Hound MCP is a zero-config dependency security tool for AI coding agents that scans packages and lockfiles for vulnerabilities, license issues, and typosquatting across 7 ecosystems — no API keys or accounts required.
Core tools:
hound_audit— Scan an entire lockfile (package-lock.json,yarn.lock,requirements.txt,Cargo.lock, etc.) for vulnerabilities across all dependencieshound_vulns— List all known vulnerabilities for a specific package version, grouped by severity with fix versions and advisory linkshound_inspect— Full package profile including license, vulnerabilities, OpenSSF Scorecard, GitHub stats, and dependency counthound_tree— Full resolved dependency tree including transitive dependencies (configurable depth up to 10)hound_score— 0–100 Hound Score (letter grade A–F) combining vulnerability severity, OpenSSF Scorecard, release recency, and license riskhound_compare— Side-by-side package comparison with a recommendation based on vulns, scorecard, stars, recency, and licensehound_preinstall— GO / CAUTION / NO-GO verdict before installing a package, checking vulns, typosquatting, abandonment, and license concernshound_upgrade— Find the minimum safe version upgrade that resolves all known vulnerabilitieshound_license_check— Scan a lockfile for license compliance against a configurable policy (permissive, copyleft, or none)hound_typosquat— Detect whether a package name looks like a typosquat of a popular packagehound_advisories— Look up full details for a security advisory by GHSA, CVE, or OSV IDhound_popular— Scan popular or user-specified packages for known vulnerabilities in a given ecosystem
Supported ecosystems: npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems
Retrieves GitHub-sourced security advisories (GHSA), repository stars, and OpenSSF Scorecard metrics for package safety evaluation.
Integrates with Google Open Source Insights (deps.dev) and Google Open Source Vulnerabilities (OSV) to provide comprehensive package metadata and security alerts.
Audits dependencies within the .NET ecosystem to identify security vulnerabilities and recommend safe upgrade paths.
Scans npm packages for vulnerabilities, license compliance, and dependency trees using deps.dev and OSV data.
Checks .NET packages in the NuGet ecosystem for vulnerabilities, license risks, and OpenSSF health scores.
Parses pnpm-lock.yaml files to conduct batch security audits and license compliance checks across all project dependencies.
Audits Python packages (PyPI) for security risks, metadata, and vulnerability history.
Inspects Ruby packages for security advisories, dependency resolution, and license verification.
Analyzes yarn.lock files to detect vulnerable packages and resolve transitive dependency security risks.
Hound MCP
The dependency bloodhound for AI coding agents.
Why Hound?
AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.
Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.
It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).
Quickstart
Claude Code
claude mcp add hound -- npx -y hound-mcpClaude Desktop / Cursor / Windsurf
Add to your MCP config file:
{
"mcpServers": {
"hound": {
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}VS Code (Copilot)
{
"mcp": {
"servers": {
"hound": {
"type": "stdio",
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}
}Config file locations
Client | Config path |
Claude Desktop (macOS) |
|
Cursor |
|
Windsurf |
|
Tools
12 tools → Full reference with example outputs
Tool | What it does |
| Scan an entire lockfile for vulnerabilities across all dependencies |
| 0–100 Hound Score (vulns + scorecard + recency + license) with letter grade |
| Side-by-side comparison of two packages with a recommendation |
| GO / CAUTION / NO-GO verdict before installing a package |
| Find the minimum safe version upgrade that resolves all known vulns |
| Scan a lockfile for license compliance against a policy |
| All known vulnerabilities for a package version, grouped by severity |
| Full package profile — license, vulns, scorecard, stars, dep count |
| Full resolved dependency tree with transitive deps |
| Detect typosquatting variants of a package name |
| Full advisory details by GHSA, CVE, or OSV ID |
| Scan popular packages for known vulnerabilities |
Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems
Built-in Prompts
3 prompts you can invoke directly from your AI client. → Full prompt reference
Prompt | What it does |
| Full project security audit — vulns, licenses, typosquats |
| Go/no-go recommendation before adding a new dependency |
| Pre-ship dependency scan that flags release blockers |
Use Cases
→ See full examples with real lockfiles and expected output
Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
Auditing an inherited codebase — run
hound_auditon an existing lockfile to get a full report in secondsChecking a package before adding it — use
hound_preinstallto get a GO / CAUTION / NO-GO verdictLicense compliance — run
hound_license_checkto ensure no GPL or AGPL packages sneak into a commercial projectCI security gate — ask your AI agent to run a security audit as part of every release check
Local Development
git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test # run tests
pnpm check # typecheck + lint + testRoadmap
Docker support — run Hound as a container for CI/CD pipelines
bun.lockbparser — Bun lockfile supportgradle.lockfileparser — Gradle (Java/Android) ecosystem supporthound_difftool — compare two lockfile snapshots to surface newly introduced risksGitHub Action — run
hound_auditas a PR check without an AI agent
Contributing
Contributions are welcome. Read CONTRIBUTING.md to get started.
The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.
Good first issues are labeled and ready.
Community
💬 Questions or ideas? Open a Discussion
License
MIT © 2026 Tilak Dave