Koskamo

dep-diff MCP

An MCP server that analyzes dependency lockfile diffs and changelogs to identify risky upgrades, providing human-readable upgrade plans for npm, PyPI, and GitHub Actions while assessing security risks and semver changes.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

dep-diff MCP logo, by DigiCatalyst-SystemsCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-06Published by DigiCatalyst-Systems
MCP endpoint (Streamable HTTP)
https://dep-diff.digicatalyst.ca/mcp
Vendor documentation

What its tools do

2 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Read-only (2)

2 of 2 have a description · 2 of 2 declare behavior hints · 2 of 2 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Identify risky changes in dependency upgrades
  • Generate human-readable upgrade plans for npm and PyPI
  • Analyze GitHub Actions dependency changes
  • Assess security risks in Dependabot PRs

Source and maintenance

Community listingRegistry 0.3.3
mcp-registry: io.github.DigiCatalyst-Systems/dep-diff-mcp@0.3.3Source repository
Maintenance checked

Protocol and capabilities

Server
dep-diff 0.3.3
MCP protocol negotiated in check
2025-11-25
Tools
2 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
2 advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  },
  "prompts": {
    "listChanged": true
  }
}

Tools

2 advertised

analyze_package_change — Analyze a single dependency version change
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Given one package and two versions (from -> to), returns a structured upgrade analysis: semver classification, GitHub release notes summary, detected breaking changes, security advisories fixed in the range, migration guide links, and a clear recommendation. Use when the user asks about a specific package upgrade ('what changed between react 18 and 19', 'is it safe to bump axios from 0.27 to 1.0', 'what does upgrading lodash 4.17.20 to 4.17.21 fix'). Supports npm, pypi, and github-actions (use the action reference as the name, e.g. actions/checkout). For analyzing many packages at once or a Dependabot batch, use analyze_packages_bulk instead.

analyze_package_change input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ecosystem",
    "name",
    "fromVersion",
    "toVersion"
  ],
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "description": "Package name (e.g. 'react', 'requests')"
    },
    "ecosystem": {
      "enum": [
        "npm",
        "pypi",
        "github-actions"
      ],
      "type": "string",
      "description": "Package ecosystem"
    },
    "toVersion": {
      "type": "string",
      "minLength": 1,
      "description": "Target version (e.g. '19.0.0')"
    },
    "fromVersion": {
      "type": "string",
      "minLength": 1,
      "description": "Current version (e.g. '18.2.0')"
    }
  }
}
analyze_package_change output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "package",
    "ecosystem",
    "fromVersion",
    "toVersion",
    "semverClass",
    "repoUrl",
    "releaseCount",
    "breakingChanges",
    "securityFixes",
    "migrationLinks",
    "recommendation",
    "recommendationLevel"
  ],
  "properties": {
    "package": {
      "type": "string",
      "description": "Package name that was analyzed"
    },
    "repoUrl": {
      "type": [
        "string",
        "null"
      ],
      "description": "Source repository URL, or null when none could be resolved"
    },
    "ecosystem": {
      "enum": [
        "npm",
        "pypi",
        "github-actions"
      ],
      "type": "string",
      "description": "Package ecosystem"
    },
    "toVersion": {
      "type": "string",
      "description": "Version being upgraded to"
    },
    "fromVersion": {
      "type": "string",
      "description": "Version being upgraded from"
    },
    "semverClass": {
      "enum": [
        "major",
        "minor",
        "patch",
        "downgrade",
        "unknown"
      ],
      "type": "string",
      "description": "Semver relationship between the two versions"
    },
    "releaseCount": {
      "type": "number",
      "description": "Number of GitHub releases found strictly between the two versions"
    },
    "securityFixes": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "summary",
          "severity"
        ],
        "properties": {
          "id": {
            "type": "string",
            "description": "Advisory identifier (e.g. 'GHSA-29mw-wpgm-hmr9' or a CVE)"
          },
          "summary": {
            "type": "string",
            "description": "One-line description of the advisory"
          },
          "severity": {
            "type": "string",
            "description": "Severity as reported by OSV (e.g. 'LOW', 'MODERATE', 'HIGH', 'CRITICAL')"
          }
        },
        "additionalProperties": false
      },
      "description": "Advisories affecting fromVersion that are resolved at toVersion"
    },
    "migrationLinks": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Migration or upgrade guide URLs found in release notes"
    },
    "recommendation": {
      "type": "string",
      "description": "Single-line verdict explaining the recommendation level"
    },
    "breakingChanges": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Breaking changes extracted from release notes; empty when none were found"
    },
    "releaseExcerpts": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "tag",
          "excerpt"
        ],
        "properties": {
          "tag": {
            "type": "string",
            "description": "Release tag the excerpt came from"
          },
          "excerpt": {
            "type": "string",
            "description": "Short excerpt of the release notes"
          }
        },
        "additionalProperties": false
      },
      "description": "Raw release-note excerpts, present only as a fallback when a major/minor bump yielded no breaking changes"
    },
    "recommendationLevel": {
      "enum": [
        "safe",
        "likely-safe",
        "review",
        "caution",
        "security"
      ],
      "type": "string",
      "description": "Risk classification, used to rank packages in bulk results"
    }
  },
  "additionalProperties": false
}
analyze_package_change annotations
{
  "title": "Analyze a single dependency version change",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
analyze_packages_bulk — Analyze multiple dependency changes in parallel
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Analyzes a list of package upgrades in parallel and returns a unified risk report with packages ranked by recommendation level (security > caution > review > likely-safe > safe). Use when the user provides many dependency changes from a Dependabot PR, npm outdated output, lockfile diff, or batch upgrade. Returns: total count, breakdown by semver class, total security fixes found, packages with breaking changes, and per-package details. Limit 50 packages per call (chunk larger lists).

