Package versions, licences and known vulnerabilities for npm, PyPI, crates, Go, Maven, NuGet
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Optional. Bearer <key> for more than the free daily allowance; free key from POST https://ukdata.reliness.co.uk/keys
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Latest version, publish date, deprecation, licences, advisories and links for a package (deps.dev). (cost: 1 credit)
string, required
npm|pypi|cargo|go|maven|nuget|rubygems
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http software-supply-chain https://ukdata.reliness.co.uk/mcp/software-supply-chain
Headers
Authorization (optional, not in the config above): Optional. Bearer <key> for more than the free daily allowance; free key from POST https://ukdata.reliness.co.uk/keysLatest version, publish date, deprecation, licences, advisories and links for a package (deps.dev). (cost: 1 credit)
| Argument | Type | Description |
|---|---|---|
| name | string | string, required |
| ecosystem | string | npm|pypi|cargo|go|maven|nuget|rubygems |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"name": {
"type": "string",
"description": "string, required"
},
"ecosystem": {
"type": "string",
"description": "npm|pypi|cargo|go|maven|nuget|rubygems"
}
}
}Known vulnerabilities (OSV) for a package@version or a list of up to 500 (array of {ecosystem,name,version} or text "name@version" per line), with severity and fixed versions. (cost: 2 credits)
| Argument | Type | Description |
|---|---|---|
| name | string | string |
| version | string | string |
| packages | any | array or text |
| ecosystem | string | npm|pypi|cargo|go|maven|nuget|rubygems|packagist |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"name": {
"type": "string",
"description": "string"
},
"version": {
"type": "string",
"description": "string"
},
"packages": {
"anyOf": [
{
"type": "array",
"items": {
"type": "string"
}
},
{
"type": "string"
}
],
"description": "array or text"
},
"ecosystem": {
"type": "string",
"description": "npm|pypi|cargo|go|maven|nuget|rubygems|packagist"
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 4, 2026.
No readOnlyHint / destructiveHint annotations, so clients can't tell a read from a write without asking.
Fix: Add annotations to each tool, e.g. { readOnlyHint: true } for tools that only read.