The dependency bloodhound for AI coding agents. Zero API keys, zero config.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent โ or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON โพ
Client Config & Setup
Choose your client or environment
Target File:
๐ก Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
Hound MCP
The dependency bloodhound for AI coding agents.
Why Hound?
AI coding agents recommend and install packages without knowing if they're safe โ and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems โ zero config, zero API keys, zero cost.
Hound is the only security tool built specifically for AI coding agents โ works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.
It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).
Quickstart
Claude Code
Claude Desktop / Cursor / Windsurf
Add to your MCP config file:
VS Code (Copilot)
Config file locations
| Client | Config path |
|---|---|
| Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
Tools
12 tools โ Full reference with example outputs
| Tool | What it does |
|---|---|
hound_audit โญ | Scan an entire lockfile for vulnerabilities across all dependencies |
hound_score | 0โ100 Hound Score (vulns + scorecard + recency + license) with letter grade |
hound_compare | Side-by-side comparison of two packages with a recommendation |
hound_preinstall | GO / CAUTION / NO-GO verdict before installing a package |
hound_upgrade | Find the minimum safe version upgrade that resolves all known vulns |
hound_license_check | Scan a lockfile for license compliance against a policy |
hound_vulns | All known vulnerabilities for a package version, grouped by severity |
hound_inspect | Full package profile โ license, vulns, scorecard, stars, dep count |
hound_tree | Full resolved dependency tree with transitive deps |
hound_typosquat | Detect typosquatting variants of a package name |
hound_advisories | Full advisory details by GHSA, CVE, or OSV ID |
hound_popular | Scan popular packages for known vulnerabilities |
Supported ecosystems: npm ยท pypi ยท go ยท maven ยท cargo ยท nuget ยท rubygems
Built-in Prompts
3 prompts you can invoke directly from your AI client. โ Full prompt reference
| Prompt | What it does |
|---|---|
security_audit | Full project security audit โ vulns, licenses, typosquats |
package_evaluation | Go/no-go recommendation before adding a new dependency |
pre_release_check | Pre-ship dependency scan that flags release blockers |
Use Cases
โ See full examples with real lockfiles and expected output
- Before merging a PR โ scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
- Auditing an inherited codebase โ run
hound_auditon an existing lockfile to get a full report in seconds - Checking a package before adding it โ use
hound_preinstallto get a GO / CAUTION / NO-GO verdict - License compliance โ run
hound_license_checkto ensure no GPL or AGPL packages sneak into a commercial project - CI security gate โ ask your AI agent to run a security audit as part of every release check
Local Development
Roadmap
- Docker support โ run Hound as a container for CI/CD pipelines
-
bun.lockbparser โ Bun lockfile support -
gradle.lockfileparser โ Gradle (Java/Android) ecosystem support -
hound_difftool โ compare two lockfile snapshots to surface newly introduced risks - GitHub Action โ run
hound_auditas a PR check without an AI agent
Contributing
Contributions are welcome. Read CONTRIBUTING.md to get started.
The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.
Good first issues are labeled and ready.
Community
๐ฌ Questions or ideas? Open a Discussion
License
MIT ยฉ 2026 Tilak Dave
Related MCP Servers
Reviews
No reviews yet โ be the first to share how this listing worked for you.
Frequently Asked Questions about Hound
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/hound)HTML Embed
<a href="https://allmcps.com/mcp/hound"><img src="https://allmcps.com/api/badge/hound?style=directory" alt="Hound on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
27Quality signal: Emerging ยท 27/100How this signal is calculated โพ
Server availabilityNot measured
Not scored for repo-hosted servers โ we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership8/20
Documentation & tools11/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data โ not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website โ proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it โ no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.