# DepGuard MCP — Dependency Vulnerability Scanner (`snipr/depguard-mcp`) Actor

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

- **URL**: https://apify.com/snipr/depguard-mcp.md
- **Developed by:** [Snithin P R](https://apify.com/snipr) (community)
- **Categories:** AI, Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.01 / 1,000 results

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## DepGuard MCP — stop your AI agent from installing vulnerable packages

DepGuard is an MCP server that checks packages against the [OSV.dev](https://osv.dev) vulnerability database **before** your coding agent installs them. Check one package, or scan an entire lockfile — npm, PyPI, Cargo, Go and more — in a single call, with your org's security policy applied to every verdict.

### Quick start

Add DepGuard to any MCP client (Claude Code, Claude Desktop, Cursor, Windsurf, ...):

```json
{
  "mcpServers": {
    "depguard": {
      "url": "https://snipr--depguard-mcp.apify.actor/mcp",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}
````

Get your token at [Apify Console → Settings → API tokens](https://console.apify.com/settings/integrations). That's it — no other setup.

With Claude Code:

```bash
claude mcp add --transport http depguard https://snipr--depguard-mcp.apify.actor/mcp \
  --header "Authorization: Bearer <YOUR_APIFY_TOKEN>"
```

Once connected, the server instructs your agent to vet every dependency before recommending or installing it — no prompting needed.

### Tools

| Tool | What it does | Price |
|---|---|---|
| `check_package` | Checks one version for known vulnerabilities. Returns `block` / `review` / `allow`, risk score, severity counts, fixed versions. | Free |
| `suggest_safe_version` | Finds the newest version with no known vulnerabilities. | Free |
| `compare_versions` | Compares two versions: resolved vs introduced vulnerabilities, whether upgrading helps. | Free |
| `scan_lockfile` | Checks **every dependency in a lockfile** in one call, with org policy enforcement. | Pay per event |

### Scanning a whole lockfile

```
scan_lockfile(filename="package-lock.json", content="<file text>")
```

Supported formats:

`package-lock.json` · `npm-shrinkwrap.json` · `yarn.lock` (v1 & berry) · `pnpm-lock.yaml` · `requirements.txt` · `poetry.lock` · `uv.lock` · `Pipfile.lock` · `Cargo.lock` · `go.sum` · `Gemfile.lock` · `composer.lock`

A 1,000-dependency lockfile scans in a few seconds: one batched OSV query for the whole file, then unique advisory records fetched concurrently and cached.

Only exactly-pinned versions are checked. Unpinned ranges (`^4.17.0`, `>=2,<3`) are reported as skipped, never guessed at.

#### Org policy

Make verdicts follow your rules, not just raw CVSS:

```json
{
  "block_at": "high",
  "allowed_vulnerabilities": ["GHSA-2gwj-7jmv-h26r"],
  "banned_packages": ["event-stream"]
}
```

- **`block_at`** — lowest severity that blocks: `critical`, `high`, or `medium`
- **`allowed_vulnerabilities`** — advisories your team already triaged and accepted. Matched against advisory **aliases** too: waiving a GHSA id also waives its CVE and PYSEC equivalents.
- **`banned_packages`** — always blocked, vulnerable or not

### Verdicts and severity

Severity is resolved from every signal OSV publishes, taking the worst: numeric scores, CVSS v2/v3.x vectors (exact base-score computation), CVSS v4 vectors (mapped onto the v3.1 formula — correct band, not an exact v4 score), and database-specific labels.

| Highest severity | Verdict |
|---|---|
| critical / high | `block` |
| medium / unknown | `review` |
| low / none | `allow` |

Some advisories (PYSEC entries especially) publish no severity at all; those resolve to `unknown` → `review`, never silently to `allow`.

> **`allow` means no *known* vulnerability in OSV data. It does not prove a package is safe.**

### Pricing

Per-package tools are free. `scan_lockfile` bills two events:

| Event | Charged |
|---|---|
| `lockfile-scan` | once per successful scan |
| `dependency-checked` | once per dependency actually checked |

A scan that fails to parse, or contains nothing checkable, is never charged. Charging stops cleanly at your configured budget limit.

