io.github.runyourempire/4da-mcp-server

4DA knows every dependency on your machine and tells you — and your coding agent — what changed and exactly what to run. Privately, locally.

Quick start · How it works · Measured · Privacy · Pricing · 4da.ai

_{Every screenshot on this page is the current build (main) on a demo machine: five public projects at older pinned releases — ripgrep 12.0.0, Pake 2.3.0, full-stack-fastapi-template 0.8.0, GitHub CLI 2.20.0 and h3 1.12.0 — whose lockfiles come from the conformance corpus. The findings are what 4DA reports for those releases today, against live OSV data.}

It reads npm, pnpm, Yarn, Bun, Cargo, Python and Go lockfiles today, with early support for Ruby and PHP; Maven, Gradle and .NET projects are not covered yet.

What it tells you

Most dependency tools stop at the alert. 4DA carries each finding through to the command.

• Only what is installed. An advisory counts when the exact version in your lockfile falls inside its affected range. Dev-only and transitive copies are labelled, and a Rust crate your build never compiles on this host is marked unreachable instead of urgent.
• The fix, not the alert. Each finding names the smallest release that clears every known advisory on that package, skipping yanked and deprecated releases and any release that pins a still-vulnerable dependency. A new release waits three days before 4DA suggests upgrading to it, so a compromised publish can be caught and pulled first.
• How the fix lands. For a transitive copy, 4DA reads the lockfile edge or the parent's installed manifest to decide whether a lockfile refresh reaches the fix or which direct dependency has to move, and names the command (pnpm update --depth Infinity, npm update, yarn up -R, cargo update --precise). When only semver rules are left to go on, it says so.
• Every project at once. One inventory across every lockfile on the machine. The Upgrade Plan ranks the fixes by how many advisories each one clears.
• Your coding agent asks first. The free MCP server answers "is this version safe to write?" before an agent edits a manifest, and tells it what an upgrade breaks and which of your files import the package.

From the screenshot above: @zag-js/core 0.82.1 has an advisory, but its parent @ark-ui/react 4.9.1 requires a line that excludes the fix, so a lockfile refresh will not reach it. 4DA traces the chain to the direct dependency and says what to do: upgrade @chakra-ui/react to 3.8.2, the smallest release that brings in a fixed copy.

Quick start

For your coding agent — free, Apache-2.0, no account

claude mcp add 4da -- npx @4da/mcp-server     # Claude Code
npx @4da/mcp-server --setup                   # Cursor, VS Code, Windsurf, Claude Desktop, Devin

Needs Node.js 22 or later. It works on its own, with no desktop app, no API key and no account.

... View full README on GitHub