Give your coding agent stack awareness in one line

Claude Code

claude mcp add 4da -- npx -y @4da/mcp-server

Cursor

{ "mcpServers": { "4da": { "command": "npx", "args": ["-y", "@4da/mcp-server"] } } }

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global).

Windsurf

Same JSON shape in ~/.codeium/windsurf/mcp_config.json.

Claude Desktop

One-click extension, no terminal: download the .mcpb for your platform (Windows, Apple Silicon, Intel Mac), then Settings → Extensions → install. It asks for one thing: the project folder to scan.

That’s the whole setup. The server scans the project it starts in and works immediately.

What your agent can now do

Nine tools work standalone, the moment it’s installed

vulnerability_scan

The full resolvable lockfile tree — transitives included — against OSV.dev: severity, fix versions, upgrade commands. Your agent checks before it bumps.

dependency_health

Freshness, deprecations, known issues across npm, Rust, Python, Go.

upgrade_planner

Ranked upgrade plan: quick wins vs breaking majors.

what_should_i_know

Pre-task briefing: advisories and decisions relevant to the task your agent is about to start.

ecosystem_pulse

What moved in your ecosystem lately.

get_context

Your stack, as detected — so the agent stops guessing your versions.

decision_memory + check_decision_alignment

Record architecture decisions once; every future agent session checks against them before suggesting a rewrite.

agent_memory

What one agent session learns, the next one knows.

Five more light up when the 4DA desktop app is running — the always-on layer: your scored intelligence feed, actionable signals, knowledge gaps, developer DNA, and live feedback learning. The server tells your agent honestly when that data is fresh versus stale (data_freshness on every feed-backed answer — no silent staleness).

Privacy

The actual answer, not the reassuring one

Standalone mode sends exactly one category of data anywhere: package names and versions — the public contents of your manifest — to OSV.dev and public registries. Your code, your paths, your prompts: never. The desktop app’s intelligence stays on your machine entirely. The server is Apache-2.0 and small; read it.