BEFORE recommending or installing any package, check it here. The response carries agent_action: REFUSE (do not add it — relay the because text to the user), CONFIRM (ask the user first), or PROCEED. A failed or rate-limited call also answers REFUSE; never proceed unchecked. Also returns the underlying advisories, slop risk, and KEV status as supporting data.

Bulk-check several packages in one call — always prefer this over repeated vdb_check_package. Each result carries its own agent_action (REFUSE / CONFIRM / PROCEED) plus a top-level agent_action for the batch. Follow them; relay because when refusing. Send names EXACTLY as written — do not correct a typo first, the call is the typo test.

BEFORE merging, scan the resolved lockfile. Checking the packages someone chose misses the transitive ones nobody did — which is usually where the risk is. Pass the file contents (package-lock.json, requirements.txt, uv.lock, go.sum, Cargo.lock, a CycloneDX SBOM, …). Returns agent_action: REFUSE means do not merge.

Fetch a single vulnerability by ID or alias (e.g. CVE-2024-1234, GHSA-xxxx-yyyy-zzzz, VDB-SLOP-…).

Free-text search over the VDB vulnerability corpus.

BEFORE recommending a community/unofficial MCP server, check it here. Scope risk is evaluated independently of advisory risk — an unvetted publisher asking for shell or filesystem access is refused even with a clean record. Follow the returned agent_action.

List packages currently flagged as slopsquatting candidates in a given ecosystem.

Decide whether attacker-controlled data can reach a dangerous operation through this file's transitive dependencies — with no CVE required. Use it on code that passes user input into a third-party API. The file is abstracted LOCALLY first (identifiers renamed, literals reduced to shapes, bodies dropped); only that abstraction and the lockfile are sent, never source text. Returns decided paths, a call-site fix that does not modify the dependency, and the residual risk the fix does not cover.

After applying a fix returned by vdb_harden, re-abstract the local file and verify the originally issued path. Returns a signed evidence payload bound to the original analysis, the fixed IR fingerprint, and the dependency graph. This proves VDB's decision over the submitted abstraction, not that the abstraction matches a deployed binary.

Given a project directory and its lockfile, work out which of its known advisories can actually be reached by attacker-controlled data, and return an OpenVEX document plus a shareable URL. Use this when a scan produced more findings than anyone can triage. Point path at the SOURCE TREE, not one file: a not_affected determination is only as wide as the code behind it, and a single-file run withholds them all. Reachability is decided at package granularity from static summaries — good for triage order, not proof of non-exploitability.