Your AI agent is burning tokens, energy, and security. Here's how I made it stop.

I was reading an Anthropic engineering post this winter that mentioned, almost in passing, that Claude Code's biggest token sink across their fleet is package-related queries. Every "how do I do X in Y", every npm install, every dependency audit. The model fetches the registry JSON, reads it, summarizes for itself, and only THEN answers you.

I started measuring it on my own agent traffic. 74% of the tokens my AI assistant burned on a typical "add this library" turn were the registry payload. Not my prompt. Not the answer. The middleware between them.

That's when I built DepScope MCP. And after six months in production with thousands of agents hitting it daily, I want to share what we've learned — including what's new in v0.9.0 that I shipped this morning.

---

The 3 things every AI install costs you

When your AI agent (Claude Code, Cursor, Windsurf, ChatGPT, whatever) suggests npm install <something>, three invisible costs land on your shoulders:

1. Tokens 🔥

The model needs context. So it goes to npm/PyPI/etc, pulls the package metadata, slurps it into the prompt, and then decides. A typical npm registry response for a moderately popular package is 3-4 KB of JSON the model has to read. Per package. Across a whole package.json audit, you're easily 50,000 tokens deep just on metadata fetches.

2. Energy ⚡

Every install your agent suggests gets executed. If the package is malicious, deprecated, or hallucinated (the model invented a name that looks real), you've just spent CI minutes, downloaded packages, run post-install scripts, only to roll back. Multiply by every dev on your team. Multiply by every CI pipeline. Multiply by every retry.

A study from CMU last year put slopsquatting — installing a hallucinated package that an attacker has registered — at 5.2% of LLM-suggested installs for popular ecosystems. That's 1 in 20.

3. Security 🛡️

Even if the package is real, is the version safe? Is there a CVE in this minor? Is the maintainer compromised this week? Is this version in CISA's Known Exploited Vulnerabilities catalog? Your agent doesn't know. It was trained 6-12 months ago. It's making decisions on stale data.

---

What DepScope MCP actually does

DepScope is a Model Context Protocol server. It exposes 22 tools to your AI agent. Free, zero-auth, public infrastructure. Covers 19 ecosystems: npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Composer, Pub, Hex, Swift, CocoaPods, CPAN, Hackage, CRAN, Conda, Homebrew, JSR, Julia.

Three killer tools you'll use 80% of the time:

• check_malicious — supply-chain malware check (OpenSSF + OSV malicious DB)
• check_typosquat — Levenshtein vs popular packages, with downloads ratio
• check_package — full health report: CVEs (live OSV + CISA KEV + EPSS), license risk, deprecation, alternatives

And one I'm particularly proud of:

• check_bulk — batch up to 100 (ecosystem, package) pairs in one round-trip, sub-100ms. Use this before any npm i a b c or pip install a b c.

---

A real example, end-to-end

Yesterday I asked Claude Code:

"Add axios to my Next.js project."

Here's what actually happened under the hood with DepScope MCP loaded:

[1] Claude → check_malicious(npm, axios)
    ← {"is_malicious": false, "advisory_id": "MAL-2026-2307",
       "summary": "Malicious code in axios (npm)",
       "downloads_weekly": 99409820,
       "note": "Advisory flags this name but 99M+ downloads/week —
                likely false positive. Verify on OSV.dev."}
       (50ms)

[2] Claude → check_typosquat(npm, axios)
    ← {"is_suspected_typosquat": false}
       (20ms)

[3] Claude → check_package(npm, axios)
    ← {"latest_version": "1.16.0",
       "health": {"score": 97, "risk": "low"},
       "vulnerabilities": {"count": 0},
       "license": "MIT",
       "scorecard": {"score": 6.7, "tier": "moderate"},
       "criticality_tier": "critical",
       "malicious": {
         "is_malicious": false,
         "advisory_id": "MAL-2026-2307",
         "affected_versions": ["0.30.4", "1.14.1"],
         "latest_version_safe": true,
         "note": "Versions 0.30.4 and 1.14.1 are compromised.
                  Current latest (1.16.0) is NOT affected — safe to install.
                  Avoid the listed versions."
       }}
       (cached, 2ms)

[4] Claude → install_command(npm, axios)
    ← {"primary": "npm install axios@1.16.0",
       "variants": {"pnpm": "pnpm add axios@1.16.0", ...}}
       (5ms)

Claude's final reply:
"Adding axios@1.16.0 (health 97/100, no known CVEs, MIT license).
 Note: avoid 0.30.4 and 1.14.1 — those versions were compromised.
 Run: npm install axios@1.16.0"

Total time: 77ms. Tokens consumed by tool responses: ~600. Tokens that would have been consumed pulling raw npm JSON + readme: ~3,500.

That's a 5.8× reduction on a single trivial install. Stack 30 of those across an audit and you've saved a session's worth of context.

---

And when the package is actually a typosquat

I asked the same agent:

"Add lodsh for utility functions."

[1] Claude → check_typosquat(npm, lodsh)
    ← {"is_suspected_typosquat": true,
       "targets": [{
         "legitimate_package": "lodash",
         "distance": 1,
         "downloads_suspect": 0,
         "downloads_legit": 146042552,
         "popularity_ratio": 146042552
       }]}

Claude's final reply:
"⚠️ `lodsh` is a likely typosquat of `lodash` (Levenshtein distance 1,
 popularity ratio 146,042,552×). Did you mean `lodash`?"

The install command never fires. The bad package never lands on disk. Your CI never wakes up. That's the energy-saving pillar in action — billions of saved cycles across the ecosystem if every agent does this.

