Labsco
MCP SERVER

Hound MCP

by tiluckdave ↗

Checks a dependency before you install it — vulnerabilities, licence, typosquatting, abandonment — across npm, PyPI, Go, Maven, Cargo, NuGet and RubyGems.

Package Registries & Dependency Supply Chain✓ Verified
Summary
It answers the question an agent normally skips: is this package safe to add?

The two tools that change behaviour are hound_preinstall, which returns a GO / CAUTION / NO-GO verdict with the blockers listed, and hound_upgrade, which finds the nearest version that clears the known vulnerabilities instead of pushing you to latest. Because lockfile contents arrive as an argument, you decide exactly what the server sees.

What it is

A dependency-security server for coding agents, built on two free unauthenticated public APIs: deps.dev for package metadata and OSV for vulnerabilities.

What you get
  • A whole lockfile scanned in one call — package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock or Pipfile.lock — batch-queried against OSV
  • A GO / CAUTION / NO-GO verdict before installing something, covering known vulnerabilities, typosquatting risk, abandonment and licence concerns
  • The nearest safe upgrade: every published version checked, and the minimum one that clears all known vulnerabilities returned
  • A 0-100 Hound Score with a letter grade, combining vulnerability severity, OpenSSF Scorecard, release recency and licence risk, with the breakdown shown
  • Two packages compared side by side — vulnerabilities, Scorecard, stars, release recency and licence — ending in a recommendation
  • Licence compliance over a lockfile against a permissive or copyleft policy, flagging what violates it
  • Vulnerabilities for one package version grouped by severity with fix versions and advisory links, and full advisory detail by GHSA, CVE or OSV ID
  • A full package profile in one call, the resolved dependency tree with depth and relation type, typosquat variants that actually exist in the registry, and a sweep of popular packages for open issues
  • Three built-in prompts: a full security audit, a package evaluation, and a pre-release dependency check
Requirements

Nothing to authorize — no account, no API key. Runs over stdio: claude mcp add hound -- npx -y hound-mcp, or the same npx -y hound-mcp command in any other client's config. Lockfile contents are passed in as a tool argument rather than read from disk, so the server needs no filesystem access of its own.

Setup effort

One command — npx -y hound-mcp