
include_dev	boolean	no	false
limit	integer	no	50
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version, defaulted_to_default_version, counts, runtime_constraint, provided_features[], requirements[], pagination, notes[], attributions[] }. Upstream: deps.dev. Cache: reference (30 days). Read-only.

oss_get_dependency_tree: Get the resolved dependency tree of a package version

Use this when you need what installing one npm, PyPI or crates.io package version really pulls in: the resolved transitive dependency graph with total, direct and indirect counts, maximum depth, packages resolved in several versions, resolution errors, and every node with its depth. Do not use for declared constraints only (oss_get_requirements), licences of the tree (oss_check_dependency_licenses) or who depends on this package (oss_get_dependents). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "webpack"), version (default: the default version), relation ("all", "direct", "indirect", default "all"), limit (1 to 100, default 50), offset, response_format ("detailed" adds bundled flags, node errors and the constraint that pulled each node).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
relation	"all" or "direct" or "indirect"	no	"all"
limit	integer	no	50
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version, defaulted_to_default_version, counts, packages_in_several_versions[], resolution_errors[], nodes[], pagination, notes[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_check_dependency_licenses: Check the licences of a dependency tree

Use this when you need a licence review of one npm, PyPI or crates.io package version and its whole resolved dependency tree: how many packages are permissive, weak copyleft (LGPL, MPL, EPL), strong copyleft (GPL, AGPL), restrictive (non-commercial, SSPL, BUSL) or need review (unknown or non-standard), grouped by licence, most sensitive first. Not legal advice. Do not use for the licence of one version only (oss_get_version) or the dependency list without licences (oss_get_dependency_tree). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "express"), version (default: the default version), limit (1 to 30 licence groups, default 20), offset, response_format ("detailed" lists 25 packages per group with their relation instead of 10).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
limit	integer	no	20
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version, defaulted_to_default_version, root_licenses[], packages_checked, by_category, attention_needed, resolution_errors[], licenses[], pagination, notes[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_get_dependents: Count the packages that depend on a package

Use this when you need how widely an npm, PyPI or crates.io package is used by other public packages: the number of packages that depend on one version, directly or indirectly, as computed by deps.dev from public dependency graphs. Do not use for download counts (oss_get_download_stats) or for what this package depends on (oss_get_dependency_tree). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "serde"), version (default: the default version), response_format.

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version, defaulted_to_default_version, dependent_count, direct_dependent_count, indirect_dependent_count, notes[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_check_package_risk: Check whether a package version is safe to use

Use this when you need a supply-chain safety check before installing or upgrading an npm, PyPI or crates.io package: deps.dev findings (malicious, vulnerable, deprecated, too recent to trust, little used with more popular look-alikes), the known security advisories of the version checked (rated by their highest CVSS 3 score), a verdict from the highest risk level, and the versions deps.dev recommends instead. Do not use for the advisory details (oss_get_version), for look-alike names only (oss_find_similarly_named_packages) or for the licences of the tree (oss_check_dependency_licenses). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "event-stream"), version (optional, default: the default version is checked), response_format ("detailed" adds the findings of each recommended version).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
version	string	no	"4.21.2"
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, version_checked, verdict, findings[], package_findings[], recommended_versions[], notes[], next_calls[], attributions[] }. Upstream: deps.dev. Cache: hourly (1 hour). Read-only.

oss_find_similarly_named_packages: Find packages with similar names (typosquatting check)

Use this when you need to know whether a package name looks like another one, to spot typos and typosquats before installing: packages whose names deps.dev considers similar to the given one, weighted by popularity, each with a risk check to run next. Do not use for a keyword search (oss_search_packages) or for the risk verdict itself (oss_check_package_risk). Parameters: ecosystem ("npm", "pypi", "cargo"), package (e.g. "reqeusts"), limit (1 to 50, default 20), offset, response_format ("detailed" adds registry links).

Parameter	Type	Required	Example
ecosystem	string	no	"npm"
package	string	yes	"express"
limit	integer	no	20
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { ecosystem, package, similar_packages[], pagination, notes[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_get_project_scorecard: Get the OpenSSF Scorecard of a source repository

Use this when you need the security posture of the repository behind a package: the OpenSSF Scorecard overall score (0 to 10), its date, every check (maintained, code review, branch protection, pinned dependencies, signed releases, vulnerabilities...) with its score and reason, and the three weakest checks. Pass a repository or a package, the repository is then found through deps.dev. Do not use for stars, forks or issues of a repository (not served) or for package vulnerabilities (oss_check_package_risk). Parameters: project (e.g. "github.com/expressjs/express" or a repository URL), or ecosystem with package (e.g. "npm" and "express"), response_format ("detailed" adds check descriptions, documentation links and up to 5 details per check).

