{
  "markdown": "# dep-scout\n\n**先查再造 (research before you build)** — an MCP server that stops AI coding\nagents from reinventing the wheel.\n\nBefore an agent writes a feature from scratch, dep-scout searches the right\nregistry — **crates.io** (Rust), **npm** (JS/TS/frontend), **PyPI** (Python),\n**pkg.go.dev** (Go), **Maven Central** (Java/Kotlin) or **NuGet** (.NET) — for a\nmature package that already solves the problem, and scores each candidate on\n**reuse quality** (popularity, maintenance recency, version stability,\nmetadata) — and flags **known security advisories** ([OSV](https://osv.dev)) and\n**license-compliance risks**. The agent then reuses a proven, safe solution\ninstead of hand-rolling buggy code. It can also search the official **MCP\nregistry** so the agent reuses an existing MCP server instead of building one.\n\nWorks with **Cursor** (and any MCP client) over stdio. **No API keys** — every\ndata source is a keyless public API.\n\n## Why\n\nAI now writes a lot of code — and its worst habit is reimplementing solved\nproblems, picking abandoned libraries, or hallucinating packages. dep-scout\nturns the best practice *\"don't build it if a maintained package already does\nit\"* into a tool the agent calls automatically, across languages.\n\n## Tools\n\n| Tool | What it does |\n| --- | --- |\n| `find_packages` | Given a feature description + `ecosystem` (`rust` \\| `npm` \\| `python` \\| `go` \\| `maven` \\| `nuget`), returns ranked candidates with a 0–100 reuse score, signals, and warnings. |\n| `inspect_package` | Deep-dives one package by exact name + ecosystem: license (+ compliance flag), known OSV vulnerabilities, deprecation/yank status, runtime/version requirements, downloads or GitHub stars, last-update recency. |\n| `find_mcp_servers` | Searches the official MCP registry for existing MCP servers (name, install info, repo, status) — so you don't rebuild one. |\n\n`ecosystem` accepts aliases: `js`/`ts`/`javascript`/`typescript`/`node`/`frontend` → **npm**,\n`py`/`pip` → **python**, `golang` → **go**, `java`/`kotlin`/`gradle`/`jvm` → **maven**,\n`dotnet`/`csharp`/`net` → **nuget**, `rs`/`cargo` → **rust**.\n\n### Reuse score (0–100)\n\n- **Popularity** (≤40) — downloads normalised to a ~90-day window; for Go/Maven\n  (no public download stats) GitHub stars are used as a proxy.\n- **Maintenance** (≤30) — how recently the package was updated.\n- **Stability** (≤15) — stable `1.0+` vs `0.x`; penalty for pre-releases.\n- **Metadata** (≤15) — repository, docs/homepage, license present.\n- **Security penalty** — known [OSV](https://osv.dev) advisories on the resolved\n  version sink the score and de-rank the candidate.\n- **License flag** — copyleft / commercially-restricted licenses (GPL, AGPL,\n  LGPL, MPL, SSPL, BUSL…) are surfaced as compliance warnings.\n- **Penalty** — latest version yanked (crates/PyPI) or deprecated (npm).\n\nVerdicts: `≥78` ✅ strongly recommend · `58–77` 🟡 usable · `38–57` 🟠 cautious ·\n`<38` 🔴 find an alternative.\n\nRanking blends **textual relevance** (query-term overlap, exact-name match) with\nthe **reuse score** and the registry's own ordering, so results are both on-topic\nand high quality.