`audit_dependencies` accepts a `remoteRepo` and a `ref`, so a branch or tag can be checked without a working copy, and the same call handles a local `projectPath`. What comes back is more than a count: severity, CVSS score, the dependency chain that introduces each advisory, and a fix suggestion, with `severity` setting the reporting floor. The result is written out as Markdown or HTML at `outputPath`, so the end of a scan is a file to attach to a ticket rather than console output to transcribe.
A single-tool dependency auditor: `audit_dependencies` scans an npm or pnpm project, either at a local `projectPath` or a `remoteRepo` on GitHub at a given `ref`, and reports vulnerabilities with severity, CVSS score, dependency chain and a suggested fix.
- A scan that does not need the code checked out: `remoteRepo` and `ref` point the audit at a GitHub repository, while `projectPath` points it at one on disk.
- Findings with the path that caused them: each vulnerability comes back with its severity, CVSS score, the dependency chain that pulls it in, and a fix suggestion.
- Output you can file rather than copy: `format` and `outputPath` write the result as a Markdown or HTML report.
- A floor on the noise: `severity` decides what is reported and what is not.
- Both package managers: npm and pnpm projects are covered by the same call.
A Node.js project managed by npm or pnpm — either on disk, or a GitHub repository the supplied `token` can read.
One command — npm install -g audit-mcp-cli