接入你的智能体
發布者自己的 URL。不是 PlugMCP 端點。
用我們的金鑰與日誌託管一份副本。
https://dep-diff.digicatalyst.ca/mcp上方的 Claude 按鈕會開啟 Claude，並填好名稱和 URL。你仍需在那裡確認。
claude mcp add --transport http io.github.digicatalyst-systems-dep-diff-mcp https://dep-diff.digicatalyst.ca/mcpRun in a terminal.
{ "mcpServers": { "io.github.digicatalyst-systems-dep-diff-mcp": { "command": "npx", "args": [ "-y", "mcp-remote", "https://dep-diff.digicatalyst.ca/mcp" ] } }}claude_desktop_config.json
遠端 URL 還是本機指令？ 兩種安裝方式的差異
來自發布者
MCP server that translates a lockfile diff into a human-readable upgrade plan.
Point your AI assistant (Cursor, Claude Desktop, Claude Code) at a Dependabot PR, npm outdated output, or any pair of package versions, and get back a ranked upgrade plan: semver class, breaking changes pulled from GitHub release notes, CVEs fixed in the range, migration guide links, and a clear recommendation per package.
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
Ask your assistant, in plain language:
Is it safe to bump lodash from 4.17.20 to 4.17.21?
It calls analyze_package_change and gets back:
{
"package": "lodash",
"ecosystem": "npm",
"fromVersion": "4.17.20",
"toVersion": "4.17.21",
"semverClass": "patch",
"repoUrl": "https://github.com/lodash/lodash",
"releaseCount": 0,
"breakingChanges": [],
"securityFixes": [
{
"id": "GHSA-29mw-wpgm-hmr9",
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
"severity": "MODERATE"
},
{
"id": "GHSA-35jh-r3h4-6jhm",
"summary": "Command Injection in lodash",
"severity": "HIGH"
}
],
"migrationLinks": [],
"recommendation": "RECOMMENDED: 2 security fix(es) (incl. high/critical).",
"recommendationLevel": "security"
}
A patch bump you would normally merge without looking. It closes a HIGH-severity command injection. That is the case this server exists for.
Dependabot opens more actions/* pull requests than almost anything else, and its
scheduled version updates carry no advisory data. Ask:
Is it safe to bump tj-actions/changed-files from 45.0.7 to 46.0.1?
{
"package": "tj-actions/changed-files",
"ecosystem": "github-actions",
"semverClass": "major",
"repoUrl": "https://github.com/tj-actions/changed-files",
"securityFixes": [
{
"id": "GHSA-mrrh-fwg8-r2c3",
"summary": "tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets",
"severity": "HIGH"
}
],
"recommendation": "RECOMMENDED: 1 security fix(es) (incl. high/critical).",
"recommendationLevel": "security"
}
Here's my Dependabot PR — what's actually risky in it?
analyze_packages_bulk takes up to 50 changes at once and ranks them
security > caution > review > likely-safe > safe:
{
"totalPackages": 5,
"bySemverClass": { "major": 1, "minor": 3, "patch": 1 },
"securityFixesTotal": 7,
"packagesWithBreakingChanges": 1,
"packages": [ /* one entry per package, same shape as above */ ]
}
Condensing the recommendation field of each entry, that batch comes back in this order:
Note the ordering: the patch bump outranks the major one. Semver tells you how much
changed; it does not tell you what is urgent.
Every response above is real output from the hosted instance, trimmed only where marked.
One command, user scope (available in every project):
claude mcp add -s user dep-diff -- npx -y @digicatalyst/dep-diff-mcp
Project scope (writes .mcp.json at repo root, team-shared):
claude mcp add -s project dep-diff -- npx -y @digicatalyst/dep-diff-mcp
With an explicit token (skip this if you have the gh CLI authenticated — see GitHub token below):
claude mcp add -s user --env GITHUB_TOKEN=ghp_xxx dep-diff -- npx -y @digicatalyst/dep-diff-mcp
Verify:
claude mcp list
Restart the Claude Code session to pick up the server.
