Predictive dependency security engine. Trust scores, zombie detection, blast radius analysis.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-ertugrulakben-dep-oracle": {
"args": [
"-y",
"dep-oracle"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Your dependencies have dependencies. Who's watching them?
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'dep-oracle' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
Checked dep-oracle against OSV.dev.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in security / developer-tools
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite
MCP server for accessing Figma plugin console logs and screenshots via Cloudflare Workers or local mode
MCP Security Weekly
Get CVE alerts and security updates for io.github.ertugrulakben/dep-oracle and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Predictive Dependency Security Engine
Quick Start · Features · Algorithm · MCP · Comparison
English | Turkce
Your dependencies have dependencies. Who's watching them?
dep-oracle is a predictive dependency security engine that calculates Trust Scores (0-100) for every package in your dependency tree. It detects zombie dependencies, measures blast radius, catches typosquatting attempts, and predicts future risks — before they become vulnerabilities.
Claude Code Security scans YOUR code. dep-oracle scans everything your code depends on.
npm audit only catches known CVEs — dep-oracle predicts future risks# Zero install — just run it
npx dep-oracle
# Or install globally
npm install -g dep-oracle
dep-oracle scan
# Check a single package
dep-oracle check express
| Feature | Description |
|---|---|
| Trust Score | 0-100 weighted score per package (security, maintainer health, activity, popularity, funding, license) |
| Zombie Detection | Finds unmaintained but critical packages (no commits in 12+ months) |
| Blast Radius | Shows how many files are affected if a dependency is compromised |
| Typosquat Detection | 1,847+ known packages + live npm registry lookup to catch suspicious names |
| Trend Prediction | 3-month risk projection based on download/commit/release trends |
| Migration Advisor | 131 package mappings with 192 safer alternatives for risky dependencies |
| Offline Mode | Works from cache without internet (--offline) |
| MCP Server | Native Claude Code integration — ask about your dependencies in natural language |
| Multi-Format Output | Terminal (colored tree), HTML, JSON, and SARIF |
| GitHub Action | Automate trust checks in your CI/CD pipeline |
# Scan current project
dep-oracle scan
# Scan with specific output format
dep-oracle scan --format json
dep-oracle scan --format html
dep-oracle scan --format sarif
# Check a single package
dep-oracle check lodash
dep-oracle check express@4.18.2
# Offline mode (uses cached data only)
dep-oracle scan --offline
# Set minimum score threshold (exit code 1 if below)
dep-oracle scan --threshold 60
# Ignore specific packages
dep-oracle scan --ignore deprecated-but-needed,legacy-pkg
# Verbose logging
dep-oracle scan --verbose
dep-oracle v1.2.0
Scanning
... [View full README on GitHub](https://github.com/ertugrulakben/dep-oracle#readme)