INDIVIDUAL MCP TOOL

get_trust_signals

One-call aggregate of ALL non-CVE supply-chain trust signals: maintainer trust (bus factor, ownership changes), OpenSSF Scorecard, quality (criticality, release velocity, publish security), and SLSA/Sigstore provenance.

depscope.devnone authenticationAvailability not checked

LIVE ENDPOINT

https://mcp.depscope.dev/mcp

No auth detected

Connect to this endpoint to inspect the live schema for get_trust_signals and invoke it with your own arguments.

Indexed input schema

{}

Risk classification

Potential side effects detected · medium confidence · heuristic, not a guarantee.

A tool name or description contains a write-action term.

Parent server

depscope.dev

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.depscope]
url = "https://mcp.depscope.dev/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "depscope": {
      "type": "http",
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: depscope
Remote MCP URL: https://mcp.depscope.dev/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "depscope": {
      "type": "http",
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "depscope",
  "transport": "streamable-http",
  "url": "https://mcp.depscope.dev/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

Related tools

check_malicious — Supply-chain malware check against OpenSSF/OSV.
check_typosquat — Typosquat detector.
check_bulk — Fast pre-flight filter for a batch of (ecosystem, package) pairs.
package_exists — Boolean registry existence check.
get_latest_version — Latest published version + deprecation flag — the cheapest call.
get_health_score — Single 0-100 health score — cheapest go/no-go gate (>=70 safe).
install_command — Canonical install command(s) across every package manager of the ecosystem (npm/pnpm/yarn/bun, pip/uv/poetry, cargo, go, composer, maven+gradle, nuget, …).
get_package_prompt — LLM-optimised package brief — plain text ~300 tokens (~75% cheaper than JSON).