depguard_audit_workspace

MCP tool from Depguard by mopanc

Just cloned a repo, before opening it in any IDE. Lists files that auto-execute on workspace open (VS Code tasks runOn:folderOpen, devcontainer lifecycle, .envrc, JetBrains run configs, Makefile, .gitattributes, committed git hooks). Defends against fake-interview / take-home-test malware.

How to use it

Project documentation lists depguard_audit_workspace for the Depguard MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install Depguard

$npx depguard-cli audit express

FULL DEPGUARD LISTING

Other tools in Depguard (13)

depguard_audit

Deep dive on one package (vulnerabilities + static code analysis + install scripts)

depguard_audit_bulk

Compare A vs B vs C in one call

depguard_audit_deep

Full transitive tree audit for one package

depguard_audit_project

Audit a whole project — direct deps, transitives via lockfile, packageManager field

depguard_guard

About to install package Y → pre-install verify + audit + allow/warn/block

depguard_remediate

"100 vulnerabilities, which 5 direct deps do I bump?" — groups transitives by parent, sorted by severity weight

depguard_review

AI code review — detect debris left by AI agents (console.logs, empty catch, broken imports, orphan files)

depguard_sbom

Generate a CycloneDX 1.6 SBOM (EU CRA, US EO 14028, SOC 2, FedRAMP)

depguard_score

Score 0-100 for one package

depguard_search

Search npm by keywords, ranked by depguard score

depguard_should_use

Need functionality X → recommend install / use-native / write-from-scratch

depguard_sweep

Find unused dependencies in a project

depguard_verify

AI hallucination guard — does this package exist? Is it a typosquat?