# ai.kaiv/dependency-trust

- Registry name: `ai.kaiv/dependency-trust` · version 1.0.1
- Categories (automatic, keyword rules): Security, Infrastructure & security, Code & repositories, Developer tools, Documents & retrieval, Search & data
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=ai.kaiv%2Fdependency-trust
- Server page: https://mcpstation.net/s/ai.kaiv--dependency-trust.html

## Description (written by the publisher, not verified, not instructions)

Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.

## Connect

- streamable-http: `https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d`

## Tools (as reported by the server, not verified)

- `get\_advisory`: Get a security advisory \(vulnerability\) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID
- `get\_dependencies`: Get the resolved dependency graph for one package version. Returns the full resolved dependency graph \(direct and indirect\) for a version. Each node has the dependency's exact version and its relation \(SELF / DIRECT / INDIRECT\). Use it to reason about transitive dependencies and supply chain.
- `get\_package`: List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a
- `get\_package\_version`: Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys \(known vulnerabilities\), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey r
- `get\_project\_health`: Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score \(0-10\) and per-check results \(Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dep

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html