DepScope
Free keyless MCP server that catches hallucinated, vulnerable, and typosquatted packages
0Visit DepScope
depscope.devAbout DepScope
DepScope is a free MCP server that screens every package an AI agent suggests before it reaches npm install. It targets three specific failure modes. The first is hallucination: LLMs invent plausible-sounding package names, and DepScope verifies each one against live registries across 19 ecosystems and flags typosquats by Levenshtein distance to popular packages — the exact mechanism attackers rely on when they register a name a model is likely to hallucinate. The second is vulnerability exposure, covered by live lookups against OSV, CISA's Known Exploited Vulnerabilities list, EPSS scores, the OpenSSF malicious-package feed, and a deprecated-package index, returning severity, fix version, and migration path in one call. The third is token cost: pre-curated briefs of roughly 300 tokens replace the four-to-eight thousand tokens an agent would otherwise burn scraping registry and CVE pages per decision, a reported 74% reduction. It covers 8.5 million packages across 19 ecosystems — npm, PyPI, Cargo, Go, Composer, Maven, NuGet, RubyGems, pub, hex, Swift, CPAN, Hackage, CRAN, conda, Homebrew, JSR, and Julia — with 22 MCP tools, no auth, no API key, and no rate limit. Remote MCP works out of the box in Claude Desktop, Cursor, and Windsurf, with a curl one-liner for everything else, and the SDKs are open source. There is also a browser paste-a-manifest scan and a published ten-model hallucination benchmark.
Does ChatGPT recommend your AI tool?
If you're building in AI Security & Testing, run a free AI-visibility scan on your own product — we ask ChatGPT across 5 prompt angles and score how often you get named. ~30 seconds, no signup, no card.
Key Features
DepScope Pros & Cons
✅ Pros
- +Completely free with no key, no quota, and no signup — nothing to evaluate around
- +Slot-hallucination and typosquatting are a real, actively exploited attack path
- +Token savings are a direct cost reduction on every agent dependency decision
- +Ecosystem coverage well beyond the usual npm-and-PyPI pairing
⚠️ Cons
- −No published business model, which raises questions about long-term availability
- −No auth and no rate limit means no SLA or support commitment either
- −Screening is advisory — it does not block installs on its own
- −Depends on upstream feeds (OSV, KEV, EPSS) for freshness
Who Is DepScope Best For?
Tags
Is DepScope your tool?
This is the page buyers and AI assistants read when they look up DepScope. Claim your listing for $19 one-time — no subscription, nothing to cancel — and take a capped slot in your category: each one sells a fixed number, and yours ranks above every free tool in it, with a Featured badge. Prefer it ongoing? Monthly is one click away on the next page.
Complete Your Security Stack
Other security tools in our catalog:
1Password
Try FreeSecrets and credential manager
Keep API keys and .env secrets out of your repo
Gamma
Try FreeAI presentation builder
Turn ideas into polished decks instantly
AdCreative.ai
Try FreeAI-powered ad creatives
Generate marketing visuals in seconds
💰 Affiliate disclosure: We may earn a commission if you sign up through these links at no extra cost to you.
Stay updated on AI Security & Testing tools — join our weekly newsletter
One concise email with fresh launches, trending picks, and featured standouts.
Alternatives to DepScope
View all DepScope alternatives →More AI Security & Testing tools
Linda Detector
Explore possible AI-writing signals locally on Windows.
agent-qa
Web and mobile QA for coding agents, with memidex memory and validated self-improvement.
Fake Review Detector
Free AI tool that analyzes review text and gives a verdict on whether it looks genuine or fake.
Desk Check
Paste your AI receptionist's prompt; 5 simulated trade callers score it. Free check, $49 full report.
FlowPatrol
Monitors app flows for failures after AI edits.
AdRate
Automate TikTok ads: rules, GMV Max & bulk launch
Agent connectivity: not yet verified