npm-deprecated-check

What it does

npm-deprecated-check is a command-line checker for npm dependencies that also runs as a local stdio MCP server when started with the --mcp flag. It looks up each dependency on the npm registry, reports which versions are marked deprecated along with the maintainer's deprecation message, and gives the lowest version that is not deprecated. It reads versions from the project's lockfile (npm, pnpm or yarn) and package.json.

Beyond deprecation, it works out the minimum Node.js version the dependencies need from their engines.node fields, suggests older dependency versions that still run on a given Node version, and tells you whether the Node.js version in use has reached end of life. It can check the current project, a single named package, or the packages installed globally with npm, yarn or pnpm.

The MCP mode exposes five tools that return JSON. When something deprecated turns up, the reply also carries a short instruction asking the assistant to recommend replacement packages and installation commands (dist/chunks/mcp.mjs in 2.1.1). The README omits that check_current_project takes a projectPath argument as well; without it, the tool checks the folder the server was started in.

What it needs

Node.js 18 or newer (required since 1.4.0). npx, or a global install with npm install -g npm-deprecated-check. A project with a package.json for the project checks; checking global packages with yarn or pnpm needs that package manager on PATH. Network access to the npm registry or the registry you name.

Limits

Only checks npm packages. Checks of a project read its folder: give projectPath as an absolute path, or the server uses the folder it was started in, which a desktop client may not set to your project. In 2.1.1 a check covers at most 200 packages at once, registry requests time out after 15 seconds, and monorepo deep checks descend at most 5 folder levels. Registry URLs pointing at private network ranges (10.x, 172.16-31.x, 192.168.x, 127.x) or cloud metadata hosts are refused, so a registry on your internal network cannot be used. The 2.1.1 build still reports its own version as 2.1.0.

Who it suits

Suits JavaScript and TypeScript developers who want an assistant to audit a project's dependencies for deprecations and Node.js version fit before an upgrade, without an account or key. It only reads and reports; it does not edit package.json or install anything, so the changes stay with you. Teams on a self-hosted registry inside a private network cannot point it there, and it covers npm packages only, not Python or other ecosystems.