O
orcsnren/pkg-health-mcp
Is this dependency still maintained? MCP server, CLI and GitHub Action that score npm packages, PyPI packages and GitHub repos 0–100 for maintenance health, with an A–F grade and plain-language risks. Works with Claude, Cursor and VS Code.
SECURITY.md ✓
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
- Copy the command above
- Paste it as one entry under
mcpServersinclaude_desktop_config.json— local servers take command + args (example: clients) - Restart your client
Client config (built from the install command this repo gives)
{
"mcpServers": {
"orcsnren-pkg-health-mcp": {
"command": "npx",
"args": ["-y", "pkg-health-mcp"]
}
}
}Parsed from the README we fetched on 2026-10-26; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"orcsnren-pkg-health-mcp": {
"command": "npx",
"args": ["-y", "pkg-health-mcp"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio orcsnren-pkg-health-mcp -- npx -y pkg-health-mcp
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 1 ★ · orcsnren/pkg-health-mcp · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- collected from the punkpeye/awesome-mcp-servers list · type: MCP server
- Harvest history
- first seen 2026-10-23 · last seen 2026-11-14 · seen 26× · listed by 23 sources
- Score
- score 2,300 · 1 ★ · 23 sources · mcp
- Install
npx -y pkg-health-mcp
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx -y pkg-health-mcp. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
orcsnren/pkg-health-mcp；first catalogued 2026-10-23；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# pkg-health-mcp
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Is this dependency still maintained? Find out before you install it.
pkg-health-mcp scores npm packages, PyPI packages and GitHub repositories from 0 to 100 for maintenance health. It combines release and commit activity, active maintainers, issue response times, download trends, OpenSSF Scorecard and license into an A–F grade and a plain-language list of risks.
Use it three ways, all built on the same engine:
MCP server for Claude Code, Claude Desktop, Cursor, VS Code and any other MCP client, so your AI agent checks a package before it suggests one.
CLI to audit a manifest or lock file, including transitive dependencies.
GitHub Action to add a health report to every pull request and fail the build below a threshold.
console
$ npx -y pkg-health-mcp scan package.json
F 10/100 request@2.88.2 [npm]
10 Recent activity last release 2444d ago
5 Maintainer diversity 0 active committer(s) in the last 12 months
10 Issue responsiveness median 113.2d to first maintainer response, 38% answered (8 issues)
65 Download trend 171.5M downloads in last 90d (-5% vs previous 90d)
34 OpenSSF Scorecard 3.4/10
100 License Apache-2.0 (permissive)
! Deprecated: request has been deprecated, see https://github.com/request/request/issues/3142
! No release in 6+ years
! No commits in the last 12 months
! 62% of recent issues got no maintainer response
F 10/100 left-pad@1.3.0 [npm]
! Deprecated: use String.prototype.padStart()
! Source repository is archived
A 99/100 express@5.3.0 [npm]
100 Recent activity last release 12d ago, last commit 4d ago
100 Maintainer diversity 42 active committer(s) in the last 12 months
100 Issue responsiveness median 0.2d to first maintainer response, 87% answered (53 issues)
100 Download trend 1.6B downloads in last 90d (+22% vs previous 90d)
85 OpenSSF Scorecard 8.5/10
100 License MIT (permissive)
## Contents
Why
Features
Quick start
GitHub token
Tools
Using it with an AI agent
Command line
GitHub Action
How the score works
Data sources
Limitations
FAQ
Development
Contributing
License
## Why
A typical project pulls in hundreds of open-source packages. Some of them are quietly abandoned: no releases for years, one maintainer who moved on, issues piling up unanswered. When a vulnerability shows up in one of those, nobody fixes it.
Checking this by hand means opening each package's GitHub page and reading commit dates, issue lists and contributor graphs. Nobody does that for every dependency, and AI coding assistants never do it: they happily suggest whatever library was popular in their training data, including ones deprecated years ago.
pkg-health-mcp makes that check a single tool call, so:
AI agents can avoid recommending abandoned libraries and flag risky ones in existing code.
