DepShield MCP

Real-time dependency security for AI coding agents

DepShield intercepts every package your agent tries to install, verifies it exists, checks it against CVE databases, and blocks vulnerable or hallucinated dependencies — before they touch your codebase.

Works with Cursor · Claude Code · Windsurf · Antigravity · Cline · any MCP-compatible IDE

🤔 Why

AI coding agents pull packages from stale training data. They install outdated versions with known CVEs. They hallucinate package names that don't exist, opening the door to typosquatting attacks. They default to deprecated libraries when better alternatives exist.

There's no checkpoint between "agent decides to use a package" and "package lands in your project." DepShield is that checkpoint.

⚡ What It Does

Seven security tools exposed over the Model Context Protocol:

Plus a depshield://status resource and a security_review prompt template for guided full-project audits.

Zero API keys required. DepShield uses free, open APIs: npm Registry, OSV.dev (Google's open vulnerability database), and PyPI.

🚀 Quick Start

Option 1: npx (no install)

Add to your IDE's MCP configuration and you're done. No global install needed.

Option 2: Clone and build

git clone https://github.com/devanshkaria88/depshield-mcp.git
cd depshield-mcp
npm install
npm run build

🔌 IDE Setup

{
  "mcpServers": {
    "depshield": {
      "command": "npx",
      "args": ["-y", "depshield-mcp"]
    }
  }
}

{
  "mcpServers": {
    "depshield": {
      "command": "node",
      "args": ["/absolute/path/to/depshield-mcp/dist/index.js"]
    }
  }
}

claude mcp add depshield -- npx depshield-mcp

claude mcp add depshield -- node /absolute/path/to/depshield-mcp/dist/index.js

{
  "mcpServers": {
    "depshield": {
      "command": "npx",
      "args": ["-y", "depshield-mcp"]
    }
  }
}

npx depshield-mcp

💡 Usage Examples

Once connected, your AI agent has access to all seven tools. Try these prompts:

📖 Tools Reference

🔒 Cursor Rule (Optional)

The .cursor/rules/dep-shield.mdc file included in this repo forces the Cursor agent to automatically call check_dependency before every package install. Copy it to your project:

mkdir -p .cursor/rules
cp node_modules/depshield-mcp/.cursor/rules/dep-shield.mdc .cursor/rules/

This turns DepShield from a tool the agent can use into a gate the agent must pass through.

🧪 Testing

MCP Inspector (interactive UI for testing tools):

npm run inspect

Or:

npx @modelcontextprotocol/inspector node dist/index.js

Raw stdio (quick verification):

printf '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0.0"}}}\n{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"check_dependency","arguments":{"name":"lodash","version":"4.17.20"}}}\n' | node dist/index.js 2>/dev/null

🌐 APIs Used

All free, no API keys required:

📁 Project Structure

depshield-mcp/
├── src/
│   ├── index.ts                    # MCP server entry — tool/resource/prompt registration
│   ├── cache.ts                    # In-memory TTL cache (5 min)
│   ├── utils.ts                    # Severity parsing, version sorting, fetch helpers
│   ├── apis/
│   │   ├── npm-registry.ts         # npm registry, search, downloads
│   │   ├── osv.ts                  # OSV.dev vulnerability queries
│   │   └── pypi-registry.ts        # PyPI JSON API
│   └── tools/
│       ├── check-dependency.ts     # Pre-install gate
│       ├── audit-project.ts        # Full manifest audit
│       ├── find-safe-version.ts    # Safe version finder
│       ├── get-advisory-detail.ts  # CVE/GHSA deep dive
│       ├── check-npm-health.ts     # Package health scoring
│       ├── suggest-alternative.ts  # Alternative package finder
│       └── deep-scan.ts            # Transitive dependency scanner
├── .cursor/rules/
│   └── dep-shield.mdc             # Cursor agent rule (alwaysApply)
├── package.json
├── tsconfig.json
├── LICENSE
└── README.md

📋 Requirements

• Node.js 22 or later
• An MCP-compatible AI coding tool

🤝 Contributing

Contributions are welcome. Please open an issue first to discuss what you'd like to change.

Areas where help would be appreciated:

• Additional ecosystem support (Cargo, Go modules, Maven)
• Improved CVSS vector string parsing
• Integration tests with mocked API responses
• GitHub Actions CI pipeline

📄 License

MIT — see LICENSE for details.

Built by Devansh Karia