Parameter	Type	Required	Example
project	string	no	"github.com/expressjs/express"
ecosystem	string	no	"npm"
package	string	no	"express"
response_format	"concise" or "detailed"	no	"concise"

Returns { project, scorecard_date, overall_score, weakest_checks[], checks[], scorecard_version, repository_commit, notes[], attributions[] }. Upstream: deps.dev. Cache: daily (1 day). Read-only.

oss_search_eol_products: Find products tracked by endoflife.date

Use this when you need to know whether endoflife.date tracks the lifecycle of a product (languages, frameworks, databases, operating systems, devices, cloud services) and under which name, or to list the products of a category or tag. Do not use for the support dates of one product (oss_get_product_lifecycle) or packages of a registry (oss_search_packages). Parameters: query (optional words matched in names, labels and aliases, e.g. "postgres"), category (optional, e.g. "database", "os", "framework", "lang", "server-app", "device", "service", "app"), tag (optional, e.g. "microsoft"), limit (1 to 100, default 20), offset, response_format ("detailed" adds aliases and the list of categories).

Parameter	Type	Required	Example
query	string	no	"postgres"
category	string	no	"database"
tag	string	no	"microsoft"
limit	integer	no	20
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { products[], categories[], pagination, notes[], attributions[] }. Upstream: endoflife.date. Cache: daily (1 day). Read-only.

oss_get_product_lifecycle: Get the support lifecycle of a product

Use this when you need the release cycles of a language, framework, database, operating system or other product with their support dates: release date, LTS flag, support status today, end of active support, end of life, extended support, and the latest version of each cycle. Do not use for one version you run (oss_check_version_support answers directly) or for a registry package profile (oss_get_package). Parameters: product (e.g. "nodejs", "python", "postgresql", "ubuntu", aliases work), status ("all", "supported", "eol", default "all"), limit (1 to 100, default 20), offset, response_format ("detailed" adds codenames, latest release dates and links, the version command and the release policy link).

Parameter	Type	Required	Example
product	string	yes	"nodejs"
status	"all" or "supported" or "eol"	no	"supported"
limit	integer	no	20
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { product, label, category, url, counts, phase_labels, version_command, release_policy, releases[], pagination, notes[], attributions[] }. Upstream: endoflife.date. Cache: daily (1 day). Read-only.

oss_check_version_support: Check whether a product version is still supported

Use this when you need to know if the version of a language, framework, database or operating system you run is still supported: the matching release cycle, its status on a date (active, security only, extended support, end of life), the dates and days left, whether you run its latest patch, and the version to upgrade to (newest maintained cycle, LTS first). Do not use for the full cycle table (oss_get_product_lifecycle) or for npm, PyPI or crates.io package versions (oss_check_package_risk). Parameters: product (e.g. "nodejs", "python", "django", "ubuntu"), version (e.g. "18.19.0", "3.9", "22.04", "v20"), as_of (optional date YYYY-MM-DD, default today).

Parameter	Type	Required	Example
product	string	yes	"nodejs"
version	string	yes	"18.19.0"
as_of	string	no	"2026-12-31"

Returns { product, label, version, as_of, cycle, status, supported, lts, release_date, active_support_until, eol, extended_support_until, days_until_eol, latest_patch, is_latest_patch, recommended_upgrade, summary, url, notes[], attributions[] }. Upstream: endoflife.date. Cache: daily (1 day). Read-only.

oss_list_upcoming_eol: List product versions reaching end of life soon

Use this when you need which release cycles of languages, frameworks, databases, operating systems and other products tracked by endoflife.date reach end of life in the coming days, soonest first, to plan upgrades. Do not use for one product (oss_get_product_lifecycle) or one version (oss_check_version_support). Parameters: within_days (1 to 730, default 90), category (optional, e.g. "database", "os", "framework", "lang"), limit (1 to 100, default 25), offset, response_format ("detailed" adds the category and release date).

