Dependency check

Working Security A

io.github.ladanyin/dependency-checkv1.0.0 GitHub verified

Check a package version for known vulnerabilities and Packagist release facts.

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-04T23:29:00.905176Z",
      "publishedAt": "2026-11-04T23:29:00.905176Z",
      "statusChangedAt": "2026-11-04T23:29:00.905176Z"
    }
  },
  "server": {
    "name": "io.github.ladanyin/dependency-check",
    "icons": [
      {
        "src": "https://firm.bestsmartgoods.com/icon.jpg",
        "sizes": [
          "163x82"
        ],
        "mimeType": "image/jpeg"
      }
    ],
    "title": "Dependency check",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://deps.bestsmartgoods.com/mcp",
        "type": "streamable-http",
        "headers": [
          {
            "name": "X-API-Key",
            "isSecret": true,
            "isRequired": true,
            "description": "API key from https://firm.bestsmartgoods.com/signup"
          }
        ]
      }
    ],
    "version": "1.0.0",
    "repository": {
      "url": "https://github.com/ladanyin/agentlane",
      "source": "github"
    },
    "websiteUrl": "https://deps.bestsmartgoods.com/docs",
    "description": "Check a package version for known vulnerabilities and Packagist release facts."
  }
}

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://deps.bestsmartgoods.com/mcp

X-API-Key (required)

API key from https://firm.bestsmartgoods.com/signup

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

check_dependency Read-only

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

namestring, required

Package name, for example guzzlehttp/guzzle or lodash.

versionstring, required

The exact version to check, for example 6.5.0.

ecosystemstring

OSV ecosystem. Omit it and a vendor/package name uses Packagist, otherwise npm.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM StudioThen replace the YOUR_ values and {placeholders} with your own.

Run in a terminal

claude mcp add --transport http dependency-check https://deps.bestsmartgoods.com/mcp \
  --header 'X-API-Key: YOUR_X_API_KEY'

Headers

X-API-Key (required): API key from https://firm.bestsmartgoods.com/signup

Try it

Call this server's tools from your browser. Nothing to install.

https://deps.bestsmartgoods.com/mcp

X-API-Key (required)

API key from https://firm.bestsmartgoods.com/signup

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

check_dependency Read-only

namestring, required

Package name, for example guzzlehttp/guzzle or lodash.

versionstring, required

The exact version to check, for example 6.5.0.

ecosystemstring

OSV ecosystem. Omit it and a vendor/package name uses Packagist, otherwise npm.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM StudioThen replace the YOUR_ values and {placeholders} with your own.

Run in a terminal

claude mcp add --transport http dependency-check https://deps.bestsmartgoods.com/mcp \
  --header 'X-API-Key: YOUR_X_API_KEY'

Headers

X-API-Key (required): API key from https://firm.bestsmartgoods.com/signup

Tools (2)

check_dependency

read-only

Argument	Type	Description
name*	string	Package name, for example guzzlehttp/guzzle or lodash.
version*	string	The exact version to check, for example 6.5.0.
ecosystem	string	OSV ecosystem. Omit it and a vendor/package name uses Packagist, otherwise npm.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "name",
    "version"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name, for example guzzlehttp/guzzle or lodash."
    },
    "version": {
      "type": "string",
      "description": "The exact version to check, for example 6.5.0."
    },
    "ecosystem": {
      "enum": [
        "packagist",
        "npm",
        "pypi",
        "go",
        "crates.io",
        "maven",
        "rubygems",
        "nuget"
      ],
      "type": "string",
      "description": "OSV ecosystem. Omit it and a vendor/package name uses Packagist, otherwise npm."
    }
  }
}

check_package

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

read-only

Argument	Type	Description
name*	string	Packagist name, vendor/package.
version	string	Optional release to select. Omit it for the latest stable.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Packagist name, vendor/package."
    },
    "version": {
      "type": "string",
      "description": "Optional release to select. Omit it for the latest stable."
    }
  }
}

Try it

check_dependency Read-only

Install

Try it

check_dependency Read-only

Install

Tools (2)

Security checkA100/100