Pkgdiet MCP server

🥗 PkgDiet

Check any npm package in under 2 seconds. Get a ALLOW / WARN / BLOCK verdict, health score, size impact, cost estimate, and curated alternatives — before you install.

Try it now — no install required

# Check a package before installing it
npx pkgdiet check moment

# Check multiple packages at once
npx pkgdiet check moment request lodash

# Audit your whole project
npx pkgdiet audit

# Wire up your AI coding agent (Cursor, Claude, Copilot, Windsurf…)
npx pkgdiet agent-setup --all

What you get

🟡 moment
  Health:      100/100
  Verdict:     WARN
  Reasons:     Efficiency Flag: Better alternatives exist for moment.
  Added Size:  4.15MB
  Cost Impact: $0.032/mo CI
  Alternatives: dayjs, date-fns, luxon
  💡 Fix: Run `npm uninstall moment && npm install dayjs`

🔴 request
  Health:      15/100
  Verdict:     BLOCK
  Reasons:     Deprecated. Maintainer explicitly marked as end-of-life.
  Alternatives: got, axios, node-fetch, ky

🟢 @babel/parser
  Health:      94/100
  Verdict:     ALLOW ✨ PkgDiet Certified
  Added Size:  1.77MB

For AI agents and MCP clients

PkgDiet is a fully working MCP server. Any MCP-compatible agent (Claude, Cursor, Windsurf, Copilot, Cline, and others) can call it to vet packages mid-task — before writing an install command.

One-command agent setup

npx pkgdiet agent-setup --all

Automatically writes the correct MCP config to all detected agents simultaneously:

• Claude Desktop → claudedesktopconfig.json
• Cursor → .cursor/mcp.json + .cursorrules
• Windsurf → .windsurfrules
• Cline → clinemcpsettings.json
• GitHub Copilot → .github/mcp.json
• Claude Code → claude mcp add

Or configure a specific agent:

npx pkgdiet agent-setup --agent cursor
npx pkgdiet agent-setup --agent claude-desktop
npx pkgdiet agent-setup --detect   # auto-detect from your project

Manual MCP config (paste into your agent's config file)

{
  "mcpServers": {
    "pkgdiet": {
      "command": "npx",
      "args": ["-y", "pkgdiet@2.0.0", "mcp"]
    }
  }
}

Tip: Run npx pkgdiet@2.0.0 mcp once in a terminal first to warm the npm cache. Subsequent agent launches will start in ~260ms.

MCP tools available to agents

Recommended agent workflow:

1. Call check_dependency before recommending or installing any package.
2. If verdict is BLOCK → do not install without explicit user direction.
3. If verdict is WARN → explain the reasons and call suggest_alternative.
4. Re-check the chosen alternative with check_dependency.

Policy — control what gets allowed

Create .pkgdietrc.json in your project root (or run npx pkgdiet setup):

{
  "minHealthScore": 70,
  "securityMode": "standard",
  "blockedPackages": ["request", "node-uuid", "colors"],
  "internalNamePrefixes": ["@myorg/"],
  "environments": {
    "ci": {
      "minHealthScore": 80,
      "securityMode": "strict",
      "failOn": "WARN"
    }
  }
}

Validate your policy at any time:

npx pkgdiet policy-check

All commands

Shortened. The full README is on GitHub.