SafeDep Vet MCP

latest · 1.19.1

Protect your AI agents and IDEs from malicious open-source packages.

GitHub: safedep/vet
Homepage: safedep.io
MCP registry: io.github.safedep/vet-mcp

Install

claude mcp add io-github-safedep-vet-mcp -- docker ghcr.io/safedep/vet:v1.19.1 -s server mcp

/mcp confirms it's connected.

Install

Or add it manually in ~/.cursor/mcp.json:

{
  "mcpServers": {
    "io-github-safedep-vet-mcp": {
      "command": "docker",
      "args": [
        "ghcr.io/safedep/vet:v1.19.1",
        "-s",
        "server",
        "mcp"
      ]
    }
  }
}

In claude_desktop_config.json (Settings → Developer → Edit Config), then restart:

{
  "mcpServers": {
    "io-github-safedep-vet-mcp": {
      "command": "docker",
      "args": [
        "ghcr.io/safedep/vet:v1.19.1",
        "-s",
        "server",
        "mcp"
      ]
    }
  }
}

Config entry, any MCP client:

{
  "command": "docker",
  "args": [
    "ghcr.io/safedep/vet:v1.19.1",
    "-s",
    "server",
    "mcp"
  ]
}

Community score

Community66/ 100

from web signals · no reviews yet · 3 mentions · 6 reactions (community v3)

Mentions (reaction sentiment)100/100 · 16% of the weight
Web signals (ecosystem baseline)60/100 · 84% of the weight

Used it? Rate v1.19.1

No reviews yet — be the first.

What the web says

Ecosystem baseline60/ 100

Objective public usage & activity (formula v3) — the community score's web-signals input, and its own sort.

GitHubsource ↗

GitHub stars · 25 days ago: ★ 1.1K
Last commit · 25 days ago: 5 days ago
Issue close rate · 25 days ago: 66%

Packages

No package-registry data collected yet.

Listed on

Glama · 4 days ago: Listed ↗

Mentions

Quotes5

Explore (Open) VEX Statement Generation ↗
What is VEX Vulnerability Exploitability eXchange (VEX) is a form of a security advisory where the goal is to communicate the exploitability of components with known vulnerabilities in the context of the product in which they are used. http…
GitHub issue · @abhisek · 4 reactions · 100% positive
Expose osv-scalibr's pomxmlnet upstream_registry config for private/mirror Maven registries ↗
Summary pkg/parser/pomxml.go constructs the Maven extractor with a hard-coded empty config: pomXmlNetExtractor, err := pomxmlnet.New(&cpb.PluginConfig{}) osv-scalibr's pomxmlnet package (which vet vendors) supports a POMXMLNetConfig.upstrea…
GitHub issue · @jrbeilke · 1 reaction · 100% positive
Question about pipeline failure functionality ↗
It's not clear to me whether the tool has the functionality to fail the pipeline only when new vulnerabilities are found, instead of simply scanning the entire repository again. This would allow blocking only the introduction of new vulnera…
GitHub discussion · @z4l1nux · 1 reaction · 100% positive
Vet MCP: Software Composition Analysis for AI Code Editors ↗
Hacker News · @abhisek · 1 point
Your vulnerability scan results could leak to attackers via DNS rebinding. CVE-2025-59163 affects SafeDep Vet MCP Server running SSE transport. The attack: A single website visit. The payload: Your entire package vulnerability database. The… ↗
Bluesky · @evanharris.bsky.social · 1 like

Docs & livenesssource ↗

No liveness or verification signals yet.

Version history1

1.19.1release date unknown

Badge for your README

Shows this page's community score and its sample, kept current, and links readers here to review.

[![rateme12 community score](https://api.rateme12.com/servers/f8371162-84e6-4644-aa1c-7ba906c3c529/badge.svg)](https://rateme12.com/servers/f8371162-84e6-4644-aa1c-7ba906c3c529)

Details

Transport: stdio
Status: listed
Source: Imported from the MCP registry
Repository: source ↗
Homepage: site ↗