Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
Most developer tooling work still happens through a UI a human drives. @4da/MCP MCP server moves it into the conversation instead. Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
It scans your codebase — Cargo.toml, package.json, go.mod, Git history — and scores every article, advisory, and release from 20+ sources against what you actually build. An item needs 2+ independent signals to survive. Everything else is rejected.
The server publishes 14 tools. What each one is for:
Title — body coherence**: titles must deliver on what they promise. Claim "React + Rust + Tauri" but only discuss React? PenaltyRole — aware scoring: security engineers see security content prominently; experience level adjusts tutorial/depth balanceAnti-gaming — title-body coherence, keyword concentration, adversarial resistance built into the pipelineCross — session, cross-agent persistent memoryAxis — What it measuresContext — Semantic similarity to your active codebaseInterest — Alignment with your declared and learned topicsACE — Real-time signals from your Git commits and file editsDependency — Direct matches against your installed packagesLearned — Save/dismiss feedback boosts or suppresses future scoresCategory — WhereUpdater — GitHub ReleasesInstallation goes through your MCP client rather than a global install: point it at @4da/mcp-server on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. @4da/MCP's toolset — Title, Role, Anti-gaming and 11 more — is a fair guide to whether it matches your workflow.
This entry was verified against @4da/MCP's own documentation before publication; SyncDev keeps the directory reviewed rather than auto-generated.
| Tool | What it does |
|---|---|
| Title | body coherence**: titles must deliver on what they promise. Claim "React + Rust + Tauri" but only discuss React? Penalty. |
| Role | aware scoring: security engineers see security content prominently; experience level adjusts tutorial/depth balance |
| Anti-gaming | title-body coherence, keyword concentration, adversarial resistance built into the pipeline |
| Cross | session, cross-agent persistent memory |
| Axis | What it measures |
| Context | Semantic similarity to your active codebase |
| Interest | Alignment with your declared and learned topics |
| ACE | Real-time signals from your Git commits and file edits |
| Dependency | Direct matches against your installed packages |
| Learned | Save/dismiss feedback boosts or suppresses future scores |
| Category | Where |
| Updater | GitHub Releases |
| Platform | Download |
| Windows | [.exe installer](https://github.com/4DA-Systems/4DA/releases/latest) |
{
"mcpServers": {
"github-com-runyourempire-4da-tree-main-mcp-4da-server": {
"command": "npx",
"args": ["-y", "@4da/mcp-server"]
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.