Not a package manager
It does not install, lock, or resolve packages. It reads the tree you already have and explains what it means.
MCP · npm · deps intelligence
Understand your dependencies.
Deps intelligence for developers and AI coding agents.
Analyze your npm dependency tree for security, freshness, maintenance, weight and transitive impact — directly through MCP.
Project healthanalyzed
74
/ 100
Security
72
Freshness
64
Maintenance
81
Weight
58
Complexity
69
Critical vulnerability in production path
lodash@4.17.20 · GHSA-35jh-r3h4-6jhm
Update first: 14 major versions behind
High impact · 47 dependents in tree
Unnecessarily heavy transitive install
Install size 18.4 MB · consider lighter alternative
MCP configurationcursor · claude · agents
{
"mcpServers": {
"dependency-intelligence": {
"url": "https://depsi.alexdln.com/api/mcp"
}
}
}Positioning
Your dependency tree has a health profile.
This is a layer of intelligence over the dependency tree — not another package manager, scanner, or generic dashboard. Turn dependency noise into decisions.
Not another scanner
Vulnerabilities are one signal among many — freshness, maintenance, weight, and transitive impact shape prioritized action.
Intelligence over the tree
Package intelligence, graph analysis, and health scoring — conversational through MCP with AI coding tools.
Features
Signals that compound into decisions.
Every dimension exists to answer a practical question: what is risky, what is heavy, what is outdated, and what should move first.
01
Package intelligence
npmx-first metadata: versions, deprecations, size, maintainers, provenance, and package identity.
02
Dependency graph analysis
Normalized graph from lockfiles — depth, dependents, reverse impact, and bounded subtree queries.
03
Security intelligence
OSV findings mapped onto the installed tree with production vs. transitive path awareness.
04
Freshness & maintenance
How stale packages are, whether they still ship, and which signals suggest abandonment risk.
05
Weight & transitive impact
Surface heavy installs and the packages whose updates ripple farthest through your tree.
06
Health scoring & priorities
A composite health profile and ordered update recommendations — what to do first, and why.
How it works
Built for conversational workflows.
The primary interaction is natural language through MCP tools — not another dashboard to babysit.
1
Connect via MCP
Point your AI coding client at the Deps Intelligence endpoint. No local daemon to babysit.
2
Pass the project tree
Provide package.json and the lockfile. The server builds a normalized graph of what is actually installed.
3
Ask for decisions
Request health, vulnerabilities, update order, heaviest packages, or deep analysis of a single dependency.
Metrics
A health score with explicit weights.
Health is not a black box. Each dimension contributes a known weight so recommendations stay explainable.
Security
35%
Vulnerabilities, severity, and production exposure.
Freshness
20%
Distance from current releases and publish recency.
Maintenance
20%
Deprecation, activity, and maintainer signals.
Weight
15%
Install size and unnecessarily heavy packages.
Complexity
10%
Dependency fan-out and transitive density.
Interaction
Ask the questions you already ask yourself.
Designed to work naturally with AI coding tools. The interface is conversation; the output is actionable. Package names link to npmx.
Example sessionanalyze_project
Analyze my dependencies.
dependency-intelligenceHealth 74/100 — 6 vulns, 37 outdated, 3 deprecated. Critical path: lodash@4.17.20. Highest leverage update: webpack (47 dependents). Prefer this as the first call before planning updates.
Docs
Connect once. Ask anything about the tree.
Stateless MCP server. Point your client at the endpoint, pass package.json + lockfile, and call the tools.
Tools
Six focused tools. Prefer analyze_project as the first call for any repository.
- analyze_projectProject health overview, findings, and top update priorities.
- find_updatesOrdered update recommendations with risk and impact context.
- plan_dependency_updatesStructured update plan (minimal / moderate / all). Planning only — no installs.
- analyze_dependencyDeep package intelligence for a single name@version.
- get_vulnerabilitiesOSV findings mapped onto the installed dependency tree.
- get_dependency_graphBounded graph slice, rankings, and reverse dependents.
MCP endpoint
Add the server to your MCP client configuration. Stdio-only clients can bridge with mcp-remote.
mcp.json/api/mcp
{
"mcpServers": {
"dependency-intelligence": {
"url": "https://depsi.alexdln.com/api/mcp"
}
}
}Turn dependency noise into decisions.
Connect Deps Intelligence to your coding agent and start with a single prompt: analyze my dependencies.