orcsnren/pkg-health-mcp

Is this dependency still maintained? Find out before you install it.
pkg-health-mcp scores npm packages, PyPI packages and GitHub repositories from 0 to 100 for maintenance health. It combines release and commit activity, active maintainers, issue response times, download trends, OpenSSF Scorecard and license into an A–F grade and a plain-language list of risks.
Use it three ways, all built on the same engine:
MCP server for Claude Code, Claude Desktop, Cursor, VS Code and any other MCP client, so your AI agent checks a package before it suggests one.
CLI to audit a manifest or lock file, including transitive dependencies.
GitHub Action to add a health report to every pull request and fail the build below a threshold.
console
$ npx -y pkg-health-mcp scan package.json
F 10/100 request@2.88.2 [npm]
10 Recent activity last release 2444d ago
5 Maintainer diversity 0 active committer(s) in the last 12 months
10 Issue responsiveness median 113.2d to first maintainer response, 38% answered (8 issues)
65 Download trend 171.5M downloads in last 90d (-5% vs previous 90d)
34 OpenSSF Scorecard 3.4/10
100 License Apache-2.0 (permissive)
! Deprecated: request has been deprecated, see https://github.com/request/request/issues/3142
! No release in 6+ years
! No commits in the last 12 months
! 62% of recent issues got no maintainer response
F 10/100 left-pad@1.3.0 [npm]
! Deprecated: use String.prototype.padStart()
! Source repository is archived
A 99/100 express@5.3.0 [npm]
100 Recent activity last release 12d ago, last commit 4d ago
100 Maintainer diversity 42 active committer(s) in the last 12 months
100 Issue responsiveness median 0.2d to first maintainer response, 87% answered (53 issues)
100 Download trend 1.6B downloads in last 90d (+22% vs previous 90d)
85 OpenSSF Scorecard 8.5/10
100 License MIT (permissive)
## Contents
Why
Features
Quick start
GitHub token
Tools
Using it with an AI agent
Command line
GitHub Action
How the score works
Data sources
Limitations
FAQ
Development
Contributing
License
## Why
A typical project pulls in hundreds of open-source packages. Some of them are quietly abandoned: no releases for years, one maintainer who moved on, issues piling up unanswered. When a vulnerability shows up in one of those, nobody fixes it.
Checking this by hand means opening each package's GitHub page and reading commit dates, issue lists and contributor graphs. Nobody does that for every dependency, and AI coding assistants never do it: they happily suggest whatever library was popular in their training data, including ones deprecated years ago.
pkg-health-mcp makes that check a single tool call, so:
AI agents can avoid recommending abandoned libraries and flag risky ones in existing code.
Engineering leads can audit a project's dependencies in seconds.
Security and compliance teams get a repeatable, explainable maintenance signal alongside vulnerability scanners.
## Features
Three MCP tools: score one package, scan a whole manifest, or compare alternatives.
npm, PyPI and any GitHub repository. Pass owner/repo or a GitHub URL to score a project that is not published to a registry.
Manifests and lock files: package.json, requirements.txt, pyproject.toml (PEP 621 and Poetry), plus package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock and uv.lock for transitive dependencies. Git dependencies on GitHub are scored as repositories.