What is dephealth-mcp?

DepHealth is a small server that speaks the Model Context Protocol, or MCP, a standard that lets AI coding assistants like Claude Code, Claude Desktop, or Cursor call out to external tools. It gives those assistants two questions they can answer instantly about a coding project: whether its current dependencies have known security problems, and whether a specific package is safe to add or upgrade to. It answers these questions using two free public data sources instead of a paid service. Vulnerability information comes from Google's OSV.dev database, which covers a very large number of security advisories across dozens of programming ecosystems, and package health signals, such as how recently a package was updated or whether it has been marked deprecated, come from deps.dev. Because both of these sources are free and public, there is no account to create and no API key to manage for this project. The main tool, audit_project, scans a folder for common dependency files such as package.json, requirements.txt, pyproject.toml, go.mod, or Cargo.toml, checks all of the listed packages against the vulnerability database at once, and returns a short report listing which packages have problems, how severe they are, and which version fixes them. The second tool, check_package, looks at a single package and returns one of three verdicts: avoid, if it has serious known vulnerabilities, caution, if it has less severe issues or has not been updated in a long time, or ok if it looks clean and maintained overall. Because MCP tools are often criticized for flooding an AI assistant's context with excessive detail, DepHealth deliberately keeps its output compact, capping the number of vulnerabilities shown per package and putting the worst ones first. Setting it up requires Python 3.11 or newer and the uv package manager, after which it can be registered with Claude Code using a single command or added to Claude Desktop's configuration file directly.