Add to your MCP client config:
~/.cursor/mcp.json~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows){
"mcpServers": {
"dep-diff": {
"command": "npx",
"args": ["-y", "@digicatalyst/dep-diff-mcp"]
}
}
}
Restart your MCP client. Ask something like "what's risky in this Dependabot PR?" and the tools are invoked automatically.
A hosted instance runs at https://dep-diff.digicatalyst.ca/mcp over streamable HTTP, so you can skip the npm package entirely:
claude mcp add -s user -t http dep-diff https://dep-diff.digicatalyst.ca/mcp
Or in a client config:
{
"mcpServers": {
"dep-diff": {
"type": "http",
"url": "https://dep-diff.digicatalyst.ca/mcp"
}
}
}
The hosted instance authenticates to GitHub with its own token, so release-note lookups work at full rate limits without you configuring anything. Pass ?githubToken=ghp_xxx on the URL only if you would rather requests counted against your own GitHub quota. It is stateless and keeps no logs of your queries — see PRIVACY.md. Run the npm package locally instead if you would rather your token never leave your machine.
The same instance is also listed on Smithery, which proxies to it through their gateway.
The server hits the GitHub API to read release notes. Without a token you get 60 requests per hour (GitHub's anonymous limit) — enough for occasional single-package queries, not enough for bulk lockfile analysis.
The server resolves a token in this order:
GITHUB_TOKEN environment variable, if set.gh auth token — if the GitHub CLI is installed and authenticated, the server uses that token automatically. No config change needed.gh CLIIf you already have gh installed (brew install gh && gh auth login), stop here — the server picks up your existing auth. No plaintext token anywhere.
Create a fine-grained token at https://github.com/settings/tokens:
dep-diff-mcpPublic Repositories (read-only) — no private repo accessrepo, workflow, user, or any write scopeThen reference it in the MCP config:
{
"mcpServers": {
"dep-diff": {
"command": "npx",
"args": ["-y", "@digicatalyst/dep-diff-mcp"],
"env": { "GITHUB_TOKEN": "github_pat_xxx" }
}
}
}
chmod 600) and do not paste the token into AI chats, issues, or shared screens — transcripts are often retained.analyze_package_changeAnalyze one package upgrade. Inputs: ecosystem (npm, pypi, or github-actions), name, fromVersion, toVersion.
analyze_packages_bulkAnalyze up to 50 package upgrades in parallel. Returns packages ranked by risk (security > caution > review > likely-safe > safe), plus summary counts.
fromVersion but resolved at toVersion (via OSV.dev)Both tools return this twice: as the JSON text block shown above, and as MCP
structured content
validated against a declared outputSchema. A client that supports structured output can read
recommendationLevel or securityFixes[] straight off the response instead of re-parsing the text.
Clients that don't are unaffected — the text block is unchanged.
actions/checkout, or a nested github/codeql-action/init). An action reference is already a repository coordinate, so release notes and breaking changes resolve without a registry lookup, and bare major tags such as 4 -> 5 classify correctly.npm install
npm run build
GITHUB_TOKEN=ghp_xxx npm run inspect # MCP Inspector
MIT
Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.
{ "mcpServers": { "io.github.digicatalyst-systems-dep-diff-mcp": { "url": "https://dep-diff.digicatalyst.ca/mcp", "headers": {} } }}工具
尚無工具清單。遠端伺服器會在首次健康檢查後取得工具清單。
常見問題
在本頁複製適用於 Cursor、Claude Desktop、Claude Code 或 VS Code 的 http 設定。它使用發布者的安裝方式，而不是 PlugMCP 代理伺服器。
這筆記錄未列出必要的環境變數。
Dep Diff 透過 HTTP 存取。
上次檢查時間：2026-11-09。 Translates a lockfile diff into a human-readable upgrade plan for npm, PyPI, and GitHub Actions.