hound — Claude Code MCP server: dependency vulnerability scanner
Scans npm, PyPI, Go, Cargo, Maven, NuGet and RubyGems packages for vulnerabilities, checks licenses and catches typosquatting. No API keys or signup.
claude mcp add hound -- npx -y hound-mcpWhat hound does
The server gives your agent 12 tools: hound_audit scans an entire lockfile for vulnerabilities, hound_preinstall returns a GO/CAUTION/NO-GO verdict before installing a package, hound_license_check enforces license policy, hound_typosquat detects name spoofing. Also includes hound_score (0–100 rating with letter grade), hound_compare (side-by-side package comparison with recommendation), hound_upgrade (minimum safe version), hound_tree (dependency tree), hound_advisories (vulnerability details by GHSA, CVE or OSV ID).
Runs on public deps.dev and OSV APIs without authentication. Three built-in prompts: full project audit, pre-install package evaluation and pre-release dependency check.
Requires Node.js with npx — server starts via npx -y hound-mcp. Supports seven ecosystems: npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems.
What it helps with
- scan a lockfile for vulnerabilities before merging a PR
- get a GO/CAUTION/NO-GO verdict before installing a package
- find GPL packages in a commercial project
- detect typosquatting variants of dependencies
- find the minimum safe version of a package
Example prompts for the agent
- Check
package-lock.jsonfor vulnerabilities - Can I install [email protected] or are there issues?
- Find GPL licenses in the project lockfile
How to install hound
Platform CLI
claude mcp add hound -- npx -y hound-mcpPlatform CLI
codex mcp add hound -- npx -y hound-mcpConfig file
{
"mcpServers": {
"hound": {
"command": "npx",
"args": [
"-y",
"hound-mcp"
]
}
}
}Config file
{
"servers": {
"hound": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"hound-mcp"
]
}
}
}Platform CLI
gemini mcp add hound npx -y hound-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about hound
How to install hound in Claude Code?
Run claude mcp add hound -- npx -y hound-mcp in your terminal. For Cursor or Windsurf, add a JSON block with npx -y hound-mcp to your MCP config file.
What does hound do?
Scans packages across seven ecosystems for vulnerabilities, checks licenses, builds dependency trees and detects typosquatting. Works through public deps.dev and OSV APIs, no keys or signup.
Which ecosystems does hound support?
npm, PyPI, Go, Maven, Cargo, NuGet and RubyGems. The server can parse each lockfile format and check transitive dependencies.
