protogrid
Sign inAdd to your agent

Search / io.github.ladanyin/dependency-check

Dependency check

R1· needs a key

Check a package version for known vulnerabilities and Packagist release facts.

v1.0.0 · active · repository · website · descriptor JSON · versions

An agent can connect on its own if it already holds X_API_KEY, X_API_KEY.Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.
Quality89new
Trust93of 100
Uptime, 30 days100%
Latency p50984 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}",
        "Authorization": "${X_API_KEY}"
      }
    }
  }
}
claude mcp add --transport http dependency-check https://deps.bestsmartgoods.com/mcp --header "X-API-Key: ${X_API_KEY}" --header "Authorization: ${X_API_KEY}"
[mcp_servers.dependency-check]
url = "https://deps.bestsmartgoods.com/mcp"
env_http_headers = { "X-API-Key" = "X_API_KEY", "Authorization" = "X_API_KEY" }

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dependency-check": {
      "type": "remote",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "enabled": true,
      "headers": {
        "X-API-Key": "{env:X_API_KEY}",
        "Authorization": "{env:X_API_KEY}"
      }
    }
  }
}
{
  "mcpServers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}",
        "Authorization": "${X_API_KEY}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=dependency-check&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZGVwcy5iZXN0c21hcnRnb29kcy5jb20vbWNwIiwiaGVhZGVycyI6eyJYLUFQSS1LZXkiOiIke1hfQVBJX0tFWX0iLCJBdXRob3JpemF0aW9uIjoiJHtYX0FQSV9LRVl9In19"
}
{
  "servers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}",
        "Authorization": "${X_API_KEY}"
      }
    }
  }
}
{
  "mcpServers": {
    "dependency-check": {
      "httpUrl": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}",
        "Authorization": "${X_API_KEY}"
      }
    }
  }
}
extensions:
  "dependency-check":
    enabled: true
    name: "dependency-check"
    type: streamable_http
    uri: "https://deps.bestsmartgoods.com/mcp"
    headers:
      "X-API-Key": "${X_API_KEY}"
      "Authorization": "${X_API_KEY}"
    timeout: 300

Placeholders to fill from your own secret store: ${X_API_KEY}, ${X_API_KEY}. The registry never accepts secret values.

Quality 89 / 100new

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene100 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • pass
    tools.description_lengthdescriptions are concise
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations2 of 2 tools declare readOnlyHint or destructiveHint
  • pass
    tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
  • pass
    tools.token_costabout 553 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
stabilityn/a · weight 15
  • n/a
    stability.changes, stability.rug_pulltool history recorded for 2 of the 7 days needed
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

2 tools, about 553 tokens to load them all · tool set 1dd1f701259a · checked 2026-11-07 16:55 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 93 / 100

duplicate-repo
provenance90
liveness100
freshness100
hygiene80

+repository +namespace-matches-repo +website +reachable +uptime-100% +updated-3d-ago -duplicate-repo(8 names)

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://deps.bestsmartgoods.com/mcp streamable-httpapi_key ${X_API_KEY}yes100%984 ms2025-11-252026-11-07

Tools (2)

check_dependencyread-onlyLook up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup
check_packageread-onlyRead the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

Schemas: list_tools.

Also listed as

7 other active names share this repository: io.github.ladanyin/api-operation, io.github.ladanyin/citation-check, io.github.ladanyin/company-lookup, io.github.ladanyin/invoice-reading, io.github.ladanyin/php-docs, io.github.ladanyin/product-catalog, io.github.ladanyin/sec-filings

Similar MCP servers

  • Package Health CheckR0quality 95
    app.openkrill/packages

    Check an npm or Python package, or a package.json, for vulnerabilities and upkeep.

  • OSV Dependency Vulnerability CheckR0quality 88
    io.github.fairquery/osv-dependency-vulnerability-check

    Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.

  • Dependency Vulnerability Check (OSV)R1quality 88
    io.github.brunckel/dependency-vuln-check

    Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.

  • NPMScanunknownquality 81
    io.github.salemalem/npmscan

    Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups

  • abandoncheckL0
    io.github.CloudCorpRecords/abandoncheck

    Judge whether a dependency is maintained, from factual signals: releases, commits, archival.

  • Keep Me SecureR0quality 81
    io.github.robertkeus/keep-me-secure-mcp

    Tells your coding agent whether your installed packages need patching, with advice on what to do.

More from io.github.ladanyin

  • API operationR1quality 89
    io.github.ladanyin/api-operation

    Read one operation from a public OpenAPI document: method, path, and required fields.

  • Citation checkR1quality 89
    io.github.ladanyin/citation-check

    Check whether a page URL supports a claim.

  • Company lookupR1quality 89
    io.github.ladanyin/company-lookup

    Look up a company by name, registration number, or tax id.

  • Product catalogR0quality 89
    io.github.ladanyin/product-catalog

    Search a product catalog for a title, price, pictures, and a page where it can be bought.

  • SEC filingsR1quality 89
    io.github.ladanyin/sec-filings

    A US SEC filing excerpt, or full-year revenue or net income.

  • PHP and WordPress docsR1quality 85
    io.github.ladanyin/php-docs

    Current PHP and WordPress pages, plus an error lookup and upgrade breaks.

And 1 more from this publisher.

Official server.json
{
  "name": "io.github.ladanyin/dependency-check",
  "icons": [
    {
      "src": "https://firm.bestsmartgoods.com/icon.jpg",
      "sizes": [
        "163x82"
      ],
      "mimeType": "image/jpeg"
    }
  ],
  "title": "Dependency check",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://deps.bestsmartgoods.com/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "X-API-Key",
          "isSecret": true,
          "isRequired": true,
          "description": "API key from https://firm.bestsmartgoods.com/signup"
        }
      ]
    }
  ],
  "version": "1.0.0",
  "repository": {
    "url": "https://github.com/ladanyin/agentlane",
    "source": "github"
  },
  "websiteUrl": "https://deps.bestsmartgoods.com/docs",
  "description": "Check a package version for known vulnerabilities and Packagist release facts."
}