Potencia tu agente
La URL propia del publicador. No es un endpoint de PlugMCP.
Host a copy with our keys and logs.
https://dep-diff.digicatalyst.ca/mcpEl botón de Claude de arriba abre Claude con el nombre y la URL ya rellenados. Aún tienes que confirmarlo allí.
claude mcp add --transport http io.github.digicatalyst-systems-dep-diff-mcp https://dep-diff.digicatalyst.ca/mcpRun in a terminal.
{ "mcpServers": { "io.github.digicatalyst-systems-dep-diff-mcp": { "command": "npx", "args": [ "-y", "mcp-remote", "https://dep-diff.digicatalyst.ca/mcp" ] } }}claude_desktop_config.json
¿URL remota o un comando en tu máquina? En qué se diferencian las dos instalaciones
Ejecutar en PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
AbrirDel publicador
MCP server that translates a lockfile diff into a human-readable upgrade plan.
Point your AI assistant (Cursor, Claude Desktop, Claude Code) at a Dependabot PR, npm outdated output, or any pair of package versions, and get back a ranked upgrade plan: semver class, breaking changes pulled from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear recommendation per package.
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
Ask your assistant, in plain language:
Is it safe to bump lodash from 4.17.20 to 4.17.21?
It calls analyze_package_change and gets back:
{
"package": "lodash",
"ecosystem": "npm",
"fromVersion": "4.17.20",
"toVersion": "4.17.21",
"semverClass": "patch",
"repoUrl": "https://github.com/lodash/lodash",
"releaseCount": 0,
"breakingChanges": [],
"securityFixes": [
{
"id": "GHSA-29mw-wpgm-hmr9",
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
"severity": "MODERATE"
},
{
"id": "GHSA-35jh-r3h4-6jhm",
"summary": "Command Injection in lodash",
"severity": "HIGH"
}
],
"migrationLinks": [],
"recommendation": "RECOMMENDED: 2 security fix(es) (incl. high/critical).",
"recommendationLevel": "security"
}
A patch bump you would normally merge without looking. It closes a HIGH-severity command injection. That is the case this server exists for.
Dependabot opens more actions/* pull requests than almost anything else, and its
scheduled version updates carry no advisory data. Ask:
Is it safe to bump tj-actions/changed-files from 45.0.7 to 46.0.1?
{
"package": "tj-actions/changed-files",
"ecosystem": "github-actions",
"semverClass": "major",
"repoUrl": "https://github.com/tj-actions/changed-files",
"securityFixes": [
{
"id": "GHSA-mrrh-fwg8-r2c3",
"summary": "tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets",
"severity": "HIGH"
}
],
"recommendation": "RECOMMENDED: 1 security fix(es) (incl. high/critical).",
"recommendationLevel": "security"
}
Here's my Dependabot PR — what's actually risky in it?
analyze_packages_bulk takes up to 50 changes at once and ranks them
security > caution > review > likely-safe > safe:
{
"totalPackages": 5,
"bySemverClass": { "major": 1, "minor": 3, "patch": 1 },
"securityFixesTotal": 7,
"packagesWithBreakingChanges": 1,
"packages": [ /* one entry per package, same shape as above */ ]
}
Condensing the recommendation field of each entry, that batch comes back in this order:
Note the ordering: the patch bump outranks the major one. Semver tells you how much
changed; it does not tell you what is urgent.
Every response above is real output from the hosted instance, trimmed only where marked.
One command, user scope (available in every project):
claude mcp add -s user dep-diff -- npx -y @digicatalyst/dep-diff-mcp
Project scope (writes .mcp.json at repo root, team-shared):
claude mcp add -s project dep-diff -- npx -y @digicatalyst/dep-diff-mcp
With an explicit token (skip this if you have the gh CLI authenticated — see GitHub token below):
claude mcp add -s user --env GITHUB_TOKEN=ghp_xxx dep-diff -- npx -y @digicatalyst/dep-diff-mcp
Verify:
claude mcp list
Restart the Claude Code session to pick up the server.
