Summary

Two things in one server: what your dependencies are doing, and what your team already decided.

The dependency half is live rather than remembered — OSV.dev for CVEs, the registries for freshness — which is exactly the data a model's training cut-off makes stale. The decision half is the more unusual part: check_decision_alignment lets an assistant test a suggestion against conventions you have already settled before it proposes switching your ORM for the third time.

What it is

A server that reads your project's manifest and lock files, resolves exact versions, and queries live vulnerability and registry data — alongside a persistent record of your architectural decisions and context.

What you get

Known CVEs across npm, Rust, Python and Go dependencies, from OSV.dev, with no configuration — vulnerability_scan
Version freshness, deprecation status and CVE counts as a health picture rather than a list — dependency_health
A prioritized upgrade plan that separates quick wins from breaking changes, weighted by severity, deprecation and version distance — upgrade_planner
A pre-task briefing: advisories, active decisions, signals and ecosystem updates relevant to what you are about to do — what_should_i_know
Hacker News discussion filtered to your own stack — ecosystem_pulse
What the server knows about you: role, tech stack, interests, learned affinities — get_context
Architectural decisions recorded, listed, updated and superseded, and any proposal checked against them before it is suggested — decision_memory, check_decision_alignment
Memory shared across agents, so what one discovers another can recall — agent_memory

Requirements

No account and no API key: install with claude mcp add 4da -- npx @4da/mcp-server, or point any client at the same package; Node 20 or newer, and npx @4da/mcp-server --setup configures every editor it detects. What leaves the machine is package names, versions and generic tech keywords — the same information your package.json already shows — and FOURDA_OFFLINE=true stops all network calls. The one exception to that is opt-in: configuring FOURDA_EMBED_PROVIDER=openai for semantic recall sends stored decision and memory text to OpenAI to be embedded, while the default and a local Ollama provider keep it on your machine.

Setup effort

One command — claude mcp add 4da -- npx @4da/mcp-server