Metadata-Version: 2.3
Name: dep-risk-mcp
Version: 0.1.2
Summary: Analyze the risk of upgrading NPM packages via MCP.
Author: Vineetsu
Author-email: Vineetsu <vineetkumarsu123@gmail.com>
Requires-Dist: mcp[cli]<2
Requires-Dist: tree-sitter>=0.26.0
Requires-Dist: tree-sitter-javascript>=0.25.0
Requires-Python: >=3.12
Description-Content-Type: text/markdown

# Dep-Risk MCP Server (v0.1)

**Hardened, tested, honest about its limits.**

A Model Context Protocol (MCP) server that analyzes the risk of upgrading NPM packages in your codebase. It checks for live security vulnerabilities (CVEs), parses GitHub release notes for breaking changes, and scans your local repo to find exactly where your code will break.

## Accuracy Eval
We run a continuous eval against real-world packages (Express 4->5, React 17->18, Lodash CVE fix).
**Current Catch Rate: 100% (3/3 passed).**

## Privacy Proof
This tool does not send your source code to a third-party server.
We enforce this with a test that blocks all network sockets during the local file scan.
You can verify this by running: `uv run pytest tests/`

## Features
- **Live CVE Checks:** Queries OSV.dev.
- **Breaking Change Parsing:** Parses GitHub releases with prompt-injection protection.
- **AST Code Scanning:** Uses `tree-sitter` (not regex) to find breaking API usages.
- **Graceful Degradation:** Returns `degraded` if APIs are down.
- **Strict Output:** Uses Pydantic Enums (`issues_found`, `no_issues_found_low_confidence`, `degraded`, `unknown`).

## Installation
```bash
uvx dep-risk-mcpx