DepGuard MCP — stop your AI agent from installing vulnerable packages

DepGuard is an MCP server that checks packages against the OSV.dev vulnerability database before your coding agent installs them. Check one package, or scan an entire lockfile — npm, PyPI, Cargo, Go and more — in a single call, with your org's security policy applied to every verdict.

Quick start

Add DepGuard to any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf, ...):

{
  "mcpServers": {
    "depguard": {
      "url": "https://snipr--depguard-mcp.apify.actor/mcp",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}

Get your token at Apify Console → Settings → API tokens. That's it — no other setup.

With Claude Code:

claude mcp add --transport http depguard https://snipr--depguard-mcp.apify.actor/mcp \
  --header "Authorization: Bearer <YOUR_APIFY_TOKEN>"

Once connected, the server instructs your agent to vet every dependency before recommending or installing it — no prompting needed.

Tools

Tool	What it does	Price
check_package	Checks one version for known vulnerabilities. Returns block / review / allow, risk score, severity counts, fixed versions.	Free
suggest_safe_version	Finds the newest version with no known vulnerabilities.	Free
compare_versions	Compares two versions: resolved vs introduced vulnerabilities, whether upgrading helps.	Free
scan_lockfile	Checks every dependency in a lockfile in one call, with org policy enforcement.	Pay per event

Scanning a whole lockfile

scan_lockfile(filename="package-lock.json", content="<file text>")

Supported formats:

package-lock.json · npm-shrinkwrap.json · yarn.lock (v1 & berry) · pnpm-lock.yaml · requirements.txt · poetry.lock · uv.lock · Pipfile.lock · Cargo.lock · go.sum · Gemfile.lock · composer.lock

A 1,000-dependency lockfile scans in a few seconds: one batched OSV query for the whole file, then unique advisory records fetched concurrently and cached.

Only exactly-pinned versions are checked. Unpinned ranges (^4.17.0, >=2,<3) are reported as skipped, never guessed at.

Org policy

Make verdicts follow your rules, not just raw CVSS:

{
  "block_at": "high",
  "allowed_vulnerabilities": ["GHSA-2gwj-7jmv-h26r"],
  "banned_packages": ["event-stream"]
}

• block_at — lowest severity that blocks: critical, high, or medium
• allowed_vulnerabilities — advisories your team already triaged and accepted. Matched against advisory aliases too: waiving a GHSA id also waives its CVE and PYSEC equivalents.
• banned_packages — always blocked, vulnerable or not

Verdicts and severity

Severity is resolved from every signal OSV publishes, taking the worst: numeric scores, CVSS v2/v3.x vectors (exact base-score computation), CVSS v4 vectors (mapped onto the v3.1 formula — correct band, not an exact v4 score), and database-specific labels.

Highest severity	Verdict
critical / high	block
medium / unknown	review
low / none	allow

Some advisories (PYSEC entries especially) publish no severity at all; those resolve to unknown → review, never silently to allow.

allow means no known vulnerability in OSV data. It does not prove a package is safe.

Pricing

Per-package tools are free. scan_lockfile bills two events:

Event	Charged
lockfile-scan	once per successful scan
dependency-checked	once per dependency actually checked

A scan that fails to parse, or contains nothing checkable, is never charged. Charging stops cleanly at your configured budget limit.

Example output

{
  "lockfile": "package-lock.json",
  "dependencies_checked": 1009,
  "overall_recommendation": "block",
  "summary": { "block": 5, "review": 3, "allow": 1001 },
  "severity_totals": { "critical": 1, "high": 8, "medium": 4, "low": 2 },
  "findings": [
    {
      "package": "minimatch",
      "version": "3.1.2",
      "recommendation": "block",
      "highest_severity": "high",
      "vulnerability_ids": ["GHSA-..."],
      "fixed_versions_reported": ["5.1.6"]
    }
  ]
}

Self-hosting

The core server is MIT-licensed and runs locally over stdio with no Apify dependency and no API keys — server.py never imports the Apify SDK.

pip install mcp httpx
claude mcp add --transport stdio depguard -- /path/to/python /path/to/server.py

(On Windows the venv interpreter is .venv\Scripts\python.exe, not .venv/bin/python.)

The hosted version adds whole-lockfile scanning at scale, a stable endpoint, and zero setup.

Data source & attribution

Vulnerability data comes from OSV.dev, which aggregates advisories from ecosystem databases under their own licenses — several CC-BY-4.0. Tool responses carry an attribution field; keep it intact when redistributing results. OSV is a free public service with no commercial SLA; availability of this Actor depends on it.

Inspired by clidey/deptrust (MIT), a Go implementation shipping as a CLI and agent hook. DepGuard is an independent Python reimplementation — if you want a free local CLI for single-package checks, use deptrust. DepGuard's paid tier exists for what per-package checking doesn't cover: whole-lockfile scans with org policy.

License

MIT