Add to your MCP client config:
~/.cursor/mcp.json~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows){
"mcpServers": {
"dep-diff": {
"command": "npx",
"args": ["-y", "@digicatalyst/dep-diff-mcp"]
}
}
}
Restart your MCP client. Ask something like "what's risky in this Dependabot PR?" and the tools are invoked automatically.
A hosted instance runs at https://dep-diff.digicatalyst.ca/mcp over streamable HTTP, so you can skip the npm package entirely:
claude mcp add -s user -t http dep-diff https://dep-diff.digicatalyst.ca/mcp
Or in a client config:
{
"mcpServers": {
"dep-diff": {
"type": "http",
"url": "https://dep-diff.digicatalyst.ca/mcp"
}
}
}
The hosted instance authenticates to GitHub with its own token, so release-note lookups work at full rate limits without you configuring anything. Pass ?githubToken=ghp_xxx on the URL only if you would rather requests counted against your own GitHub quota. It is stateless and keeps no logs of your queries — see PRIVACY.md. Run the npm package locally instead if you would rather your token never leave your machine.
The same instance is also listed on Smithery, which proxies to it through their gateway.
The server hits the GitHub API to read release notes. Without a token you get 60 requests per hour (GitHub's anonymous limit) — enough for occasional single-package queries, not enough for bulk lockfile analysis.
The server resolves a token in this order:
GITHUB_TOKEN environment variable, if set.gh auth token — if the GitHub CLI is installed and authenticated, the server uses that token automatically. No config change needed.gh CLIIf you already have gh installed (brew install gh && gh auth login), stop here — the server picks up your existing auth. No plaintext token anywhere.
Create a fine-grained token at https://github.com/settings/tokens:
dep-diff-mcpPublic Repositories (read-only) — no private repo accessrepo, workflow, user, or any write scopeThen reference it in the MCP config:
{
"mcpServers": {
"dep-diff": {
"command": "npx",
"args": ["-y", "@digicatalyst/dep-diff-mcp"],
"env": { "GITHUB_TOKEN": "github_pat_xxx" }
}
}
}
chmod 600) and do not paste the token into AI chats, issues, or shared screens — transcripts are often retained.analyze_package_changeAnalyze one package upgrade. Inputs: ecosystem (npm, pypi, or github-actions), name, fromVersion, toVersion.
analyze_packages_bulkAnalyze up to 50 package upgrades in parallel. Returns packages ranked by risk (security > caution > review > likely-safe > safe), plus summary counts.
fromVersion but resolved at toVersion (via OSV.dev)Both tools return this twice: as the JSON text block shown above, and as MCP
structured content
validated against a declared outputSchema. A client that supports structured output can read
recommendationLevel or securityFixes[] straight off the response instead of re-parsing the text.
Clients that don't are unaffected — the text block is unchanged.
actions/checkout, or a nested github/codeql-action/init). An action reference is already a repository coordinate, so release notes and breaking changes resolve without a registry lookup, and bare major tags such as 4 -> 5 classify correctly.npm install
npm run build
GITHUB_TOKEN=ghp_xxx npm run inspect # MCP Inspector
MIT
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
{ "mcpServers": { "io.github.digicatalyst-systems-dep-diff-mcp": { "url": "https://dep-diff.digicatalyst.ca/mcp", "headers": {} } }}Herramientas
Aún no hay lista de herramientas. Los servidores remotos la reciben tras la primera comprobación de estado.
Preguntas frecuentes
Copia en esta página la configuración http para Cursor, Claude Desktop, Claude Code o VS Code. Usa la instalación del publicador, no un proxy de PlugMCP.
Este registro no indica ninguna variable de entorno obligatoria.
Se accede a Dep Diff por HTTP.
Última comprobación: 2026-11-09. Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.