All servers · Security · Code & repositories · Documents & retrieval

ai.kaiv/dependency-trust

ai.kaiv/dependency-trust · v1.0.1

Measured by MCP Station

Last check	Reachable
Checked at	—
Check success 7 / 30 days	—
First-try success 30 days	—
Median response	—
Lookups 30 days	—
Authentication	No auth
MCP version	2025-06-18
Rank score	—
Declared risk	Read-only (all tools declare readOnlyHint)
Capabilities declared	tools
Tool definitions	5 tools · with description 100% · input schema is an object 100% · read/destructive hints 100%

Description written by the publisher, not verified

Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.

Connect

streamable-http · https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d

claude mcp add --transport http dependency-trust https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d

{
  "mcpServers": {
    "dependency-trust": {
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}

Tools as reported by the server

get_advisory
Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID
get_dependencies
Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
get_package
List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a
get_package_version
Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey r
get_project_health
Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dep

JSON · Text for agents · Registry updated 2026-08-17