\n\n## Data sources (all keyless)\n\n| Ecosystem | Search | Details | Popularity |\n| --- | --- | --- | --- |\n| Rust | crates.io API (relevance + downloads merge) | crates.io API | crates.io downloads (90-day) |\n| npm | `registry.npmjs.org/-/v1/search` | `registry.npmjs.org/{pkg}/latest` | `api.npmjs.org` (last-month) |\n| Python | [deps.dev](https://deps.dev) name search (+ token fallback) | `pypi.org/pypi/{pkg}/json` | pypistats (last-month) |\n| Go | deps.dev name search | deps.dev v3 (`GetPackage`/`GetVersion`/`GetProject`) | GitHub stars |\n| Java/Kotlin | Maven Central solr search | deps.dev v3 | GitHub stars |\n| .NET | NuGet search API | NuGet search API | NuGet total downloads |\n| MCP servers | official `registry.modelcontextprotocol.io` | — | — |\n| Security | [OSV.dev](https://osv.dev) `query` (detail) + `querybatch` (flag) across all ecosystems | | |\n\n> **Python note:** PyPI has no public full-text search API (the legacy XML-RPC\n> search is gone and the web search is bot-blocked), so Python search is\n> name-oriented via deps.dev. It excels when the query is/contains the library\n> name; for pure capability phrases, prefer `inspect_package` with a known name.\n\n## Build\n\nRequires a recent Rust toolchain (edition 2024).\n\n```bash\ncargo build --release\n```\n\nThe binary is produced at `target/release/dep-scout` (`.exe` on Windows).\n\n## Use in Cursor\n\n1. Register the MCP server. A portable project config lives at\n   [`.cursor/mcp.json`](.cursor/mcp.json) — it uses `cargo run --release` so no\n   machine-specific paths are required. For global use, add an entry to\n   `~/.cursor/mcp.json`:\n\n   ```json\n   {\n     \"mcpServers\": {\n       \"dep-scout\": {\n         \"command\": \"/absolute/path/to/dep-scout/target/release/dep-scout\"\n       }\n     }\n   }\n   ```\n\n   On Windows use `...\\\\target\\\\release\\\\dep-scout.exe`. Build the release binary\n   first (`cargo build --release` above) when using a direct binary path.\n2. Restart Cursor; you should see `dep-scout` with its tools enabled.\n3. The [`.cursor/rules/research-before-build.mdc`](.cursor/rules/research-before-build.mdc)\n   rule makes the agent search before building. A portable, client-agnostic\n   version lives at [`skill/SKILL.md`](skill/SKILL.md).\n\n## How it talks\n\nStandard MCP over stdio (JSON-RPC 2.0), built on the official\n[`rmcp`](https://crates.io/crates/rmcp) SDK. Logs go to stderr so they never\ncorrupt the protocol stream on stdout.\n\n## Roadmap\n\n- More ecosystems: Ruby (RubyGems), PHP (Packagist), Dart/Flutter (pub.dev).\n- Per-ecosystem popularity calibration (npm/PyPI volumes dwarf crates.io).\n- Last-update recency for NuGet; richer Maven search ranking.\n- Deeper repo health signals (open issues, release cadence, maintainer count).\n- A curated trust/quality dataset — the real moat over a plain registry mirror.\n\n## Project layout\n\n```\nsrc/\n  main.rs      # MCP server + tools (find_packages / inspect_package / find_mcp_servers)\n  model.rs     # Ecosystem enum, normalised Package, reuse scoring, relevance\n  sources.rs   # keyless registry clients (crates.io, npm, PyPI, deps.dev, MCP registry)\n.cursor/\n  rules/research-before-build.mdc   # always-on Cursor rule\n  mcp.json                          # local server registration\nskill/SKILL.md                      # portable skill for any MCP client\n```\n\n## MCP Registry\n\nPublished to the [official MCP Registry](https://registry.modelcontextprotocol.io) as\n`io.github.unievolver/dep-scout`. Download the `.mcpb` bundle from\n[GitHub Releases](https://github.com/unievolver/dep-scout/releases) or build from\nsource with `cargo build --release`.\n\n- MCP Registry name: `mcp-name: io.github.unievolver/dep-scout`\n\n## License\n\nMIT\n",
  "bytes": 6794,
  "sha": "b0f10b43e3fd71d1511583e66949433e7af87b96246a4ad3652a5d7c1022cc41",
  "repo_slug": "unievolver/dep-scout",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_unievolver_dep_scout_e2330270/readme"
}