Borrowing it
Nothing to install: this file belongs to arvindand/maven-tools-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/arvindand/maven-tools-mcp/main/.claude/commands/deps-upgrade.mdgit clone --depth 1 https://github.com/arvindand/maven-tools-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/arvindand/maven-tools-mcp/deps-upgrade)<a href="https://agentmods.dev/commands/arvindand/maven-tools-mcp/deps-upgrade"><img src="https://agentmods.dev/badge/commands/arvindand/maven-tools-mcp/deps-upgrade/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/arvindand/maven-tools-mcp/deps-upgrade"><img src="https://agentmods.dev/badge/commands/arvindand/maven-tools-mcp/deps-upgrade.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00008 | $0.00358 |
| Opus 5 | $0.00004 | $0.00179 |
| Sonnet 5 | $0.00002 | $0.00072 |
| Haiku 4.5 | $0.00001 | $0.00036 |
Grade A, and why
deps-upgrade scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Analyze dependencies for upgrade recommendations using the maven-tools-mcp MCP server.
Dependencies to check (with current versions): $ARGUMENTS
If no dependencies are specified, extract them with versions from the project's build file.
Analysis:
Use compare_dependency_versions with:
includeSecurityScan: true- Include CVE vulnerability checkstabilityFilter: STABLE_ONLY- Only recommend stable version upgrades
Report Format:
| Dependency | Current | Recommended Now | Recommended Type | Latest Stable | Security |
|---|
For each dependency, show:
- Current version vs recommended immediate target
- Recommended type from
update_type, or fromsame_major_stable_fallback.update_typewhen a fallback is present - Latest stable version separately using the top-level
latest_versionwhen it differs from the immediate recommendation - If
same_major_stable_fallbackis present, usesame_major_stable_fallback.latest_versionas the recommended safe-now target and keep the top-level major path as manual review - Security status: vulnerabilities fixed in newer versions
Upgrade Priority:
- Critical - Security vulnerabilities requiring action now
- High - Safe same-major fallback, minor, or patch updates available
- Medium - Major upgrades requiring planning and migration work
- Low - Already on latest or near-latest
For major updates, keep the breaking-change path separate from the immediate recommendation. If documentation lookup is needed, include Context7 migration guidance hints if available.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 39 lines · 8 tokens per session scan A 2f3bf8536dde
deps-upgrade is a command published in the GitHub repository arvindand/maven-tools-mcp (32 stars, last pushed 2d ago), licensed MIT. It adds 8 tokens to every session and 358 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
statusbar-style
Switch the status-bar style (classic / capsule / hairline).
statusbar
Show current status-bar config and list available styles + themes.
fest-commit
Commit changes with festival traceability metadata.
superpowers-execute
Execute the current GSD phase plan with Superpowers instead of gsd-execute-phase.
release
Generate changelog, bump version, and create git tag.
role-ops
Reliability and operations lens. Blast radius, failure, recovery.