hound_advisories
Get full details for a security advisory by ID (GHSA, CVE, or OSV ID). Returns title, severity, affected versions, fix versions, and references.
LABSCO SUMMARY
It answers the question an agent normally skips: is this package safe to add?
The two tools that change behaviour are hound_preinstall, which returns a GO / CAUTION / NO-GO verdict with the blockers listed, and hound_upgrade, which finds the nearest version that clears the known vulnerabilities instead of pushing you to latest. Because lockfile contents arrive as an argument, you decide exactly what the server sees.
What it is
A dependency-security server for coding agents, built on two free unauthenticated public APIs: deps.dev for package metadata and OSV for vulnerabilities.
What you get
- A whole lockfile scanned in one call — package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock or Pipfile.lock — batch-queried against OSV
- A GO / CAUTION / NO-GO verdict before installing something, covering known vulnerabilities, typosquatting risk, abandonment and licence concerns
- The nearest safe upgrade: every published version checked, and the minimum one that clears all known vulnerabilities returned
- A 0-100 Hound Score with a letter grade, combining vulnerability severity, OpenSSF Scorecard, release recency and licence risk, with the breakdown shown
- Two packages compared side by side — vulnerabilities, Scorecard, stars, release recency and licence — ending in a recommendation
- Licence compliance over a lockfile against a permissive or copyleft policy, flagging what violates it
- Vulnerabilities for one package version grouped by severity with fix versions and advisory links, and full advisory detail by GHSA, CVE or OSV ID
- A full package profile in one call, the resolved dependency tree with depth and relation type, typosquat variants that actually exist in the registry, and a sweep of popular packages for open issues
- Three built-in prompts: a full security audit, a package evaluation, and a pre-release dependency check
Requirements
Nothing to authorize — no account, no API key. Runs over stdio: claude mcp add hound -- npx -y hound-mcp, or the same npx -y hound-mcp command in any other client's config. Lockfile contents are passed in as a tool argument rather than read from disk, so the server needs no filesystem access of its own.
Setup effort
One command — npx -y hound-mcp
USE CASES
01
Deciding whether to add a package at all
Get the go/no-go verdict first, then read the vulnerabilities behind it if it comes back negative.
02
Auditing a codebase you have just inherited
Scan the whole lockfile at once and read the findings grouped by severity.
03
Finding the smallest upgrade that clears an advisory
Read the advisory in full, then get the minimum version that resolves it.
04
Choosing between two libraries that do the same thing
Compare them side by side, and score each one on its own for the breakdown.
05
Keeping copyleft out of a commercial project
Resolve the licence of every dependency in the lockfile and flag what breaks the policy.
06
Catching a package name that is one letter off
Generate the likely typo variants, see which exist in the registry, then inspect the suspicious one.
12 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
hound_audit
Scan a project's lockfile for dependency risks. Parses package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock, or Pipfile.lock and batch-queries OSV for vulnerabilities across all dependencies.
hound_compare
Side-by-side comparison of two packages: vulnerabilities, OpenSSF Scorecard, GitHub stars, release recency, and license. Returns a recommendation.
hound_inspect
Get a comprehensive profile of a package version: licenses, vulnerabilities, OpenSSF scorecard, GitHub stats, and dependency count — all in one call.
hound_license_check
Scan a lockfile for license compliance. Resolves licenses for every dependency and flags packages that violate the chosen policy (permissive, copyleft, or none).
hound_popular
Scan a list of popular (or user-specified) packages for known vulnerabilities. Quickly surface which widely-used packages in an ecosystem have open security issues.
hound_preinstall
Safety check before installing a package. Checks known vulnerabilities, typosquatting risk, abandonment, and license concerns. Returns a go/no-go verdict.
hound_score
Compute a 0-100 Hound Score for a package version combining vulnerability severity, OpenSSF Scorecard, release recency, and license risk. Returns a letter grade (A-F) with a breakdown.
hound_tree
Show the full resolved dependency tree for a package version, including all transitive dependencies with their depth and relation type.
hound_typosquat
Check if a package name looks like a typosquat of a popular package. Generates likely typo variants and checks which ones exist in the registry.
hound_upgrade
Find the minimum version upgrade that resolves all known vulnerabilities for a package. Checks every published version and returns the nearest safe one.
hound_vulns
List all known vulnerabilities for a specific package version, grouped by severity with fix versions and advisory links.
BEFORE YOU INSTALL
What to know first
Tools you get
12 tools when we connected. security_audit, package_evaluation and pre_release_check are built-in prompts, not tools, and hound_diff is on the roadmap but not built yet.
Requires
npx on PATH
Where it runs
All 5 documented clients run the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 12 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y hound-mcpMCP Clients
Claude Code
CLAUDE CODE · TERMINAL
claude mcp add hound -- npx -y hound-mcpClaude Desktop, Cursor, Windsurf
JSON
{
"mcpServers": {
"hound": {
"command": "npx",
"args": [
"-y",
"hound-mcp"
]
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"hound": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"hound-mcp"
]
}
}
}
