# hound

Scans npm, PyPI, Go, Cargo, Maven, NuGet and RubyGems packages for vulnerabilities, checks licenses and catches typosquatting. No API keys or signup.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 17
- Author: tiluckdave
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/tiluckdave/hound-mcp
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/hound

## What it does

The server gives your agent 12 tools: `hound_audit` scans an entire lockfile for vulnerabilities, `hound_preinstall` returns a GO/CAUTION/NO-GO verdict before installing a package, `hound_license_check` enforces license policy, `hound_typosquat` detects name spoofing. Also includes `hound_score` (0–100 rating with letter grade), `hound_compare` (side-by-side package comparison with recommendation), `hound_upgrade` (minimum safe version), `hound_tree` (dependency tree), `hound_advisories` (vulnerability details by GHSA, CVE or OSV ID).

Runs on public deps.dev and OSV APIs without authentication. Three built-in prompts: full project audit, pre-install package evaluation and pre-release dependency check.

Requires Node.js with `npx` — server starts via `npx -y hound-mcp`. Supports seven ecosystems: npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add hound -- npx -y hound-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add hound -- npx -y hound-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hound": {
            "command": "npx",
            "args": [
                "-y",
                "hound-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hound": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "hound-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add hound npx -y hound-mcp
```

## When to use it
- scan a lockfile for vulnerabilities before merging a PR
- get a GO/CAUTION/NO-GO verdict before installing a package
- find GPL packages in a commercial project
- detect typosquatting variants of dependencies
- find the minimum safe version of a package

## Example prompts
- Check `package-lock.json` for vulnerabilities
- Can I install axios@1.6.0 or are there issues?
- Find GPL licenses in the project lockfile

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md