A
licenseA
qualityA
maintenanceDependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
9
394 npm
2
Apache 2.0
PkgGuard
Server Details
Dependency scan for agents: known CVEs and malicious packages via OSV.dev. By Crypto Money Maker
If you are the author of this connector, you can claim ownership by verifying the domain or GitHub account it belongs to. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Score is being calculated.
Available Tools
2 toolscheck_packageIs this package version vulnerable or malicious?Read-onlyIdempotentInspect
Checks one package version (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet) against OSV.dev. Free preview tier: verdict and advisory count. The paid x402 endpoint /v1/package adds advisory ids, severity, CVSS and fixed-in versions.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name, e.g. lodash | |
| version | Yes | Exact version, e.g. 4.17.15 | |
| ecosystem | No | One of npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet, Pub, Hex (default npm) |
scan_dependenciesScan a dependency manifest for vulnerable and malicious packagesRead-onlyIdempotentInspect
Checks a package.json, lockfile, requirements.txt, go.mod, Cargo.lock, poetry.lock or composer.lock (or a list of packages) against OSV.dev for known vulnerabilities and confirmed-malicious packages. Free preview tier: verdict and counts, up to 25 packages. The paid x402 endpoint /v1/scan adds per-package advisory ids, severity, CVSS and fixed-in versions (up to 500 packages).
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filename | No | Optional file name, helps type detection | |
| manifest | No | Manifest or lockfile contents (package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, go.mod, Cargo.lock, composer.lock) | |
| packages | No | Alternative to manifest: [{ecosystem, name, version}], up to 500 | |
| include_dev | No | Include devDependencies (default true) |
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
check_package - First observed
scan_dependencies
Related MCP Connectors
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.
Related MCP Servers
- AlicenseAqualityFmaintenanceDependency security & health auditing for AI agents with no account or API key required.22MIT
- AlicenseAqualityAmaintenanceEnables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.3MIT
- AlicenseAqualityBmaintenanceVulnerability intelligence for AI agents that enables CVE lookup, package vulnerability checks, and dependency auditing without API keys.5MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd
Glama MCP Gateway
Add one secure layer between your agents and this server.