Audit a dependency list for known vulnerabilities, licenses and outdated versions.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use this when the user pastes a dependency manifest for npm or PyPI (package.json, requirements.txt, or one name@version / name==version per line) and wants known vulnerabilities with fixed-in versions, licenses and outdated packages, as a Markdown report for a pull request plus CSV and PDF. Reads live OSV.dev and deps.dev records. Up to 150 packages and 400 distinct advisories per call (a larger list is refused with a plan of smaller calls); ranges are checked at their stated minimum version. Does not resolve transitive dependencies, read lockfiles, scan source code or fix code. Do not use for Go, crates.io, Maven or Gradle, container images or operating system packages.
The manifest text exactly as in the file, e.g. the full package.json, or lines like [email protected]. Up to 60,000 characters and 150 packages.
Package ecosystem: npm (package.json or name@version lines) or PyPI (requirements.txt or name==version lines). Go, crates.io and Maven are not supported.
Include development and test dependencies (npm devDependencies), e.g. true. Default true.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http dependency-audit https://dependency-audit.zovo.one/mcp
Use this when the user pastes a dependency manifest for npm or PyPI (package.json, requirements.txt, or one name@version / name==version per line) and wants known vulnerabilities with fixed-in versions, licenses and outdated packages, as a Markdown report for a pull request plus CSV and PDF. Reads live OSV.dev and deps.dev records. Up to 150 packages and 400 distinct advisories per call (a larger list is refused with a plan of smaller calls); ranges are checked at their stated minimum version. Does not resolve transitive dependencies, read lockfiles, scan source code or fix code. Do not use for Go, crates.io, Maven or Gradle, container images or operating system packages.
| Argument | Type | Description |
|---|---|---|
| manifest* | string | The manifest text exactly as in the file, e.g. the full package.json, or lines like [email protected]. Up to 60,000 characters and 150 packages. |
| ecosystem* | string | Package ecosystem: npm (package.json or name@version lines) or PyPI (requirements.txt or name==version lines). Go, crates.io and Maven are not supported. |
| include_dev | boolean | Include development and test dependencies (npm devDependencies), e.g. true. Default true. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"ecosystem",
"manifest"
],
"properties": {
"manifest": {
"type": "string",
"maxLength": 60000,
"description": "The manifest text exactly as in the file, e.g. the full package.json, or lines like [email protected]. Up to 60,000 characters and 150 packages."
},
"ecosystem": {
"enum": [
"npm",
"PyPI"
],
"type": "string",
"description": "Package ecosystem: npm (package.json or name@version lines) or PyPI (requirements.txt or name==version lines). Go, crates.io and Maven are not supported."
},
"include_dev": {
"type": "boolean",
"description": "Include development and test dependencies (npm devDependencies), e.g. true. Default true."
}
}
}Use this when the user asks whether one specific package version has known vulnerabilities, which version fixes them, its license, or how outdated it is (for example lodash 4.17.15 on npm or django 3.2.0 on PyPI). Reads live OSV.dev and deps.dev records and returns Markdown, CSV and PDF reports. Needs one specific version, not a range. Does not check transitive dependencies or scan code. npm and PyPI only.
| Argument | Type | Description |
|---|---|---|
| name* | string | Package name as published on npm or PyPI, e.g. lodash, @babel/core or django. |
| version* | string | One exact version, e.g. 4.17.15. |
| ecosystem* | string | Package ecosystem: npm (package.json or name@version lines) or PyPI (requirements.txt or name==version lines). Go, crates.io and Maven are not supported. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"ecosystem",
"name",
"version"
],
"properties": {
"name": {
"type": "string",
"maxLength": 214,
"description": "Package name as published on npm or PyPI, e.g. lodash, @babel/core or django."
},
"version": {
"type": "string",
"maxLength": 64,
"description": "One exact version, e.g. 4.17.15."
},
"ecosystem": {
"enum": [
"npm",
"PyPI"
],
"type": "string",
"description": "Package ecosystem: npm (package.json or name@version lines) or PyPI (requirements.txt or name==version lines). Go, crates.io and Maven are not supported."
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 8, 2026.