pkg-health-mcp

Is this dependency still maintained? Find out before you install it.

pkg-health-mcp scores npm packages, PyPI packages and GitHub repositories from 0 to 100 for maintenance health. It combines release and commit activity, active maintainers, issue response times, download trends, OpenSSF Scorecard and license into an A–F grade and a plain-language list of risks.

Use it three ways, all built on the same engine:

• MCP server for Claude Code, Claude Desktop, Cursor, VS Code and any other MCP client, so your AI agent checks a package before it suggests one.
• CLI to audit a manifest or lock file, including transitive dependencies.
• GitHub Action to add a health report to every pull request and fail the build below a threshold.

$ npx -y pkg-health-mcp scan package.json

F   10/100  request@2.88.2  [npm]
      10  Recent activity        last release 2444d ago
       5  Maintainer diversity   0 active committer(s) in the last 12 months
      10  Issue responsiveness   median 113.2d to first maintainer response, 38% answered (8 issues)
      65  Download trend         171.5M downloads in last 90d (-5% vs previous 90d)
      34  OpenSSF Scorecard      3.4/10
     100  License                Apache-2.0 (permissive)
     !  Deprecated: request has been deprecated, see https://github.com/request/request/issues/3142
     !  No release in 6+ years
     !  No commits in the last 12 months
     !  62% of recent issues got no maintainer response

F   10/100  left-pad@1.3.0  [npm]
     !  Deprecated: use String.prototype.padStart()
     !  Source repository is archived

A   99/100  express@5.3.0  [npm]
     100  Recent activity        last release 12d ago, last commit 4d ago
     100  Maintainer diversity   42 active committer(s) in the last 12 months
     100  Issue responsiveness   median 0.2d to first maintainer response, 87% answered (53 issues)
     100  Download trend         1.6B downloads in last 90d (+22% vs previous 90d)
      85  OpenSSF Scorecard      8.5/10
     100  License                MIT (permissive)

Contents

• Why
• Features
• Quick start
• GitHub token
• Tools
• Using it with an AI agent
• Command line
• GitHub Action
• How the score works
• Data sources
• Limitations
• FAQ
• Development
• Contributing
• License

Why

A typical project pulls in hundreds of open-source packages. Some of them are quietly abandoned: no releases for years, one maintainer who moved on, issues piling up unanswered. When a vulnerability shows up in one of those, nobody fixes it.

Checking this by hand means opening each package's GitHub page and reading commit dates, issue lists and contributor graphs. Nobody does that for every dependency, and AI coding assistants never do it: they happily suggest whatever library was popular in their training data, including ones deprecated years ago.

pkg-health-mcp makes that check a single tool call, so:

• AI agents can avoid recommending abandoned libraries and flag risky ones in existing code.
• **Engineering

... View full README on GitHub