Connection check
verified live · 20h ago
dependency-trust
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Tools
5
GitHub stars
—
Installs / wk
—
Licence
—
Transport
streamable-http
Last checked
20h ago
Tools & capabilities
5 toolsRead from the running server on 20h ago.
get_advisory
read-only
advisoryKey*
Get a security advisory (vulnerability) by its key. Returns a security advisory by key — e.g. a GHSA id taken from a version's advisoryKeys — including the title, CVE aliases, CVS… Get a security advisory (vulnerability) by its key. Returns a security advisory by key — e.g. a GHSA id taken from a version's advisoryKeys — including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys — there is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
get_dependencies
read-only
system*package*version*
Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version — each node has the dependency's exact ve… Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version — each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
get_package
read-only
system*package*
List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Us… List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
get_package_version
read-only
system*package*version*
Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabili… Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
get_project_health
read-only
projectKey*