Dependency Trust

Last 30 days

Uptime

100%

Response time

162 ms typical, 293 ms slowest 5%

Last check

6 h ago

Next check

any minute now

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "dependency-trust": {
      "type": "http",
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}

5 tools

• get_advisory

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already

• get_dependencies

  Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and

• get_package

  List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this

• get_package_version

  Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. P

• get_project_health

  Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-P

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks