Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
Advisory id, e.g. 'GHSA-29mw-wpgm-hmr9' (taken from a version's advisoryKeys).
Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
| Argument | Type | Description |
|---|---|---|
| advisoryKey* | string | Advisory id, e.g. 'GHSA-29mw-wpgm-hmr9' (taken from a version's advisoryKeys). |
{
"type": "object",
"required": [
"advisoryKey"
],
"properties": {
"advisoryKey": {
"type": "string",
"x-in": "path",
"description": "Advisory id, e.g. 'GHSA-29mw-wpgm-hmr9' (taken from a version's advisoryKeys)."
}
}
}Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
| Argument | Type | Description |
|---|---|---|
| system* | string | Package ecosystem. |
| package* | string | Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'. |
| version* | string | Exact version string, e.g. '18.2.0'. |
{
"type": "object",
"required": [
"system",
"package",
"version"
],
"properties": {
"system": {
"enum": [
"npm",
"pypi",
"go",
"maven",
"cargo",
"nuget",
"rubygems"
],
"type": "string",
"x-in": "path",
"description": "Package ecosystem."
},
"package": {
"type": "string",
"x-in": "path",
"description": "Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'."
},
"version": {
"type": "string",
"x-in": "path",
"description": "Exact version string, e.g. '18.2.0'."
}
}
}List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
| Argument | Type | Description |
|---|---|---|
| system* | string | Package ecosystem. |
| package* | string | Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'. |
{
"type": "object",
"required": [
"system",
"package"
],
"properties": {
"system": {
"enum": [
"npm",
"pypi",
"go",
"maven",
"cargo",
"nuget",
"rubygems"
],
"type": "string",
"x-in": "path",
"description": "Package ecosystem."
},
"package": {
"type": "string",
"x-in": "path",
"description": "Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'."
}
}
}Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
| Argument | Type | Description |
|---|---|---|
| system* | string | Package ecosystem. |
| package* | string | Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'. |
| version* | string | Exact version string, e.g. '18.2.0'. |
{
"type": "object",
"required": [
"system",
"package",
"version"
],
"properties": {
"system": {
"enum": [
"npm",
"pypi",
"go",
"maven",
"cargo",
"nuget",
"rubygems"
],
"type": "string",
"x-in": "path",
"description": "Package ecosystem."
},
"package": {
"type": "string",
"x-in": "path",
"description": "Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'."
},
"version": {
"type": "string",
"x-in": "path",
"description": "Exact version string, e.g. '18.2.0'."
}
}
}Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOURCE_REPO link (call get_package_version first), e.g. 'github.com/facebook/react'.
| Argument | Type | Description |
|---|---|---|
| projectKey* | string | Source repository, raw and unencoded (the gateway URL-encodes it). Pass it as-is, e.g. 'github.com/facebook/react'. Supported hosts: github.com, gitlab.com, bitbucket.org. Take it from a version's SOURCE_REPO link (get_package_version). |
{
"type": "object",
"required": [
"projectKey"
],
"properties": {
"projectKey": {
"type": "string",
"x-in": "path",
"description": "Source repository, raw and unencoded (the gateway URL-encodes it). Pass it as-is, e.g. 'github.com/facebook/react'. Supported hosts: github.com, gitlab.com, bitbucket.org. Take it from a version's SOURCE_REPO link (get_package_version)."
}
}
}