Zovo Dependency Audit MCP Server

by theluckystrike Your server? Claim it

answering

Zovo Dependency Audit is answering right now. Last checked moments ago. It exposes 2 tools.

Audit a dependency list for known vulnerabilities, licenses and outdated versions.

Uptime history 51 hours of history

51 hours agonow

100.0%

Uptime 24h

92 of 92 checks

Tools

read from the server

226 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check Zovo Dependency Audit every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 0 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add dependency-audit --transport http https://dependency-audit.zovo.one/mcp

Settings → Connectors → Add custom connector, then paste this address

https://dependency-audit.zovo.one/mcp

~/.codex/config.toml

[mcp_servers.dependency-audit]
url = "https://dependency-audit.zovo.one/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "dependency-audit": {
      "url": "https://dependency-audit.zovo.one/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "dependency-audit": {
      "type": "http",
      "url": "https://dependency-audit.zovo.one/mcp"
    }
  }
}

Available tools 2

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

audit

audit_dependencies

Use this when the user pastes a dependency manifest for npm or PyPI (package.json, requirements.txt, or one name@version / name==version per line) and wants known vulnerabilities with fixed-in versions, licenses and outdated packages, as a Markdown report for a pull request plus CSV and PDF. Reads live OSV.dev and deps.dev records. Up to 150 packages and 400 distinct advisories per call (a larger list is refused with a plan of smaller calls); ranges are checked at their stated minimum version. Does not resolve transitive dependencies, read lockfiles, scan source code or fix code. Do not use for Go, crates.io, Maven or Gradle, container images or operating system packages.

package

check_package

Use this when the user asks whether one specific package version has known vulnerabilities, which version fixes them, its license, or how outdated it is (for example lodash 4.17.15 on npm or django 3.2.0 on PyPI). Reads live OSV.dev and deps.dev records and returns Markdown, CSV and PDF reports. Needs one specific version, not a range. Does not check transitive dependencies or scan code. npm and PyPI only.

Endpoints

URL	Transport	State	Latency	Checked
https://dependency-audit.zovo.one/mcp	streamable-http	answering	98 ms	0 min ago

Alternatives to Zovo Dependency Audit

same job, measured the same way

Dependency check

by ladanyin

Check a package version for known vulnerabilities and Packagist release facts.

2 tools answering

Osv Advisory MCP Server

by cyanheads

Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

537 installs/wk 5 tools answering

Dependency Vulnerability Check (OSV)

by brunckel

Known vulnerabilities and fixed versions for npm, PyPI, Go, Maven packages from OSV.dev via Apify.

answering

UK Data: Software packages and vulnerabilities

by co-reliness

Package versions, licences and known vulnerabilities for npm, PyPI, crates, Go, Maven, NuGet

2 tools answering

OSV Advisories

by basitalisandhu

Query OSV.dev for known vulnerabilities by package and version, and scan lockfiles in batch.

local only

OSV Dependency Vulnerability Check

by fairquery

Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.

answering

Depcheck

by kaneky

Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.

1 tools answering

Vulnerability Exposure

by mrfrazer25

Confirmed vulnerabilities and exposure for IPs, domains and software versions (NVD, CISA KEV, EPSS)

387 installs/wk local only

Zovo Dependency Audit — questions

Answers built from our own checks of this server.

What can Zovo Dependency Audit do?

It exposes 2 tools, read directly from the server on our last check. Among them: audit_dependencies, check_package. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Zovo Dependency Audit working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 226 ms. The bar chart above shows every period we have measured.

How do I connect Zovo Dependency Audit?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Zovo Dependency Audit need an API key?

No. Zovo Dependency Audit completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 2 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Zovo Dependency Audit?

It answers our handshake in 226 ms on average, which is faster than 59% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.