npm-deprecated-checkBLOCK
🐦 Check for deprecated packages
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
npm-deprecated-check Check for deprecated packages
Preview
Requirements
Since version 1.4.0, npm-deprecated-check requires Node.js 18 or higher.
Install
npm install -g npm-deprecated-check
Features
- Check the packages of current project, global or specified is deprecated.
- According to the version range of lockfile and package.json.
- Additionally checks if the running node version reached End Of Life.
- Return the minimum upgradable version.
- Check if the current environment meets the Node.js version range required for dependency operation.
- Calculate the minimum Node.js version required across all dependencies.
- Suggest compatible dependency versions when Node.js version requirements are not met.
- Check Node.js version compatibility for a project or package when upgrading or downgrading Node.js.
- MCP Server support: expose tools for external AI agents to consume deprecation data.
Node.js Version Compatibility
The tool automatically analyzes Node.js version requirements across all dependencies and provides helpful information.
Default Output
By default, you get a concise summary showing the recommended engines.node value:
Node Version Summary: Minimum engines.node: >=20.0.0 Recommendation: Update package.json engines.node to ">=20.0.0" Current: >=18.12
Detailed Output (--verbose)
Use the --verbose flag for detailed information:
ndc current --verbose
Node Version Summary (detailed): Minimum Node version (production): 20.0.0 Determined by: [email protected] Minimum Node version (development): 20.17.0 Determined by: [email protected] Current Node version: v25.4.0 Project engines.node: >=18.12 Production dependencies require Node >=20.0.0, but package.json allows >=18.12 Consider updating engines.node to ">=20.0.0"
Compatible Version Suggestions
When a dependency re
45b8b0f6dc3cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add npm-deprecated-check -- npx -y [email protected]
{
"mcpServers": {
"npm-deprecated-check": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
check_compat | read | Check Node.js version compatibility for a project or package. Reports which dependencies are compatible/incompatible with a target Node version based on engines.node. |
check_current_project | read | Check all dependencies of the current project for deprecation, upgrade versions, and Node.js compatibility. |
check_global | read | Check globally installed packages for deprecation. |
check_node | read | Check if the current Node.js version has reached End of Life. |
check_package | read | Check if a specific npm package is deprecated. Returns deprecation info, minimum upgrade version, and Node.js compatibility. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
'169.254.169.254',
'metadata.google.internal',
exec(`cd ${normalDir} && node ${cli} compat`, { timeout: 160000 }, (_error, stdout, _stderr) => {exec(`cd ${deprecatedDir} && node ${cli} compat`, { timeout: 160000 }, (_error, stdout, _stderr) => {exec(`cd ${deprecatedDir} && node ${cli} compat --node 14`, { timeout: 160000 }, (_error, stdout, _stderr) => {exec(`cd ${deprecatedDir} && node ${cli} compat --ignore request,tslint`, { timeout: 160000 }, (_error, stdout, _stderr) => {exec(`cd ${playgroundDir} && node ${cli} compat --deep`, { timeout: 160000 }, (_error, stdout, _stderr) => {import { version } from '../../package.json'@modelcontextprotocol/sdk, @pnpm/lockfile-file, @pnpm/logger, @yarnpkg/parsers, ansis, commander, semver, yocto-spinner
Gates applied: no_behavioural_pass.
45b8b0f6dc3cfull audit observations/trust-audit/mcp-server/kid-joker__npm-deprecated-check.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 45b8b0f6dc3c | BLOCK | D | 69 | first audit |
Questions
What is the npm-deprecated-check MCP server?
🐦 Check for deprecated packages
What tools does npm-deprecated-check expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is npm-deprecated-check safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does npm-deprecated-check need?
No credential environment variables were found in its source, so it appears to need none.
How does npm-deprecated-check run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as npm-deprecated-check at 2.1.1.
How current is this page?
The grade is for one exact copy of the source (45b8b0f6dc3c), read on 2026-10-12. The repository is watched and re-audited when it changes.