audit_nodejs_dependencies
Audit specific dependencies for vulnerabilities
LABSCO SUMMARY
The audit runs against a list you supply, which is what lets it sit in a review step with no code checked out.
Because dependencies is an argument, this works on a proposed change as easily as on a shipped one: a version bump quoted in a pull request can be audited before anyone pulls the branch. The scope is exactly that one question. There is no project-wide scan, no lockfile parsing and no remediation step, so the answer stops at what is vulnerable.
What it is
A one-tool auditor for Node.js dependencies: you pass the dependency set as an argument, it reports what is known against it.
What you get
- A vulnerability report for the dependency set you send, taken from the dependencies argument rather than read out of a checked-out project
- An audit that needs no repository access: nothing is cloned, no directory is scanned, and the names and versions you pass are the whole input
- A check that fits before an install, since the input is a list rather than an installed dependency tree
Requirements
The dependency names and versions you want checked. No account, no key and no environment variables. MIT licensed.
Setup effort
One command — npx -y mcp-security-audit
USE CASES
01
Vetting a dependency change before it merges
Take the dependency names and versions out of the proposed change and pass them straight in, without checking the branch out. The report comes back against those exact versions, which is the question a reviewer is actually asking.
1 tool
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
BEFORE YOU INSTALL
What to know first
Tools you get
1 tool when we connected.
Requires
npx on PATH
CONTEXT COST
Light Standing cost
Rated by the size of the one tool definition that rides along on every turn
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"mcp-security-audit": {
"command": "npx",
"args": [
"-y",
"mcp-security-audit"
]
}
}
}npx
TERMINAL
npx -y mcp-security-audit
