Dependency check MCP Server

by ladanyin Your server? Claim it

answering

Dependency check is answering right now. Last checked 8 min ago. It exposes 2 tools. Last commit 6 Nov 2026.

Check a package version for known vulnerabilities and Packagist release facts.

Uptime history 69 hours of history

69 hours agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

342 ms

Response time

average over 24h

Stars

last commit 6 Nov 2026

Nothing serious here today

Today is the operative word: we check Dependency check every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 8 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add dependency-check --transport http https://deps.bestsmartgoods.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://deps.bestsmartgoods.com/mcp

~/.codex/config.toml

[mcp_servers.dependency-check]
url = "https://deps.bestsmartgoods.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "dependency-check": {
      "url": "https://deps.bestsmartgoods.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp"
    }
  }
}

Available tools 2

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

dependency

check_dependency

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

package

check_package

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

Endpoints

URL	Transport	State	Latency	Checked
https://deps.bestsmartgoods.com/mcp	streamable-http	answering	371 ms	8 min ago

Alternatives to Dependency check

same job, measured the same way

Dependency Vulnerability Check (OSV)

by brunckel

Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.

answering

Depcheck

by kaneky

Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.

1 tools answering

Osv Advisory MCP Server

by cyanheads

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

775 installs/wk 5 tools answering

Exploitwatch

by vercel-exploitwatch-kappa

Check dependencies against CISA's real Known Exploited Vulnerabilities feed.

1 tools answering

OSV Advisories

by basitalisandhu

Query OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch.

local only

OSV Dependency Vulnerability Check

by fairquery

Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.

answering

Package Health Check

by openkrill

Check an npm or Python package, or a package.json, for vulnerabilities and upkeep.

6 tools answering

UK Data: Software packages and vulnerabilities

by co-reliness

Package versions, licences and known vulnerabilities for npm, PyPI, crates, Go, Maven, NuGet

2 tools answering

Dependency check — questions

Answers built from our own checks of this server.

What can Dependency check do?

It exposes 2 tools, read directly from the server on our last check. Among them: check_dependency, check_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Dependency check working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 342 ms. The bar chart above shows every period we have measured.

How do I connect Dependency check?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Dependency check need an API key?

No. Dependency check completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 2 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Dependency check?

It answers our handshake in 342 ms on average, which is faster than 42% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is Dependency check open source?

We cannot say either way: 0 stars on GitHub, but we could not determine the licence, and without one the code is not open source by default.