npm dependency fitness: deprecated/yanked/superseded + verified safe migration target.
npm dependency fitness: deprecated/yanked/superseded + verified safe migration target. That is what the dependency mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
An MCP server that gives a coding agent a cross-validated fitness verdict for an npm package before it writes or upgrades a dependency:
The server publishes 2 tools. What each one is for:
check_package_fitness — Single-package verdict. Input: package (e.g. request, @babel/core), optional version (exact, semver range, or dist-tag — omit for latest). Outputaudit_dependencies — Batch verdict for a CI / pre-merge gate. Input: packages (e.g. ["react@18.2.0", "request"]) and/or the raw contents of a package.json. Output: aInstallation goes through your MCP client rather than a global install: point it at dependency-fitness-mcp on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Configuration is passed through the environment: GITHUB_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Dependency's toolset — check_package_fitness, audit_dependencies — is a fair guide to whether it matches your workflow. It is maintained by TweedBeetle; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| check_package_fitness | Single-package verdict. Input: package (e.g. request, @babel/core), optional version (exact, semver range, or dist-tag — omit for latest). Output: the full Verdict (structured) plus a human-readable summary. |
| audit_dependencies | Batch verdict for a CI / pre-merge gate. Input: packages (e.g. ["react@18.2.0", "request"]) and/or the raw contents of a package.json. Output: a per-package verdict array plus a summary (how many deprecated / malicious / |
{
"mcpServers": {
"dependency-fitness": {
"command": "npx",
"args": ["-y", "dependency-fitness-mcp"],
"env": {
"GITHUB_TOKEN": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| GITHUB_TOKEN | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.