Getting Started with DepCheck

📄 Prefer offline? Download this guide as a PDF.

DepCheck is a hosted MCP server. You connect your AI client to it once, and from then on the client's agent can call the dependency-check tools whenever it needs them.

There are two ways to run it:

1. Hosted (recommended) — connect to https://mcp.cert-ix.com/depcheck over the network. Nothing to install; always up to date.
2. Local (stdio) — run the vuln-mcp binary next to your agent for a fully offline, filesystem-aware setup.

Prerequisites

• An MCP-capable client: Claude Code, Claude Desktop, Cursor, VS Code (with an MCP extension), or any client that speaks streamable-HTTP MCP.
• A DepCheck API key. Request one from your Cert-IX account team; it is sent as a Bearer token on every request. Treat it like a password — see Security & data handling.

info

The hosted endpoint requires an API key. Requests without a valid Authorization: Bearer <key> header are rejected with 401.

Option 1 — Hosted endpoint

Claude Code (CLI)

Add the server with the claude mcp command:

claude mcp add --transport http depcheck https://mcp.cert-ix.com/depcheck \
  --header "Authorization: Bearer YOUR_API_KEY"

Verify it registered and the tools are visible:

claude mcp list

You should see depcheck with five tools: check_package, scan_dependencies, suggest_safe_version, get_advisory, and get_cve_intel.

Claude Desktop / Cursor / generic MCP client

Add an entry to your client's MCP configuration. Most clients accept a streamable-HTTP server block like this:

{
  "mcpServers": {
    "depcheck": {
      "type": "http",
      "url": "https://mcp.cert-ix.com/depcheck",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Restart the client after saving. The exact file location varies by client (Claude Desktop uses claude_desktop_config.json; Cursor uses its MCP settings panel) — the server block above is the part that matters.

Sanity check with curl

The endpoint is a standard MCP server, so you can confirm reachability and auth with a raw initialize call:

curl -sS https://mcp.cert-ix.com/depcheck \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2025-06-18",
                 "capabilities":{},
                 "clientInfo":{"name":"curl","version":"1.0"}}}'

A 200 with a JSON-RPC result means auth and connectivity are good. A 401 means the key is missing or wrong; a 429 means you have hit the rate limit (see Security & data handling).

Option 2 — Local (stdio)

For air-gapped work, or when you want the agent to read manifests straight off disk, run the server locally over stdio. In this mode scan_dependencies accepts a file path (manifest_path) in addition to inline content.

{
  "mcpServers": {
    "depcheck": {
      "command": "vuln-mcp",
      "env": {
        "VULN_MCP_SOURCE": "es-then-osv"
      }
    }
  }
}

Hosted vs local: one difference in scan_dependencies

The hosted server has no access to your filesystem, so its scan_dependencies tool takes the manifest text (manifest_content + manifest_name) — your agent reads the file and passes the contents. The local stdio server also accepts a manifest_path. Everything else is identical.

First call

Once connected, ask your agent something like:

"Before we add it, is [email protected] safe? If not, what's the newest clean version?"

The agent will call check_package(ecosystem="npm", name="express", version="4.17.1") and, if there are advisories, suggest_safe_version — and tell you which version to use. That is the whole point: the check happens before the dependency lands in your manifest.

Continue to the Tools reference for the full parameter set of each tool, or Agent workflows for the check-before-you-add discipline.