Search / io.github.DigiCatalyst-Systems/dep-diff-mcp
protogridR0· no sign-inTranslates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
v0.3.2 · active · repository · descriptor JSON · versions
{
"mcpServers": {
"dep-diff-mcp": {
"type": "http",
"url": "https://dep-diff.digicatalyst.ca/mcp"
}
}
}claude mcp add --transport http dep-diff-mcp https://dep-diff.digicatalyst.ca/mcp[mcp_servers.dep-diff-mcp]
url = "https://dep-diff.digicatalyst.ca/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dep-diff-mcp": {
"type": "remote",
"url": "https://dep-diff.digicatalyst.ca/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"dep-diff-mcp": {
"type": "http",
"url": "https://dep-diff.digicatalyst.ca/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=dep-diff-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZGVwLWRpZmYuZGlnaWNhdGFseXN0LmNhL21jcCJ9"
}{
"servers": {
"dep-diff-mcp": {
"type": "http",
"url": "https://dep-diff.digicatalyst.ca/mcp"
}
}
}{
"mcpServers": {
"dep-diff-mcp": {
"httpUrl": "https://dep-diff.digicatalyst.ca/mcp"
}
}
}extensions:
"dep-diff-mcp":
enabled: true
name: "dep-diff-mcp"
type: streamable_http
uri: "https://dep-diff.digicatalyst.ca/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations2 of 2 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 634 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulnsno known advisory in 102 resolved packagesdeps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or laterdeps.resolvable@digicatalyst/[email protected] resolved: 102 packagesNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +reachable +uptime-94% ~updated-44d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
@digicatalyst/[email protected] npm101 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19
| advisory | severity | package | fixed in |
|---|---|---|---|
| GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server | high | @modelcontextprotocol/[email protected]MCP SDK, direct | fixed in 1.31.0 |
Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://dep-diff.digicatalyst.ca/mcp streamable-http | none | yes | 94% | 322 ms | 2025-11-25 | 2026-10-19 |
| package | registry | version | runtime | secrets |
|---|---|---|---|---|
@digicatalyst/dep-diff-mcp | npm | 0.3.2 | – |
analyze_package_changeread-only | Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead. |
analyze_packages_bulkread-only | Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lockfile diff, or batch upgrade. Returns: total count, breakdown by semver class, total security fixes found, packages with breaking changes, and per-package details. Limit 50 packages per call (chunk larger lists). |
Schemas: list_tools.
{
"name": "io.github.DigiCatalyst-Systems/dep-diff-mcp",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://dep-diff.digicatalyst.ca/mcp",
"type": "streamable-http"
}
],
"version": "0.3.2",
"packages": [
{
"version": "0.3.2",
"transport": {
"type": "stdio"
},
"identifier": "@digicatalyst/dep-diff-mcp",
"registryType": "npm"
}
],
"repository": {
"url": "https://github.com/DigiCatalyst-Systems/dep-diff-mcp",
"source": "github"
},
"description": "Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions."
}