---

What's new in v0.9.0 — Auto-discovery via server.instructions

Until this release, MCP servers had a structural problem: even when installed, they sat dormant unless the user explicitly asked the model to use them. Tools were available, but the model didn't know when to invoke them. So users had to drop manual rule files: CLAUDE.md, .cursorrules, .windsurfrules, etc. — repeating the trigger logic in every project.

v0.9.0 fixes this. The server now sends a system-prompt directive at MCP handshake init. Every Claude Code, Cursor, Windsurf, Cline, Continue, Aider, and Zed session that connects gets this brief automatically:

DepScope: dependency safety & intelligence MCP for AI agents.
Covers 19 package ecosystems.

INVOKE PROACTIVELY — before suggesting any package install,
version bump, lockfile change, or when a 'module not found' error appears.

Three pillars:
- TOKEN-SAVING: one DepScope call replaces a web search + readme fetch.
- ENERGY-SAVING: skip installs of malicious, hallucinated, deprecated pkgs.
- SECURITY: stop supply-chain attacks BEFORE the install command leaves your reply.

Standard flow:
  check_malicious + check_typosquat (gate, ~50ms)
  → check_package or get_health_score (verdict)
  → install_command (safe pinned cmd)

Batch installs: check_bulk in ONE call (≤100 items).
Lockfile change: scan_project.
Version bumps: get_breaking_changes + get_migration_path.
'module not found' errors: resolve_error.
Choosing libraries: find_alternatives + compare_packages.

All tools are read-only, zero-auth, free. Latency 50-300ms per call.

No more rule files needed. Your agent now knows what DepScope is, when to use it, and which tool to pick. From the very first message of the very first session.

---

Setup — pick one (literally one line)

Claude Code (CLI)

claude mcp add depscope --transport http https://mcp.depscope.dev/mcp

Or with the bundled Claude Code plugin (skill + MCP config):

git clone https://github.com/cuttalo/depscope-claude-plugin ~/.claude/plugins/depscope

Claude Desktop / Cursor / Windsurf / Cline / Continue

Add to your MCP config (mcp.json / claude_desktop_config.json / etc.):

{
  "mcpServers": {
    "depscope": {
      "url": "https://mcp.depscope.dev/mcp"
    }
  }
}

That's the remote transport — zero install on your side, the server runs at depscope.dev. If your client doesn't support remote MCP yet, fall back to stdio:

{
  "mcpServers": {
    "depscope": {
      "command": "npx",
      "args": ["-y", "depscope-mcp"]
    }
  }
}

Verify it works

After setup, ask your agent: "add axios to my project". You should see it call check_malicious, check_typosquat, check_package, then propose the pinned install. If it just says "run npm install axios" without any of those calls, the MCP isn't active — restart your client.

---

What the user has to do — and what the agent does for you

This is the part most "AI tooling" articles skip. Real division of labor:

You (the human)	Your AI agent
Install MCP once (1 line)	Calls DepScope on every package decision
Maybe set an X-API-Key for >200 req/min	Reads malicious/typosquat/CVE/health/license/alternatives
Read the verdict	Picks the safest pinned version automatically
Decide when to override (e.g. accept a deprecated pkg knowingly)	Surfaces the trade-off explicitly

That's it. You're not adding a step to your workflow. You're removing several.

---

The environmental angle (skeptics, this part is for you)

Energy/sustainability claims in software are mostly vague hand-waving. Here's what's concrete:

• Avoided CI minutes: every blocked typosquat or malicious install is a CI run that doesn't happen. Average dependency-audit CI run on GitHub Actions: ~3 minutes. Power draw of a typical CI runner: 50W. We've blocked roughly 1,400 confirmed typosquat suggestions in the last 30 days across our public infrastructure. That's ~70 hours of saved CI runtime per month, ~3.5 kWh — comparable to running a fridge for 4 days.
• Avoided model tokens: 74% reduction per package decision × ~30M decisions/month across our user base = ~22 billion tokens not generated. At ~0.001 watt-hour per generated token (rough, public estimates), that's 22 MWh. Equivalent to powering a small office for a month.
• Avoided rollback cycles: when a malicious package gets installed and then yanked, the chain of cleanup (revert commit, redeploy, recompute, regenerate) costs 5-10× the original install. Skipping the install at the source is a step-function efficiency gain.

These numbers are public (dashboard). If you want to verify, the source data is api_usage rows over the last 30 days.

---

Why open source — and where to follow

DepScope MCP is AGPL-3.0. The MCP server is on GitHub: cuttalo/depscope-mcp. The Claude Code plugin lives at cuttalo/depscope-claude-plugin.

The reason it's open: AI agents shouldn't query infrastructure that's gated behind authentication and pricing. The package safety layer of the AI coding ecosystem must stay public — the same way DNS or CRLs do — because the alternative is every agent vendor reinventing it badly.

The release cycle has been weekly. v0.9.0 (today) brings auto-discovery. v0.10.0 (next month) is bringing per-tool latency optimization and a streaming /api/check for incremental decisions during long agent runs.

---

TL;DR

• AI agents waste tokens, energy, and security every time they suggest a package install without a check.
• DepScope MCP gives your agent 22 tools to check first, install second.
• v0.9.0 makes it automatic: agent receives invocation guidance at handshake, no manual rule files.
• Free, zero-auth, public, AGPL.

# Claude Code
claude mcp add depscope --transport http https://mcp.depscope.dev/mcp

# That's it.

Try it on your next install. Ask your agent: "add axios to my project". Watch the tool calls fly by. Tell me what you find.

— Vincenzo

depscope.dev · GitHub · npm: depscope-mcp