Protects AI coding agents from installing malicious open source packages. Every npm and PyPI package is checked against SafeDep’s real-time threat intelligence before installation.
Scored across 2 tools
The two tools have completely distinct purposes: check_package_security is a pre-install gate for package risk, while ping is a connectivity check. There is no overlap or potential for misselection.
Both names use snake_case, which is consistent, but 'ping' is a bare verb while the other follows a verb_noun pattern. This minor deviation is acceptable and still readable.
With only 2 tools, the set feels thin for a security service; it provides a core check and a connectivity probe but little else. While each tool earns its place, the count is borderline under-scoped.
The tool surface covers the essential pre-install check and connectivity, but lacks batch scanning, lockfile analysis, or detailed vulnerability reporting. These notable gaps mean agents may need to work around limitations for fuller security workflows.
MANDATORY pre-installation security gate for open source packages. You MUST call this tool BEFORE running any package install command including: npm install, yarn add, pnpm add, pip install, poetry add, uv add, go get, cargo add, gem install, composer require, mvn dependency:resolve, or any other package manager install/add command. Call once for EACH package being directly installed. This tool checks packages for malware, supply chain attacks, and critical/high vulnerabilities. If the response status indicates the package is MALICIOUS or has CRITICAL vulnerabilities, you MUST REFUSE to install the package and inform the user of the security risk. Always follow the 'instruction' field in the response — it contains critical safety guidance.
Inputs: name (required), ecosystem (required), version.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package intelligence for AI agents across npm, PyPI, crates.io and deps.dev. No API keys.
Package verdicts for AI coding agents: check npm, PyPI, Go and NuGet installs before they run.
Check packages for CVEs, slopsquatting, and CISA KEV before your AI agent installs them.
Add one secure layer between your agents and this server.
