LABSCO SUMMARY

It audits a repository you have not cloned, which is what separates it from running the package manager's own audit.

audit_dependencies accepts a remoteRepo and a ref, so a branch or tag can be checked without a working copy, and the same call handles a local projectPath. What comes back is more than a count: severity, CVSS score, the dependency chain that introduces each advisory, and a fix suggestion, with severity setting the reporting floor. The result is written out as Markdown or HTML at outputPath, so the end of a scan is a file to attach to a ticket rather than console output to transcribe.

What it is

A single-tool dependency auditor: audit_dependencies scans an npm or pnpm project, either at a local projectPath or a remoteRepo on GitHub at a given ref, and reports vulnerabilities with severity, CVSS score, dependency chain and a suggested fix.

What you get

A scan that does not need the code checked out: remoteRepo and ref point the audit at a GitHub repository, while projectPath points it at one on disk.
Findings with the path that caused them: each vulnerability comes back with its severity, CVSS score, the dependency chain that pulls it in, and a fix suggestion.
Output you can file rather than copy: format and outputPath write the result as a Markdown or HTML report.
A floor on the noise: severity decides what is reported and what is not.
Both package managers: npm and pnpm projects are covered by the same call.

Requirements

A Node.js project managed by npm or pnpm — either on disk, or a GitHub repository the supplied token can read.

Setup effort

One command — npm install -g audit-mcp-cli

See installation options

USE CASES

01

Checking a dependency tree before you merge it

Point the audit at the working copy, set the severity floor to what you actually gate on, and file the report alongside the change.

audit_dependencies

02

Vetting a repository you have not cloned

Give it the GitHub repo and the ref you care about, and read the advisories and their dependency chains without pulling the code down first.

audit_dependencies

1 tool

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`audit_dependencies`

Audit Node.js project dependencies for security vulnerabilities. Supports npm and pnpm projects, local or GitHub remote repos. Returns detailed vulnerability info (severity, CVSS score, dependency chains, fix suggestions) and generates Markdown/HTML report.

BEFORE YOU INSTALL

What to know first

Tools you get

1 tool when we connected. Pass projectPath to audit a local tree, or remoteRepo and ref to audit a GitHub repository without cloning. CLI switches such as --fail-on arrive as parameters of this tool.

Requires

npx on PATH

Where it runs

All 4 documented setups run the server on your machine.

CONTEXT COST

Light Standing cost

Rated by the size of the one tool definition that rides along on every turn

INSTALLATION

Connect your client

Server setup

TERMINAL

npm install -g audit-mcp-cli

MCP Clients

Claude Desktop, Cursor

JSON

{
  "mcpServers": {
    "audit-mcp-cli": {
      "command": "npx",
      "args": [
        "-y",
        "audit-mcp-cli",
        "--mcp"
      ]
    }
  }
}

Claude Desktop — GitHub token, Cursor — GitHub token