analyze_packages_bulk input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "changes"
  ],
  "properties": {
    "changes": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "ecosystem",
          "name",
          "fromVersion",
          "toVersion"
        ],
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1
          },
          "ecosystem": {
            "enum": [
              "npm",
              "pypi",
              "github-actions"
            ],
            "type": "string",
            "description": "Package ecosystem"
          },
          "toVersion": {
            "type": "string",
            "minLength": 1
          },
          "fromVersion": {
            "type": "string",
            "minLength": 1
          }
        }
      },
      "maxItems": 50,
      "minItems": 1,
      "description": "List of package changes to analyze"
    }
  }
}
analyze_packages_bulk output schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "totalPackages",
    "bySemverClass",
    "securityFixesTotal",
    "packagesWithBreakingChanges",
    "packages"
  ],
  "properties": {
    "packages": {
      "type": "array",
      "items": {
        "anyOf": [
          {
            "type": "object",
            "required": [
              "package",
              "ecosystem",
              "fromVersion",
              "toVersion",
              "semverClass",
              "repoUrl",
              "releaseCount",
              "breakingChanges",
              "securityFixes",
              "migrationLinks",
              "recommendation",
              "recommendationLevel"
            ],
            "properties": {
              "package": {
                "type": "string",
                "description": "Package name that was analyzed"
              },
              "repoUrl": {
                "type": [
                  "string",
                  "null"
                ],
                "description": "Source repository URL, or null when none could be resolved"
              },
              "ecosystem": {
                "enum": [
                  "npm",
                  "pypi",
                  "github-actions"
                ],
                "type": "string",
                "description": "Package ecosystem"
              },
              "toVersion": {
                "type": "string",
                "description": "Version being upgraded to"
              },
              "fromVersion": {
                "type": "string",
                "description": "Version being upgraded from"
              },
              "semverClass": {
                "enum": [
                  "major",
                  "minor",
                  "patch",
                  "downgrade",
                  "unknown"
                ],
                "type": "string",
                "description": "Semver relationship between the two versions"
              },
              "releaseCount": {
                "type": "number",
                "description": "Number of GitHub releases found strictly between the two versions"
              },
              "securityFixes": {
                "type": "array",
                "items": {
                  "type": "object",
                  "required": [
                    "id",
                    "summary",
                    "severity"
                  ],
                  "properties": {
                    "id": {
                      "type": "string",
                      "description": "Advisory identifier (e.g. 'GHSA-29mw-wpgm-hmr9' or a CVE)"
                    },
                    "summary": {
                      "type": "string",
                      "description": "One-line description of the advisory"
                    },
                    "severity": {
                      "type": "string",
                      "description": "Severity as reported by OSV (e.g. 'LOW', 'MODERATE', 'HIGH', 'CRITICAL')"
                    }
                  },
                  "additionalProperties": false
                },
                "description": "Advisories affecting fromVersion that are resolved at toVersion"
              },
              "migrationLinks": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "Migration or upgrade guide URLs found in release notes"
              },
              "recommendation": {
                "type": "string",
                "description": "Single-line verdict explaining the recommendation level"
              },
              "breakingChanges": {
                "type": "array",
                "items": {
                  "type": "string"
                },
                "description": "Breaking changes extracted from release notes; empty when none were found"
              },
              "releaseExcerpts": {
                "type": "array",
                "items": {
                  "type": "object",
                  "required": [
                    "tag",
                    "excerpt"
                  ],
                  "properties": {
                    "tag": {
                      "type": "string",
                      "description": "Release tag the excerpt came from"
                    },
                    "excerpt": {
                      "type": "string",
                      "description": "Short excerpt of the release notes"
                    }
                  },
                  "additionalProperties": false
                },
                "description": "Raw release-note excerpts, present only as a fallback when a major/minor bump yielded no breaking changes"
              },
              "recommendationLevel": {
                "enum": [
                  "safe",
                  "likely-safe",
                  "review",
                  "caution",
                  "security"
                ],
                "type": "string",
                "description": "Risk classification, used to rank packages in bulk results"
              }
            },
            "additionalProperties": false
          },
          {
            "type": "object",
            "required": [
              "package",
              "error",
              "recommendationLevel"
            ],
            "properties": {
              "error": {
                "type": "string",
                "description": "Why the analysis could not be completed"
              },
              "package": {
                "type": "string",
                "description": "Package name whose analysis failed"
              },
              "recommendationLevel": {
                "type": "string",
                "const": "review",
                "description": "Always 'review' — a package that could not be analyzed cannot be cleared automatically"
              }
            },
            "additionalProperties": false
          }
        ]
      },
      "description": "Per-package results, ranked security > caution > review > likely-safe > safe"
    },
    "bySemverClass": {
      "type": "object",
      "required": [
        "major",
        "minor",
        "patch"
      ],
      "properties": {
        "major": {
          "type": "number",
          "description": "Count of major bumps"
        },
        "minor": {
          "type": "number",
          "description": "Count of minor bumps"
        },
        "patch": {
          "type": "number",
          "description": "Count of patch bumps"
        }
      },
      "description": "Breakdown of the batch by semver class",
      "additionalProperties": false
    },
    "totalPackages": {
      "type": "number",
      "description": "Number of package changes submitted"
    },
    "securityFixesTotal": {
      "type": "number",
      "description": "Total security advisories resolved across the whole batch"
    },
    "packagesWithBreakingChanges": {
      "type": "number",
      "description": "How many packages had at least one breaking change"
    }
  },
  "additionalProperties": false
}
analyze_packages_bulk annotations
{
  "title": "Analyze multiple dependency changes in parallel",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