Engineering leads can audit a project's dependencies in seconds.
Security and compliance teams get a repeatable, explainable maintenance signal alongside vulnerability scanners.
## Features
Three MCP tools: score one package, scan a whole manifest, or compare alternatives.
npm, PyPI and any GitHub repository. Pass owner/repo or a GitHub URL to score a project that is not published to a registry.
Manifests and lock files: package.json, requirements.txt, pyproject.toml (PEP 621 and Poetry), plus package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock and uv.lock for transitive dependencies. Git dependencies on GitHub are scored as repositories.
pkg-health-mcp scores npm packages, PyPI packages and GitHub repositories from 0 to 100 for maintenance health. It combines release and commit activity, active maintainers, issue response times, download trends, OpenSSF Scorecard and license into an A–F grade and a plain-language list of risks.
Use it three ways, all built on the same engine:
MCP server for Claude Code, Claude Desktop, Cursor, VS Code and any other MCP client, so your AI agent checks a package before it suggests one.
CLI to audit a manifest or lock file, including transitive dependencies.
GitHub Action to add a health report to every pull request and fail the build below a threshold.
console
$ npx -y pkg-health-mcp scan package.json
F 10/100 request@2.88.2 [npm]
10 Recent activity last release 2444d ago
5 Maintainer diversity 0 active committer(s) in the last 12 months
10 Issue responsiveness median 113.2d to first maintainer response, 38% answered (8 issues)
65 Download trend 171.5M downloads in last 90d (-5% vs previous 90d)
34 OpenSSF Scorecard 3.4/10
100 License Apache-2.0 (permissive)
! Deprecated: request has been deprecated, see https://github.com/request/request/issues/3142
! No release in 6+ years
! No commits in the last 12 months
! 62% of recent issues got no maintainer response
F 10/100 left-pad@1.3.0 [npm]
! Deprecated: use String.prototype.padStart()
! Source repository is archived
A 99/100 express@5.3.0 [npm]
100 Recent activity last release 12d ago, last commit 4d ago
100 Maintainer diversity 42 active committer(s) in the last 12 months
100 Issue responsiveness median 0.2d to first maintainer response, 87% answered (53 issues)
100 Download trend 1.6B downloads in last 90d (+22% vs previous 90d)
85 OpenSSF Scorecard 8.5/10
100 License MIT (permissive)
## Contents
Why
Features
Quick start
GitHub token
Tools
Using it with an AI agent
Command line
GitHub Action
How the score works
Data sources
Limitations
FAQ
Development
Contributing
License
## Why
A typical project pulls in hundreds of open-source packages. Some of them are quietly abandoned: no releases for years, one maintainer who moved on, issues piling up unanswered. When a vulnerability shows up in one of those, nobody fixes it.
Checking this by hand means opening each package's GitHub page and reading commit dates, issue lists and contributor graphs. Nobody does that for every dependency, and AI coding assistants never do it: they happily suggest whatever library was popular in their training data, including ones deprecated years ago.
pkg-health-mcp makes that check a single tool call, so:
AI agents can avoid recommending abandoned libraries and flag risky ones in existing code.
Engineering leads can audit a project's dependencies in seconds.
Security and compliance teams get a repeatable, explainable maintenance signal alongside vulnerability scanners.
## Features
Three MCP tools: score one package, scan a whole manifest, or compare alternatives.
npm, PyPI and any GitHub repository. Pass owner/repo or a GitHub URL to score a project that is not published to a registry.
Manifests and lock files: package.json, requirements.txt, pyproject.toml (PEP 621 and Poetry), plus package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock and uv.lock for transitive dependencies. Git dependencies on GitHub are scored as repositories.
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/orcsnren-pkg-health-mcp/)
- Source
- awesome · https://github.com/orcsnren/pkg-health-mcp
- Browse by field
- MCP servers
- Traction
- 1 ★
- Listed by
- 23 independent sources
- added
- today
- Security policy
- the repository has
SECURITY.mdat its root (we checked that the file exists, not what it says)
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.