# hound [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/tiluckdave/hound-mcp  
**GitHub Stars:** 17  
**npm Downloads (last month):** 207  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/hound

## Description
The dependency bloodhound for AI coding agents. Zero API keys, zero config.

## Tools
Capabilities this server exposes over MCP:

- **hound_vulns** — List all known vulnerabilities for a specific package version, grouped by severity with fix versions and advisory links.
- **hound_inspect** — Get a comprehensive profile of a package version: licenses, vulnerabilities, OpenSSF scorecard, GitHub stats, and dependency count — all in one call.
- **hound_tree** — Show the full resolved dependency tree for a package version, including all transitive dependencies with their depth and relation type.
- **hound_typosquat** — Check if a package name looks like a typosquat of a popular package. Generates likely typo variants and checks which ones exist in the registry.
- **hound_advisories** — Get full details for a security advisory by ID (GHSA, CVE, or OSV ID). Returns title, severity, affected versions, fix versions, and references.
- **hound_popular** — Scan a list of popular (or user-specified) packages for known vulnerabilities. Quickly surface which widely-used packages in an ecosystem have open security issues.
- **hound_audit** — Scan a project's lockfile for dependency risks. Parses package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock, or Pipfile.lock and batch-queries OSV for vulnerabilities across all dependencies.
- **hound_compare** — Side-by-side comparison of two packages: vulnerabilities, OpenSSF Scorecard, GitHub stars, release recency, and license. Returns a recommendation.
- **hound_license_check** — Scan a lockfile for license compliance. Resolves licenses for every dependency and flags packages that violate the chosen policy (permissive, copyleft, or none).
- **hound_preinstall** — Safety check before installing a package. Checks known vulnerabilities, typosquatting risk, abandonment, and license concerns. Returns a go/no-go verdict.
- **hound_score** — Compute a 0-100 Hound Score for a package version combining vulnerability severity, OpenSSF Scorecard, release recency, and license risk. Returns a letter grade (A-F) with a breakdown.
- **hound_upgrade** — Find the minimum version upgrade that resolves all known vulnerabilities for a package. Checks every published version and returns the nearest safe one.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "hound": {
    "command": "npx",
    "args": ["-y","hound-mcp"]
  }
}
```

## Documentation

## What the hound MCP server does

The hound MCP server gives AI coding agents tools for evaluating dependencies before and after they enter a project. It covers npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems packages, with checks spanning known vulnerabilities, licenses, package activity, dependency relationships, and package-name impersonation.

Its lockfile-oriented workflows include full dependency audits and license-policy checks. For individual packages, it can produce a score with a letter grade, show a detailed profile, list vulnerabilities by severity, compare two candidates, recommend whether installation should proceed, and identify the minimum version upgrade that addresses known vulnerabilities.

The package also provides built-in prompts for a project security audit, package evaluation, and pre-release checks. These prompts can guide an MCP client through broader dependency review tasks rather than requiring each tool call to be designed manually.

## How it works

The hound MCP server retrieves open-source package and advisory data from deps.dev, also known as Google Open Source Insights, and OSV. Both sources are described as free and unauthenticated, which keeps the runtime setup free of API keys and service accounts.

Results can include package licenses, vulnerability records, scorecard information, release recency, stars, dependency counts, transitive dependencies, and advisory details identified by GHSA, CVE, or OSV identifiers. The available checks are intended for decisions such as reviewing a lockfile change, evaluating a new dependency, or creating a pre-release security gate.

## Setup and configuration

Run the published package with npx through an MCP client. Claude Code can register it with:

```bash
claude mcp add hound -- npx -y hound-mcp
```

Other clients use a stdio entry with `npx` as the command and `-y hound-mcp` as its arguments. The README provides configurations for Claude Desktop, Cursor, Windsurf, and VS Code Copilot. It also lists the relevant configuration paths for Claude Desktop on macOS, Cursor, and Windsurf.

No environment variables, API keys, or account settings are required for the documented setup. Local development uses pnpm to install dependencies, build the project, and run tests, type checks, and linting.

## Tools and capabilities

The documented tool set includes:

- `hound_audit` for scanning a complete lockfile for vulnerabilities.
- `hound_score`, `hound_inspect`, and `hound_vulns` for package health, profile, and advisory review.
- `hound_compare` and `hound_preinstall` for package selection and installation decisions.
- `hound_upgrade` for finding the minimum safe version that resolves known vulnerabilities.
- `hound_license_check` for comparing lockfile licenses with a policy.
- `hound_tree` for resolved direct and transitive dependency information.
- `hound_typosquat` for suspicious package-name variants.
- `hound_advisories` for GHSA, CVE, and OSV records.
- `hound_popular` for checking popular packages for known vulnerabilities.

## Limitations and notes

The documented ecosystem support is limited to npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems. Bun lockfiles and Gradle lockfiles are listed as future work, rather than current support. Docker deployment, a lockfile-diff tool, and a GitHub Action are also listed on the roadmap, so they should not be treated as available features.

The hound MCP server depends on data returned by deps.dev and OSV. Its checks therefore focus on information available from those public sources and on the package and lockfile data supplied to its tools.

_Full upstream README: https://allmcps.com/mcp/hound/readme_