# Dependency Health MCP

> Package alive? Verdict with evidence: deprecated, archived, stale or active; plus runtime EOL dates. Remote MCP server over Streamable HTTP at `https://dephealth.dsh.sh/mcp`. Free, no API key. Tools: `package_health`, `deps_audit`, `runtime_eol`. The tool list is fixed per version.

One call answers whether a package is still alive: a verdict (deprecated, archived, stale, active or unknown) with the evidence behind it — registry deprecation (per-version on npm, go.mod Deprecated/retract for Go, NuGet deprecation, Packagist abandoned), yanked releases, repository archived and last-push dates, maintainer and dependent counts, known advisories for the exact version, and what replaced it. Covers npm, PyPI, crates.io, RubyGems, Go modules, Maven, NuGet and Packagist through ecosyste.ms, the native registries and deps.dev, all keyless. deps_audit takes a whole package.json or requirements.txt (up to 25 packages) and runtime_eol reports endoflife.date support and EOL dates for runtimes and OSes. Free, no key, no account; every response lists the upstream calls it made.

Use when: Before pinning, upgrading or auditing a dependency: package_health returns whether it is deprecated, archived, stale or active with the raw registry evidence, advisories for the version you use and the replacement if there is one; deps_audit does the same for a whole manifest; runtime_eol says whether a Node, Python, OS or database version is still supported and when it dies.

Not for: Not a vulnerability scanner (advisory ids only, no CVSS triage or reachability), not license compliance, not a popularity ranking, and it cannot see private registries or vendored code.

Quick install (Claude Code): `claude mcp add --transport http dephealth https://dephealth.dsh.sh/mcp -s user`

## Docs

- [Full reference](https://dephealth.dsh.sh/llms-full.txt): every tool with its JSON input schema and an example
- [Install for any client](https://dephealth.dsh.sh/install): Claude Code, Cursor, VS Code, Claude Desktop, ChatGPT, Codex, Gemini CLI, Windsurf, Cline, Continue, Zed
- [OpenAPI twin](https://dephealth.dsh.sh/openapi.json): the same tools as plain HTTP POST endpoints
- [Registry server.json](https://dephealth.dsh.sh/.well-known/mcp/server.json): machine-readable server record

## Upstreams

- [ecosyste.ms packages API](https://packages.ecosyste.ms/api/v1): keyless
- [deps.dev v3](https://api.deps.dev/v3): keyless
- [npm registry](https://registry.npmjs.org): keyless
- [PyPI JSON API](https://pypi.org/pypi): keyless
- [crates.io API](https://crates.io/api/v1): keyless
- [RubyGems API](https://rubygems.org/api/v1): keyless
- [Go module proxy](https://proxy.golang.org): keyless
- [NuGet registration index](https://api.nuget.org/v3): keyless
- [Packagist p2](https://repo.packagist.org/p2): keyless
- [GitHub REST (fallback only)](https://api.github.com): keyless
- [endoflife.date API](https://endoflife.date/api): keyless

## Optional

- [Health](https://dephealth.dsh.sh/healthz): liveness JSON
- [Owner](https://agie.sh): agie