SafeDep

✓ Official

from google-gemini

Real-time malicious package protection for AI coding agents

🔥🔥🔥🔥✓ VerifiedAccount requiredQuick setup

SafeDep MCP Server

Protect your AI coding agents against malicious packages using SafeDep MCP

The SafeDep CLI is the fastest way to get started. One command signs you in, sets up your API key, and configures SafeDep in every AI coding agent it finds on your machine. To configure things manually, see Manual Setup .

SafeDep monitors npm, PyPI, and other package registries in real time. It stays invisible when packages are safe and surfaces only when it blocks something dangerous.

SafeDep MCP has a free tier. See pricing for details.

Endpoints

Endpoint Description https://mcp.safedep.io/model-context-protocol/threats/v1/mcp SafeDep MCP endpoint (HTTP) https://mcp.safedep.io/model-context-protocol/threats/v1/sse Legacy SSE endpoint

Authentication

The MCP server requires API key authentication. The following HTTP headers are required:

Header Description Authorization <API Key> X-Tenant-ID your-tenant-domain (e.g. default-team.your-domain.safedep.io)

Your tenant domain is shown in SafeDep Cloud settings after you sign in.

Testing

After setup, verify the integration by asking your coding agent to install one of the following test packages:

Package Ecosystem safedep-test-pkg npm safedep-test-pkg PyPI

These packages are harmless but are marked as malicious in the SafeDep database for testing purposes. Your coding agent should block the installation and warn that the package is flagged.

For example, try prompting your agent with:

Copy & paste — that's it

Install the npm package safedep-test-pkg

If the MCP server is configured correctly, the agent will check the package against SafeDep's threat intelligence and refuse to install it.

Quick Start

Run the following command in your terminal. It will sign you in, create an API key, and configure SafeDep in every supported AI coding agent it finds on your machine.

Copy & paste — that's it

 
 
 ```bash theme={null}
 npx @safedep/cli setup mcp install

Copy & paste — that's it

pnpx @safedep/cli setup mcp install

Copy & paste — that's it

bunx @safedep/cli setup mcp install

Copy & paste — that's it


 
 
 Verify the setup by asking your coding agent to install a [test package](#testing). The agent should block it as malicious.

Copy & paste — that's it


## Manual Setup

To configure an agent manually, or if the CLI did not auto-detect yours, follow the instructions below. Each configuration requires a SafeDep API key and your tenant domain. Create an API key in [SafeDep Cloud settings](https://app.safedep.io/settings/api-keys).

 
 
 Use `claude` CLI to add the MCP server to your user settings. This configuration will be available across all Claude Code projects.

Copy & paste — that's it

claude mcp add -s user --transport http safedep \
 https://mcp.safedep.io/model-context-protocol/threats/v1/mcp \
 --header "Authorization: " \
 --header "X-Tenant-ID: "

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Cursor configuration. Create or edit `~/.cursor/mcp.json` in your home directory:

Copy & paste — that's it

{
 "mcpServers": {
 "safedep": {
 "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

Restart Cursor after saving the configuration. You can verify the server connection in Cursor Settings > MCP Servers.

See the Cursor MCP documentation for more details.

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your VS Code configuration. Create or edit the user-level `mcp.json` file for your platform:

Platform	Path
Linux	`~/.config/Code/User/mcp.json`
macOS	`~/Library/Application Support/Code/User/mcp.json`
Windows	`%APPDATA%\Code\User\mcp.json`

Copy & paste — that's it

{
 "servers": {
 "safedep": {
 "type": "http",
 "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

Reload VS Code after saving the configuration.

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Gemini CLI configuration. Edit `~/.gemini/settings.json` in your home directory:

Copy & paste — that's it

{
 "mcpServers": {
 "safedep": {
 "httpUrl": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

See the Gemini CLI repository for MCP configuration details.

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your OpenCode configuration. Create or edit `~/.config/opencode/opencode.json` in your home directory:

Copy & paste — that's it

{
 "mcp": {
 "safedep": {
 "type": "remote",
 "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "enabled": true,
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Antigravity configuration. Create or edit `~/.gemini/antigravity/mcp_config.json` in your home directory:

Copy & paste — that's it

{
 "mcpServers": {
 "safedep": {
 "serverUrl": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Codex configuration. Edit `~/.codex/config.toml` (or `.codex/config.toml` in your project root for project-scoped access):

Copy & paste — that's it

[mcp_servers.safedep]
url = "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp"

[mcp_servers.safedep.env_http_headers]
"Authorization" = "SAFEDEP_API_KEY"
"X-Tenant-ID" = "SAFEDEP_TENANT_ID"

Set the environment variables with your credentials:

Copy & paste — that's it

export SAFEDEP_API_KEY=" "
export SAFEDEP_TENANT_ID=" "

See the Codex repository for MCP configuration details.

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Windsurf configuration. Create or edit `~/.codeium/windsurf/mcp_config.json` in your home directory:

Copy & paste — that's it

{
 "mcpServers": {
 "safedep": {
 "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

See the Windsurf Cascade MCP documentation for more details.

Copy & paste — that's it


 
 
 Add the SafeDep MCP server to your Zed configuration. Create or edit `~/.config/zed/settings.json` in your home directory.

Copy & paste — that's it

{
 "context_servers": {
 "safedep": {
 "enabled": true,
 "url": "https://mcp.safedep.io/model-context-protocol/threats/v1/mcp",
 "headers": {
 "Authorization": " ",
 "X-Tenant-ID": " "
 }
 }
 }
}

See the Zed MCP documentation for more details.

Copy & paste — that's it