# SafeDep Vet MCP

MCP server that scans dependencies, GitHub Actions workflows, and agent configs for malicious packages and vulnerabilities. Useful for catching supply chain threats early.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed · ★ 1116
- Author: safedep
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/safedep/vet
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/safedep-vet-mcp

## What it does

The server inspects manifests and lockfiles across ecosystems such as npm and PyPI without executing external code. SafeDep Threat Intel checks newly released package versions against fresh threat feeds to catch malware and cooldown violations. It also reviews GitHub Actions workflows for template injection and unpinned actions.

Scanning criteria can be defined with CEL rules inside a policy file. Docker is required to run the MCP server locally, because execution happens inside the `ghcr.io/safedep/vet:v1.20.0` container. It sends no source code externally. No account registration is required.

## Requirements
- Needs: Docker

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0
```

### Codex

**Platform CLI**
```bash
codex mcp add safedep-vet-mcp -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "safedep-vet-mcp": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/safedep/vet:v1.20.0"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "safedep-vet-mcp": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/safedep/vet:v1.20.0"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add safedep-vet-mcp docker run -i --rm ghcr.io/safedep/vet:v1.20.0
```

## When to use it
- detect malicious packages and vulnerabilities in project manifests
- inspect GitHub Actions workflows for dangerous triggers and injection
- enforce CEL security policies on newly added dependencies
- generate CycloneDX xBOM and CBOM inventories for AI and cryptography

## Example prompts
- Scan the dependencies in this repository for malicious packages using SafeDep Vet
- Audit the GitHub Actions workflows for template injection and exposed secrets
- Check if any packages in the lockfile fall inside the cooldown window

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [bernstein](https://affpapa.org/en/nevibecode/mcp/bernstein.md) — MCP server · ★ 1331
- [Kody](https://affpapa.org/en/nevibecode/mcp/kody.md) — MCP server · ★ 851

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md