### Example output

```json
{
  "lockfile": "package-lock.json",
  "dependencies_checked": 1009,
  "overall_recommendation": "block",
  "summary": { "block": 5, "review": 3, "allow": 1001 },
  "severity_totals": { "critical": 1, "high": 8, "medium": 4, "low": 2 },
  "findings": [
    {
      "package": "minimatch",
      "version": "3.1.2",
      "recommendation": "block",
      "highest_severity": "high",
      "vulnerability_ids": ["GHSA-..."],
      "fixed_versions_reported": ["5.1.6"]
    }
  ]
}
```

### Self-hosting

The core server is MIT-licensed and runs locally over stdio with no Apify dependency and no API keys — `server.py` never imports the Apify SDK.

```bash
pip install mcp httpx
claude mcp add --transport stdio depguard -- /path/to/python /path/to/server.py
```

(On Windows the venv interpreter is `.venv\Scripts\python.exe`, not `.venv/bin/python`.)

The hosted version adds whole-lockfile scanning at scale, a stable endpoint, and zero setup.

### Data source & attribution

Vulnerability data comes from [OSV.dev](https://osv.dev), which aggregates advisories from ecosystem databases under their own licenses — several CC-BY-4.0. Tool responses carry an `attribution` field; keep it intact when redistributing results. OSV is a free public service with no commercial SLA; availability of this Actor depends on it.

Inspired by [clidey/deptrust](https://github.com/clidey/deptrust) (MIT), a Go implementation shipping as a CLI and agent hook. DepGuard is an independent Python reimplementation — if you want a free local CLI for single-package checks, use deptrust. DepGuard's paid tier exists for what per-package checking doesn't cover: whole-lockfile scans with org policy.

### License

MIT

# Actor input Schema

## `lockfileName` (type: `string`):

Name of the lockfile to scan, e.g. package-lock.json, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, composer.lock.

## `lockfileContent` (type: `string`):

Full text of the lockfile to scan.

## `blockAt` (type: `string`):

Lowest severity that should produce a 'block' verdict.

## `includeDev` (type: `boolean`):

Scan dependencies marked dev-only in the lockfile.

## Actor input object example

```json
{
  "lockfileName": "package-lock.json",
  "blockAt": "high",
  "includeDev": true
}
```

# Actor output Schema

## `scanReport` (type: `string`):

Full vulnerability scan report for the submitted lockfile: overall verdict, per-verdict summary, severity totals and per-dependency findings.

## `runDetails` (type: `string`):

Console view of this scan run.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("snipr/depguard-mcp").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("snipr/depguard-mcp").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call snipr/depguard-mcp --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=snipr/depguard-mcp",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "DepGuard MCP — Dependency Vulnerability Scanner",
        "description": "MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.",
        "version": "0.1",
        "x-build-id": "AQq3Pe5QyrXl5qEtz"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/snipr~depguard-mcp/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-snipr-depguard-mcp",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/snipr~depguard-mcp/runs": {
            "post": {
                "operationId": "runs-sync-snipr-depguard-mcp",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/snipr~depguard-mcp/run-sync": {
            "post": {
                "operationId": "run-sync-snipr-depguard-mcp",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "properties": {
                    "lockfileName": {
                        "title": "Lockfile name",
                        "type": "string",
                        "description": "Name of the lockfile to scan, e.g. package-lock.json, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, composer.lock."
                    },
                    "lockfileContent": {
                        "title": "Lockfile content",
                        "type": "string",
                        "description": "Full text of the lockfile to scan."
                    },
                    "blockAt": {
                        "title": "Block at severity",
                        "enum": [
                            "critical",
                            "high",
                            "medium"
                        ],
                        "type": "string",
                        "description": "Lowest severity that should produce a 'block' verdict.",
                        "default": "high"
                    },
                    "includeDev": {
                        "title": "Include dev dependencies",
                        "type": "boolean",
                        "description": "Scan dependencies marked dev-only in the lockfile.",
                        "default": true
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```