# ai.kaiv/dependency-trust

> Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.

- name: ai.kaiv/dependency-trust
- version: 1.0.1
- connection class: R0 (autonomous)
- trust: 76/100 flags: no-repository
- quality: 100/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/ai.kaiv%2Fdependency-trust
- tools: https://api.protogrid.dev/v1/servers/ai.kaiv%2Fdependency-trust/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "dependency-trust": {
      "type": "http",
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 99
- freshness: 85
- provenance: 45
- drivers: +dns-namespace +reachable +uptime-97% ~updated-64d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 100/100 (strong)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 60000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 5 of 5 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,200 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 5, about 1,200 tokens to load them all
- tool set hash: 9698cb0fc6110ba8385e9c2824470d7d
- badge: [![protogrid quality](https://protogrid.dev/badge/ai.kaiv/dependency-trust.svg)](https://protogrid.dev/servers/ai.kaiv/dependency-trust)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d (streamable-http, auth none, reachable true, uptime30d 0.9655172)

## Packages

_none_

## Tools (5)

- `get_advisory`: Get a security advisory (vulnerability) by its key.

Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
- `get_dependencies`: Get the resolved dependency graph for one package version.

Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
- `get_package`: List every version of a package and whether each is deprecated.

Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
- `get_package_version`: Get license, security advisories, and source links for one package version.

Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
- `get_project_health`: Get a project's OpenSSF Scorecard security posture and maintenance signals.

THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOURCE_REPO link (call get_package_version first), e.g. 'github.com/facebook/react'.