
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@inferensys/dr-mcp
Advanced tools
Clean your MCP setup with config audits, context-weight analysis, abandoned-package checks, usage history, and safe patch plans.
Clean your MCPs.
Audit, clean, and slim down the MCP setup your coding agent loads every day.
If you use Claude Code, Codex, Cursor, Windsurf, Copilot, or VS Code across different projects, your MCP configs collect junk fast: old demo servers, duplicate GitHub tools, broad filesystem access, packages nobody maintains, and giant tool lists your agent has to sort through before it can write code.
dr-mcp scans that mess and shows what to remove.
npx @inferensys/dr-mcp
That starts a local scan in the current project. It does not delete anything. You get a cleanup report, a ranked list of context-heavy MCPs, and reversible patch plans you can apply after review.
For the full cleanup scan with package/repo checks and local install-history tracking:
npx @inferensys/dr-mcp cleanup
Inside Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, or any MCP client that exposes server prompts/tools, use dr_mcp_scan or dr_mcp_cleanup. If your client maps MCP prompts into slash commands, use /dr-mcp scan.
--registry, check npm metadata and GitHub activity for archived or stale projects.--track-usage and build a local ledger of MCPs that keep showing up across scans.npx packages using latest or no version.# Local audit in the current project
npx @inferensys/dr-mcp
# Deeper cleanup report with package/repo checks and local install history
npx @inferensys/dr-mcp cleanup
# Full scan alias for agent workflows
npx @inferensys/dr-mcp scan --deep
# Local-only cleanup flow with no network checks or usage ledger writes
npx @inferensys/dr-mcp cleanup --local
# JSON for scripts or CI
npx @inferensys/dr-mcp scan --workspace . --json --registry
# Shareable cleanup report
npx @inferensys/dr-mcp report --workspace . --format html > dr-mcp-report.html
# Preview a repair plan
npx @inferensys/dr-mcp patch --workspace . --plan remove-duplicate-servers
npx @inferensys/dr-mcp patch --workspace . --plan upgrade-stale-packages
# Apply a reviewed repair plan with backups
npx @inferensys/dr-mcp patch --workspace . --plan remove-duplicate-servers --apply
# Run as an MCP server
npx @inferensys/dr-mcp server
| Tool | Configs scanned |
|---|---|
| Claude Desktop | claude_desktop_config.json |
Claude Code / cc | ~/.claude.json, ~/.claude/settings.json, .claude/settings.json |
| OpenAI Codex | ~/.codex/config.toml, .codex/config.toml |
| Cursor | ~/.cursor/mcp.json, .cursor/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json, .windsurf/mcp.json |
| GitHub Copilot in VS Code | VS Code user settings, VS Code Insiders settings, .vscode/mcp.json, .vscode/settings.json |
| GitHub Copilot CLI | ~/.copilot/mcp-config.json, .copilot/mcp-config.json |
| Cline | ~/.cline/data/settings/cline_mcp_settings.json, .cline/data/settings/cline_mcp_settings.json |
| Roo Code | .roo/mcp.json, common Roo Code VS Code global storage paths |
| Continue | ~/.continue/config.yaml, .continue/config.yaml |
| Zed | Zed user settings, .zed/settings.json |
| Generic MCP | .mcp.json |
Once added, start from the shortest in-session action:
dr_mcp_scan
For cleanup candidates, upgrades, abandoned servers, and long-lived installs:
dr_mcp_cleanup
Clients that expose MCP prompts as slash commands may show these as dr_mcp_scan, dr_mcp_cleanup, or a prompt such as /dr-mcp scan.
codex mcp add dr-mcp -- npx -y @inferensys/dr-mcp server
claude mcp add dr-mcp -- npx -y @inferensys/dr-mcp server
Use this for Claude Desktop, Cursor, Windsurf, Cline, Roo Code, VS Code, and GitHub Copilot in VS Code:
{
"mcpServers": {
"dr-mcp": {
"command": "npx",
"args": ["-y", "@inferensys/dr-mcp", "server"]
}
}
}
VS Code and GitHub Copilot may use servers:
{
"servers": {
"dr-mcp": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@inferensys/dr-mcp", "server"]
}
}
}
{
"context_servers": {
"dr-mcp": {
"command": "npx",
"args": ["-y", "@inferensys/dr-mcp", "server"]
}
}
}
mcpServers:
dr-mcp:
command: npx
args:
- -y
- @inferensys/dr-mcp
- server
When running as a server, dr-mcp exposes:
dr_mcp_scandr_mcp_cleanupscan_mcp_setupexplain_issuegenerate_patch_planapply_patch_planexport_reportdr_mcp with action=scan or action=cleanupdr_mcp_scandr_mcp_cleanupScans never edit MCP client configs.
Patch plans create timestamped backups before writing. Reports redact secrets, tokens, emails, home paths, and private GitHub repo URLs.
Usage tracking is opt-in. --track-usage writes a local ledger at ~/.dr-mcp/usage-ledger.json. It tracks what remains installed across scans; it does not claim true per-tool usage unless a client exposes that data.
dr-mcp does not auto-install, uninstall, upgrade packages, or run destructive cleanup.
npm install
npm run check
node dist/cli.js scan --workspace tests/fixtures/mixed --json
Registry name: io.github.Inferensys/dr-mcp
Package: @inferensys/dr-mcp
FAQs
Clean your MCP setup with config audits, context-weight analysis, abandoned-package checks, usage history, and safe patch plans.
The npm package @inferensys/dr-mcp receives a total of 42 weekly downloads. As such, @inferensys/dr-mcp popularity was classified as not popular.
We found that @inferensys/dr-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.