DepGuard MCP Server

DepGuard is a production MCP server for real-time dependency risk checks while coding.

It checks package updates against:

• OSV vulnerabilities (CVE/GHSA)
• npm package deprecations
• local cache for fast repeated lookups

Status

• Docker image: ghcr.io/foudhilriahi/depguard:latest
• Multi-arch publish: linux/amd64, linux/arm64
• GitHub Pages live proof: https://foudhilriahi.github.io/DepGuard/

---

1) Fastest way to use DepGuard (Docker + MCP)

Add this to your MCP client config:

{
  "mcpServers": {
    "depguard": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "CACHE_TTL_SECONDS=86400",
        "-e",
        "DEPGUARD_CACHE_PATH=/data/cache.sqlite",
        "-v",
        "depguard-cache:/data",
        "ghcr.io/foudhilriahi/depguard:latest"
      ]
    }
  }
}

Restart your AI IDE/CLI after saving config.

Available MCP tools

• check_package
• check_packages_bulk
• scan_package_json
• get_cached_result

---

2) Real online proof (no mocks)

Live proof page

GitHub Pages app in docs/ performs real browser calls to:

• https://api.osv.dev/v1/querybatch
• https://registry.npmjs.org/<package>

CI proof artifact

docs/proof/latest.json is generated by running actual DepGuard core logic in CI:

• workflow: .github/workflows/proof-artifact.yml
• script: scripts/generate-proof.mjs

This is not simulation data.

---

3) How to test Docker image online (without local Docker)

Use GitHub Actions manual workflow:

• Workflow: .github/workflows/docker-smoke.yml
• Trigger: Actions → Docker Smoke Test (GHCR) → Run workflow

It validates:

1. image can be pulled from GHCR
2. manifest inspection works
3. container runtime works (node --version)
4. MCP entrypoint file exists (/app/dist/index.js)

So you can prove your container works even without Docker installed locally.

---

4) GitHub Pages setup

Use workflow-based Pages deploy for consistency:

1. GitHub repo → Settings → Pages
2. Source: GitHub Actions
3. Keep .github/workflows/pages.yml enabled

---

5) Local dev (optional)

npm install
npm run test
npm run build
npm run dev

---

6) Environment variables

• CACHE_TTL_SECONDS (default 86400)
• DEPGUARD_CACHE_PATH (default .depguard-cache.sqlite)
• DEPGUARD_HTTP_TIMEOUT_MS (default 7000)
• DEPGUARD_HTTP_RETRIES (default 2)
• DEPGUARD_HTTP_RETRY_DELAY_MS (default 250)

---

7) CI/CD workflows in this repo

• ci.yml → tests + build
• pages.yml → deploys docs/ to GitHub Pages
• proof-artifact.yml → refreshes real proof JSON
• publish-docker.yml → publishes multi-arch GHCR image
• docker-smoke.yml → manual online container verification