Summary
The audit runs against a list you supply, which is what lets it sit in a review step with no code checked out.
Because dependencies is an argument, this works on a proposed change as easily as on a shipped one: a version bump quoted in a pull request can be audited before anyone pulls the branch. The scope is exactly that one question. There is no project-wide scan, no lockfile parsing and no remediation step, so the answer stops at what is vulnerable.
What it is
A one-tool auditor for Node.js dependencies: you pass the dependency set as an argument, it reports what is known against it.
What you get
- A vulnerability report for the dependency set you send, taken from the dependencies argument rather than read out of a checked-out project
- An audit that needs no repository access: nothing is cloned, no directory is scanned, and the names and versions you pass are the whole input
- A check that fits before an install, since the input is a list rather than an installed dependency tree
Requirements
The dependency names and versions you want checked. No account, no key and no environment variables. MIT licensed.
Setup effort
One command — npx -y mcp-security-audit