Search / ai.kaiv/dependency-trust
protogridR0· no sign-inTrust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
v1.0.1 · active · descriptor JSON · versions
{
"mcpServers": {
"dependency-trust": {
"type": "http",
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
}
}claude mcp add --transport http dependency-trust https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d[mcp_servers.dependency-trust]
url = "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dependency-trust": {
"type": "remote",
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d",
"enabled": true
}
}
}{
"mcpServers": {
"dependency-trust": {
"type": "http",
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=dependency-trust&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLmthaXYuYWkvYXBpL2JyaWRnZS9tY3AvZGVwZW5kZW5jeS10cnVzdC1mMWFhZjA2ZCJ9"
}{
"servers": {
"dependency-trust": {
"type": "http",
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
}
}{
"mcpServers": {
"dependency-trust": {
"httpUrl": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
}
}extensions:
"dependency-trust":
enabled: true
name: "dependency-trust"
type: streamable_http
uri: "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
timeout: 300
protocol.modernsupports 2026-07-28 (server/discover)protocol.statelessanswers without a sessionprotocol.transportstreamable HTTPprotocol.list_ttltool list is cacheable (ttlMs 60000)auth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations5 of 5 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 1,200 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changesno tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +reachable +uptime-96% ~updated-63d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d streamable-http | none | yes | 96% | 336 ms | 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05 | 2026-10-19 |
get_advisoryread-only | Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth. |
get_dependenciesread-only | Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain. |
get_packageread-only | List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version. |
get_package_versionread-only | Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details. |
get_project_healthread-only | Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOURCE_REPO link (call get_package_version first), e.g. 'github.com/facebook/react'. |
Schemas: list_tools.
And 1 more from this publisher.
{
"name": "ai.kaiv/dependency-trust",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d",
"type": "streamable-http"
}
],
"version": "1.0.1",
"description": "Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems."
}