io.github.yc-droid/depscout

up checked 2026-11-11T11:37:41.006Z

Unclaimed · Unverified

Publisher-provided title

DepScout

Publisher-provided description

Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.

Summary by lookupd

Scans package manifests and lockfiles across npm, PyPI, Go, Maven, Cargo and NuGet for known vulnerabilities and malicious packages.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http depscout https://depscout.salesup.workers.dev/mcp

Codex, remote (streamable-http)

codex mcp add depscout --url https://depscout.salesup.workers.dev/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "depscout": {
      "url": "https://depscout.salesup.workers.dev/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

check_package Check one open-source package (npm, PyPI, Go, Maven, crates.io or NuGet) for safety and freshness. Returns a malicious-package flag (from OSV MAL- and malware a
check_dependencies Check up to 50 packages at exact versions (for example from package.json, package-lock.json, requirements.txt, go.mod, pom.xml, Cargo.toml or a .csproj) against
check_lockfile Audit a whole lockfile or dependency file in one call, including transitive dependencies where the file records them. Paste the file content as-is: package-lock
get_vulnerability Look up one vulnerability or malicious-package advisory by ID (CVE, GHSA, PYSEC, GO, RUSTSEC, MAL and other OSV IDs) and return its summary, severity, CVSS vect

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.yc-droid/depscout.svg)](https://lookupd.com/servers/io.github.yc-droid/depscout)