Parameter	Type	Required	Example
within_days	integer	no	90
category	string	no	"database"
limit	integer	no	25
offset	integer	no	0
response_format	"concise" or "detailed"	no	"concise"

Returns { from, to, cycles[], pagination, notes[], attributions[] }. Upstream: endoflife.date. Cache: daily (1 day). Read-only.

search: Search

Use this when ChatGPT needs to find open source packages (npm, crates.io, exact PyPI names) or products with end-of-life data (endoflife.date) for a topic or a name. Do not use for details, call fetch with a result id. Parameter query (string), e.g. "http client" or "django".

Parameter	Type	Required	Example
query	string	yes	"django"

Returns { results[], notices[] }. Upstream: npm registry, npm downloads API, PyPI, crates.io, deps.dev, endoflife.date. Cache: hourly (1 hour). Read-only.

fetch: Fetch

Use this when ChatGPT needs the summary of one result returned by search: a package profile (version, licence, links, downloads) or a product support lifecycle. Do not use for ids that did not come from search. Parameter id (from search), e.g. "npm:express", "pypi:requests", "cargo:serde" or "eol:nodejs".

Parameter	Type	Required	Example
id	string	yes	"npm:express"

Returns { id, title, text, url, metadata, notices[] }. Upstream: npm registry, npm downloads API, PyPI, crates.io, deps.dev, endoflife.date. Cache: hourly (1 hour). Read-only.

Connect

Endpoint (Streamable HTTP): https://mrbridge--oss-intel-mcp.apify.actor/mcp

Every client authenticates with your Apify API token, found in Apify Console > Settings > API & Integrations. Clients that support custom headers send it as Authorization: Bearer <token>. The others use the ?token= URL variant, which must be treated as a secret: keep it out of commits, screenshots and shared logs.

Claude Code

$claude mcp add --transport http oss-intel "https://mrbridge--oss-intel-mcp.apify.actor/mcp" --header "Authorization: Bearer ${APIFY_TOKEN}"

Cursor, VS Code and other JSON configurations

{
  "mcpServers": {
    "oss-intel": {
      "type": "http",
      "url": "https://mrbridge--oss-intel-mcp.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer ${APIFY_TOKEN}"
      }
    }
  }
}

claude.ai and Claude Desktop

Add a custom connector with the URL https://mrbridge--oss-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN and no authentication. Prefilled link (replace the token placeholder before saving): add Open Source Dependency Check MCP Server to Claude.

ChatGPT (developer mode)

Settings > Apps > Create, URL https://mrbridge--oss-intel-mcp.apify.actor/mcp?token=YOUR_APIFY_TOKEN, authentication "No authentication". ChatGPT snapshots the tool list: after a server update, an admin has to click Refresh on the app.

OpenAI Responses API

{
  "type": "mcp",
  "server_label": "oss_intel",
  "server_url": "https://mrbridge--oss-intel-mcp.apify.actor/mcp",
  "headers": {
    "Authorization": "Bearer YOUR_APIFY_TOKEN"
  },
  "require_approval": "never"
}

Add allowed_tools to restrict the tool list. Tool calls must finish within about 60 seconds on this API, and every tool of this server answers in under 50 seconds.

Anthropic Messages API

{
  "mcp_servers": [
    {
      "type": "url",
      "url": "https://mrbridge--oss-intel-mcp.apify.actor/mcp",
      "name": "oss-intel",
      "authorization_token": "YOUR_APIFY_TOKEN"
    }
  ],
  "tools": [
    {
      "type": "mcp_toolset",
      "mcp_server_name": "oss-intel"
    }
  ]
}

Send the beta header anthropic-beta: mcp-client-2025-11-20.

One-click OAuth alternative

https://mcp.apify.com/?tools=mrbridge/oss-intel-mcp connects through Apify OAuth without a token. It exposes the Actor as a single tool rather than the granular tools listed above.

Cost control

Each Standby run has a spending limit (maxTotalChargeUsd). When a call uses the last of it, the result is still returned, and later calls in that run answer CHARGE_LIMIT_REACHED until the limit is raised.