2 advertised

review_dependabot_pr — Review a Dependabot or batch upgrade PR

Advertised by the server during the last successful anonymous check.

Generates a user message instructing the model to analyze a list of dependency changes, then call analyze_packages_bulk to produce a ranked risk report.

ecosystem
Package ecosystem (required)
changes
Raw list of changes, one per line, formatted as 'name from_version -> to_version'. Example: lodash 4.17.20 -> 4.17.21 axios 0.27.0 -> 1.7.0 (required)
explain_package_upgrade — Explain a single package upgrade

Advertised by the server during the last successful anonymous check.

Generates a user message asking the model to analyze a specific package version bump and explain the risk.

ecosystem
Package ecosystem (required)
name
Package name (required)
fromVersion
Current version (required)
toVersion
Target version (required)

Resources

Not advertised

No resource definitions available.

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (5 of 5 answered).

  1. 2026-11-07: 2 of 2 checks answered
  2. 2026-11-09: 1 of 1 checks answered
  3. 2026-11-10: 2 of 2 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
531 ms
95th percentile latency
531 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 531 ms · metadata changed · 2 tool(s), 2 prompt(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http dep-diff-mcp-digicatalyst https://dep-diff.digicatalyst.ca/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add dep-diff-mcp-digicatalyst --url https://dep-diff.digicatalyst.ca/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable dep-diff-mcp-digicatalyst in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "dep-diff-mcp-digicatalyst": {
      "url": "https://dep-diff.digicatalyst.ca/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "dep-diff-mcp-digicatalyst": {
      "type": "streamableHttp",
      "url": "https://dep-diff.digicatalyst.ca/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start dep-diff-mcp-digicatalyst and inspect its tools.
VS Code configuration
{
  "servers": {
    "dep-diff-mcp-digicatalyst": {
      "type": "http",
      "url": "https://dep-diff.digicatalyst.ca/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http dep-diff-mcp-digicatalyst https://dep-diff.digicatalyst.ca/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://dep-diff.digicatalyst.ca/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "dep-diff-mcp-digicatalyst": {
      "serverUrl": "https://dep-diff.digicatalyst.ca/mcp"
    }
  }
}

Let your agent find its tools

Find servers like dep-diff MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 9,448