audit_dependenciesLABSCO SUMMARY
Publish access, not popularity — the risk a vulnerability scanner does not report.
The signal this is built around is a package with one person holding publish rights and an enormous install base, which is the shape the recent token-theft incidents took and which no vulnerability scanner surfaces, because it is not a vulnerability. audit_dependency_tree is the one to reach for rather than reading a manifest: the packages carrying this risk are usually transitive.
What it is
A supply-chain risk service exposed over MCP. It scores npm and PyPI packages, Rust crates, Go modules and GitHub repositories on behaviour that is hard to fake, and flags the concentration pattern where one publisher controls a package that everything depends on.
What you get
- A batch of packages audited at once across npm, PyPI, Cargo and Go (audit_dependencies)
- A GitHub repository's manifest fetched and every dependency in it audited (audit_github_repo)
- An npm package's full dependency tree mapped, so transitive risk surfaces instead of hiding in the lock file (audit_dependency_tree)
- A single package profiled on its own, per ecosystem (lookup_npm_package, lookup_pypi_package, lookup_cargo_crate, lookup_go_module)
- A repository scored on longevity, commit frequency and contributor depth (lookup_github_repo)
- Scores built from longevity, publisher depth, release consistency, download trend and OpenSSF Scorecard, with risk flags attached
- A free key created from inside the chat, without opening a browser (get_api_key)
- Company lookups against the Norwegian business register, by name or by organisation number (lookup_business, lookup_business_by_org)
Requirements
Nothing to install — it is a hosted server you point your client at by URL. Anonymous use is rate limited per address; a free key raises that, and can be created from the conversation itself.
Setup effort
Paste a URL — add the endpoint to your client
USE CASES
01
Checking a project's real exposure
Map the dependency tree rather than the manifest, so transitive packages are scored too.
02
Vetting something before you add it
Profile the single package on publisher depth, release rhythm and age.
03
Reviewing someone else's repository
Point it at the repo and let it fetch the manifest and audit every dependency.
04
Judging a project rather than a package
Score the repository on longevity, commit frequency and contributor depth.
05
Covering a polyglot codebase
Audit crates and Go modules alongside the npm and Python dependencies.
06
Getting past the anonymous rate limit
Create a free key from inside the conversation.
12 tools
Listed in project docs. Your client may show a different list.
audit_github_repoaudit_dependency_treelookup_npm_packagelookup_pypi_packagelookup_cargo_cratelookup_go_modulelookup_github_repolookup_businesslookup_business_by_orgquery_commitmentget_api_keyBEFORE YOU INSTALL
What to know first
Tools you get
12 tools named in the project's documentation.
Requires
A client that can reach a remote MCP server over HTTP
Where it runs
The documented client connects to a hosted endpoint.
INSTALLATION
Connect your client
Add the endpoint to your client.
Server setup
ENDPOINT URL
https://poc-backend.amdal-dev.workers.dev/mcpMCP Clients
Cursor
CURSOR · JSON
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