Why use Open Source Dependency Check MCP Server

• Three registries, one set of tools. npm, PyPI and crates.io behind tools shaped like questions. Package URLs (purls), registry links and name@version all work.
• Supply-chain checks before you install. Malicious, vulnerable, deprecated and too-recent findings, look-alike names (typosquatting), install scripts, build provenance and the OpenSSF Scorecard of the source repository.
• Dependency intelligence. Resolved transitive trees with depth and duplicated packages, dependents counts, and a licence review of the whole tree grouped by risk category.
• Lifecycle answers. Is this version still supported, what to upgrade to, and what reaches end of life in the coming months, computed for any date.
• No personal data. Author, maintainer and publisher names and e-mail addresses are removed from every answer.
• ChatGPT deep research ready. A search and fetch pair across packages and product lifecycles.

Pricing (Pay-per-Event)

Open Source Dependency Check MCP Server uses pay-per-event pricing. Each successful call is one tool-read event at $0.005, or one tool-action event at $0.01 for the three heavier tools (oss_get_version, oss_check_dependency_licenses and oss_compare_packages), so 1,000 reads cost $5 in events, and a full dependency licence review is a single tool-action event however many packages it checks. These are the FREE plan prices, and Apify plan discounts lower them. Apify also bills its standard apify-actor-start event when a Standby run starts, and you pay the platform usage of your own Standby run on top of the events, as explained below. Calls that end in an error carry no event charge. See the Pricing tab for the price on your Apify plan.

Event	Charged when	Price
apify-actor-start	run start (platform default)	see the Store page
tool-read (primary event)	each successful read tool call	see the Store page
tool-action	each successful call of a detailed or computed tool	see the Store page

Never charged: initialize, tools/list, pings, readiness probes, and any call that ends in an error (invalid input, not found, upstream failure, timeout, spending limit).

Platform usage comes on top of these events. This server runs in Apify Standby mode, and you also pay the platform usage of your own Standby run, billed to your Apify account like any other run: the memory set for the Standby run, for as long as the server is up, idle time included, until the run stops at its idle timeout. The Apify pay-per-event documentation says so: "For runs in Standby mode, users always pay the platform usage costs in addition to the event charges."

Limits, caveats and attribution

• Attribution. Every answer carries an attributions list with the source, the terms URL and the notices the source requires: the npm trademark notice, the deps.dev CC-BY 4.0 credit, the OpenSSF Scorecard CDLA-Permissive-2.0 licence and the endoflife.date MIT copyright line. Keep them when you reuse the data. Values this server computes (dependency depth, licence categories, release statistics, download trends, support status on a date, risk verdict) are labelled as such.
• Registries covered. Package tools cover npm, PyPI and crates.io. PyPI has no search API, so PyPI questions need the exact project name. PyPI publishes no download counts. crates.io gives the last 90 days and all-time totals, npm gives daily counts for up to a year.
• What is not served. No GitHub or Docker Hub data: their terms do not allow resale of API access. The repository facts that deps.dev collects from GitHub or GitLab (stars, forks, issues, description) are left out for the same reason. Only the OpenSSF Scorecard of a repository is returned.
• No personal data. Author, maintainer, publisher and owner names and e-mail addresses are removed from every answer. npm packages show a maintainers count only.
• Licences are not legal advice. Licences come from package metadata as published and may be wrong or incomplete. The licence review groups SPDX identifiers into broad categories (permissive, weak copyleft, strong copyleft, restrictive, needs review) and flags a tree with resolution errors as incomplete. Check each licence yourself before a decision.
• Security data. Advisories and findings (malicious, vulnerable, deprecated, too recent, little used) come from deps.dev and OSV.dev sources. "No finding" is not a guarantee of safety. A dedicated vulnerability server goes deeper into CVE details.
• Dependency graphs are resolved by deps.dev as if the package were installed alone on a generic 64-bit Linux system, so a real install can differ. Very large graphs (several thousand packages) may not finish within the 48-second limit of one call.
• Beta data. Dependents counts, findings, look-alike names and the batch licence lookup use the deps.dev v3alpha API, which may change without notice.
• Lifecycle data from endoflife.date is maintained by volunteers. Check the vendor release policy before an upgrade decision. The support status is computed for today, or for the date you give, from the published dates.
• Rate limits. crates.io allows one request per second. Several copies of this server may run at once, so each one keeps to one request every four seconds and makes at most one retry: a comparison of five crates takes about 16 seconds the first time and is instant from the cache after. npm, PyPI, deps.dev and endoflife.date publish no limit, and the server keeps its own conservative pace.
• Freshness. Search results, package profiles and supply-chain findings are cached for an hour, download counts, dependency graphs, advisories, Scorecards and lifecycle data for a day, the declared requirements of a published version for 30 days. When a source is down, a cached copy may be served and the answer says so.

