mcpbeat Sign in

Dependency Trust MCP Server

by kaiv Your server? Claim it
answering

Dependency Trust is answering right now. Last checked 9 min ago. It exposes 5 tools.

Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.

Uptime history 15 days of history · worst day 92%
15 days agonow
100.0%
Uptime 24h
91 of 91 checks
5
Tools
read from the server
213 ms
Response time
average over 24h
open, no key
Access
streamable-http

Nothing serious here today

Today is the operative word: we check Dependency Trust every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 9 min ago.

run in your terminal
claude mcp add dependency-trust --transport http https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "dependency-trust": {
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}
~/.codex/config.toml
[mcp_servers.dependency-trust]
url = "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
.cursor/mcp.json
{
  "mcpServers": {
    "dependency-trust": {
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "dependency-trust": {
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}

Available tools 5

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

package
get_package
List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
get_package_version
Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
advisory
get_advisory
Get a security advisory (vulnerability) by its key. Returns a security advisory by key — e.g. a GHSA id taken from a version's advisoryKeys — including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys — there is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
dependencies
get_dependencies
Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version — each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
project
get_project_health
Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated — not just whether it has a known CVE. Get the projectKey from a version's SOURCE_REPO link (call get_package_version first), e.g. 'github.com/facebook/react'.

Endpoints

URLTransportStateLatencyChecked
https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d streamable-http answering 307 ms 9 min ago

Alternatives to Dependency Trust

same job, measured the same way
I
LicenseGate
by computersmarts1

Open-source licence risk checks for AI coding agents and dependency trees.

1 tools answering
Dep
by rog0x

License check, outdated deps, security for AI agents

49 installs/wk local only
AgentGuard — security checks for AI agents
by shuaicongxiaomai

Secret, CVE and dependency-vulnerability scanning for AI agents (free, OSV.dev).

local only
ScoutScore
by scoutscore

Trust scoring for AI agents. Check scores, fidelity, and flags for x402 services.

38 installs/wk local only
Hlido Agent Reviews
by hlido

Independent AI-agent reviews: trust checks, evidence scorecards, incident registry, recommendations.

19 tools answering
Offers MCP
by dexter-works

Deep purchase intelligence for agents and apps: live prices, landed cost, trust scores. Free.

2 tools answering
Legit
by gonna

Trust scores and organic demand intelligence for x402 agents

4 tools answering
Nanmesh MCP
by sacravenger

12 tools that let AI agents check trust scores and reviews before recommending any software tool.

264 installs/wk local only

Dependency Trust — questions

Answers built from our own checks of this server.

What can Dependency Trust do?
It exposes 5 tools, read directly from the server on our last check. Among them: get_advisory, get_dependencies, get_package, get_package_version, get_project_health. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Dependency Trust working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 213 ms. The bar chart above shows every period we have measured.
How do I connect Dependency Trust?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Dependency Trust need an API key?
No. Dependency Trust completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 5 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Dependency Trust?
It answers our handshake in 213 ms on average, which is faster than 70% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.