SafeDep Vet MCP — Claude Code MCP server: how to install
MCP server that scans dependencies, GitHub Actions workflows, and agent configs for malicious packages and vulnerabilities. Useful for catching supply chain threats early.
claude mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0What SafeDep Vet MCP does
The server inspects manifests and lockfiles across ecosystems such as npm and PyPI without executing external code. SafeDep Threat Intel checks newly released package versions against fresh threat feeds to catch malware and cooldown violations. It also reviews GitHub Actions workflows for template injection and unpinned actions.
Scanning criteria can be defined with CEL rules inside a policy file. Docker is required to run the MCP server locally, because execution happens inside the ghcr.io/safedep/vet:v1.20.0 container. It sends no source code externally. No account registration is required.
What it helps with
- detect malicious packages and vulnerabilities in project manifests
- inspect GitHub Actions workflows for dangerous triggers and injection
- enforce CEL security policies on newly added dependencies
- generate CycloneDX xBOM and CBOM inventories for AI and cryptography
Example prompts for the agent
- Scan the dependencies in this repository for malicious packages using SafeDep Vet
- Audit the GitHub Actions workflows for template injection and exposed secrets
- Check if any packages in the lockfile fall inside the cooldown window
How to install SafeDep Vet MCP
Platform CLI
claude mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0Platform CLI
codex mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0Config file
{
"mcpServers": {
"safedep-vet-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/safedep/vet:v1.20.0"
]
}
}
}Config file
{
"servers": {
"safedep-vet-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/safedep/vet:v1.20.0"
]
}
}
}Platform CLI
gemini mcp add safedep-vet-mcp docker run -i --rm ghcr.io/safedep/vet:v1.20.0Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about SafeDep Vet MCP
How to install SafeDep Vet MCP in Claude Code?
Run claude mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0 in your terminal. Docker must be installed and running on your system.
What does SafeDep Vet MCP inspect?
It inspects package manifests, lockfiles, AI agent configs, and GitHub Actions workflows. It identifies malware, known vulnerabilities, and unsafe CI triggers.
Does SafeDep Vet transmit project source code?
No, vet does not transmit your source code and operates without an account. It inspects manifest metadata and configuration files locally.