Data terms

By using this server you agree to use the data it returns in line with the terms of each source, and to keep the credit lines when you share it.

• npm public registry: npm Open-Source Terms and npm Logos and Usage. npm is a registered trademark of npm, Inc. Do not suggest that npm endorses your product, and do not put "npm" in a product name.
• PyPI: Terms of Service and Acceptable Use Policy. Do not use the data for spam or to sell personal information. "Python" is a registered trademark of the Python Software Foundation.
• crates.io: policies and data access policy.
• deps.dev: data generated by deps.dev is licensed under CC-BY 4.0, use of the API is subject to the Google APIs Terms of Service. Credit deps.dev. Advisories from the GitHub Advisory Database are licensed under CC-BY 4.0: credit them with a link to https://github.com/advisories.
• OpenSSF Scorecard: results licensed under the Community Data License Agreement Permissive 2.0.
• endoflife.date: Copyright 2020 endoflife.date contributors, MIT License. Keep the copyright line.

The fee for this server pays for the service (hosting, caching, normalisation, the computed summaries), not for a licence on the data.

Use cases

• Code review. Before merging a pull request that adds a dependency, ask for its risk check, its install scripts and its licence review.
• Licence compliance. "Does anything in the dependency tree of this package version use a strong copyleft or non-commercial licence?"
• Choosing a library. "Compare axios, got and ky: weekly downloads, runtime dependencies, licence and latest version."
• Typosquatting checks. "Is reqeusts a look-alike of a popular PyPI package?"
• Upgrade planning. "Which runtimes and databases reach end of life in the next 90 days?"
• Repository health. Read the OpenSSF Scorecard of a package's source repository and its three weakest checks.

Licence reviews and risk findings are indicative, not legal or security advice. A clean result is not a guarantee of safety.

More developer and security tools

• CVE lookup for AI: known vulnerabilities in your pinned dependencies and CVE records with CVSS scores.
• programming Q&A search MCP: Stack Overflow questions similar to your error, with accepted and top answers.

FAQ

Why is the first call slower?

The server runs in Apify Standby mode. When no request comes in for a while, the run stops at its idle timeout, and the next call starts a new one. That cold start took about 6 seconds in the last platform test. Calls made while the server is warm skip the delay.

Which ecosystems are covered?

npm, PyPI and crates.io for package tools. Maven, Go, NuGet and RubyGems are not covered. Lifecycle tools cover every product that endoflife.date tracks: languages, frameworks, databases, operating systems, devices and cloud services.

Why can't I search PyPI by keyword?

PyPI offers no search API, so PyPI questions need the exact project name. PyPI also publishes no download counts.

Why is the first comparison of Rust crates slow?

crates.io allows one request per second, and this server keeps well under that. Comparing five crates takes about 16 seconds the first time and is instant from the cache after.

Does it show GitHub stars or Docker images?

No. GitHub and Docker Hub terms do not allow resale of their API access, so repository stars, forks, issues and container images are left out. The OpenSSF Scorecard of a repository is included.

Where do I get CVE details?

The risk check lists advisories with their CVSS scores. For CVE records, known-exploited dates and dependency scans of a whole lockfile, see the companion Vulnerability Intelligence MCP Server.

Your feedback

Found a bug or a wrong answer? Open an issue on the Issues tab. Open Source Dependency Check MCP Server is built by MrBridge. More servers are listed in the MCP server catalogue, and more tools and data studies are at mr-bridge.com.

Changelog

• 0.1.4: Output, dataset and key-value store schemas, as Apify asks for publication: the Output tab of a run started from the Console shows the connection details and one row per tool.
• 0.1.3: the Input tab shows the endpoint and how to connect an AI client, and a run started from the Console outputs the connection details and the tool list
• 0.1.2: pricing events tool-read and tool-action
• 0.1.1: the server is named Open Source Dependency Check MCP Server (connector name, connection page and server instructions). The endpoint and the tools do not change.
• 0.1.0: initial build (private, unpublished)