Log inSubmit server
Hound logo

Hound

Audits dependencies, vulnerabilities, licenses, trees, and package risks across seven ecosystems through MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Hound

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": [
        "-y",
        "hound-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 12 tools correctly (3d ago).

Overview

The hound MCP server evaluates software dependencies using vulnerability, license, package health, and dependency-tree data. It connects to the free, unauthenticated deps.dev and OSV APIs, so it requires no API keys or account configuration. Use it to audit lockfiles, assess packages before installation, find safer upgrade versions, and identify typosquatting risks. It runs through standard MCP configurations in clients including Claude Code, Cursor, Windsurf, and VS Code.

Use cases

  • Audit a lockfile before merging dependency changes
  • Evaluate a package before adding it to a project
  • Check dependency licenses against a commercial policy
  • Find a safer version during a vulnerability response

Key features

  • Scans lockfiles for dependency vulnerabilities
  • Scores packages with a letter grade
  • Checks licenses against project policies
  • Resolves transitive dependency trees
  • Detects package typosquatting variants
  • Supports seven package ecosystems

Tools12

What Hound lets your agent do. Expand a tool for its parameters.

Verified live~1.8k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

7/7 checks healthy over the last 50d

What it can do

From the 12 tools this server returned when we ran it.

Read-only tools · 12
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age227 days
Maintainers1

Observed 2026-10-25 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13d ago via OSV.dev · hound-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars17Stargazers on the source repository.
npm downloads207Package downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed12Callable tools this server registers over MCP.

How Hound works

What the hound MCP server does

The hound MCP server gives AI coding agents tools for evaluating dependencies before and after they enter a project. It covers npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems packages, with checks spanning known vulnerabilities, licenses, package activity, dependency relationships, and package-name impersonation.

Its lockfile-oriented workflows include full dependency audits and license-policy checks. For individual packages, it can produce a score with a letter grade, show a detailed profile, list vulnerabilities by severity, compare two candidates, recommend whether installation should proceed, and identify the minimum version upgrade that addresses known vulnerabilities.

The package also provides built-in prompts for a project security audit, package evaluation, and pre-release checks. These prompts can guide an MCP client through broader dependency review tasks rather than requiring each tool call to be designed manually.

How it works

The hound MCP server retrieves open-source package and advisory data from deps.dev, also known as Google Open Source Insights, and OSV. Both sources are described as free and unauthenticated, which keeps the runtime setup free of API keys and service accounts.

Results can include package licenses, vulnerability records, scorecard information, release recency, stars, dependency counts, transitive dependencies, and advisory details identified by GHSA, CVE, or OSV identifiers. The available checks are intended for decisions such as reviewing a lockfile change, evaluating a new dependency, or creating a pre-release security gate.

Setup and configuration

Run the published package with npx through an MCP client. Claude Code can register it with:

Terminal
claude mcp add hound -- npx -y hound-mcp

Other clients use a stdio entry with npx as the command and -y hound-mcp as its arguments. The README provides configurations for Claude Desktop, Cursor, Windsurf, and VS Code Copilot. It also lists the relevant configuration paths for Claude Desktop on macOS, Cursor, and Windsurf.

No environment variables, API keys, or account settings are required for the documented setup. Local development uses pnpm to install dependencies, build the project, and run tests, type checks, and linting.

Tools and capabilities

The documented tool set includes:

  • hound_audit for scanning a complete lockfile for vulnerabilities.
  • hound_score, hound_inspect, and hound_vulns for package health, profile, and advisory review.
  • hound_compare and hound_preinstall for package selection and installation decisions.
  • hound_upgrade for finding the minimum safe version that resolves known vulnerabilities.
  • hound_license_check for comparing lockfile licenses with a policy.
  • hound_tree for resolved direct and transitive dependency information.
  • hound_typosquat for suspicious package-name variants.
  • hound_advisories for GHSA, CVE, and OSV records.
  • hound_popular for checking popular packages for known vulnerabilities.

Limitations and notes

The documented ecosystem support is limited to npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems. Bun lockfiles and Gradle lockfiles are listed as future work, rather than current support. Docker deployment, a lockfile-diff tool, and a GitHub Action are also listed on the roadmap, so they should not be treated as available features.

The hound MCP server depends on data returned by deps.dev and OSV. Its checks therefore focus on information available from those public sources and on the package and lockfile data supplied to its tools.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Hound

hound is an MCP server that connects AI coding agents to deps.dev and OSV for dependency security analysis. Its main tools audit lockfiles, score and inspect packages, list vulnerabilities, check licenses, compare dependencies, find safe upgrades, resolve dependency trees, and detect typosquatting across seven ecosystems.

Install it by registering `npx -y hound-mcp` as a stdio MCP server. Claude Code uses `claude mcp add hound -- npx -y hound-mcp`; Claude Desktop, Cursor, Windsurf, and VS Code can add the equivalent command and arguments to their MCP configuration.

Yes, hound works with Cursor through its MCP configuration file at `~/.cursor/mcp.json`. Add `npx` as the command and `-y`, `hound-mcp` as the arguments, then start the server through Cursor.

No, the hound MCP server requires no API key, account, or environment configuration for its documented setup. It uses the free, unauthenticated deps.dev and OSV public APIs to obtain package and vulnerability data.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewHound AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/hound?style=directory)](https://allmcps.com/mcp/hound)
HTML Embed
<a href="https://allmcps.com/mcp/hound"><img src="https://allmcps.com/api/badge/hound?style=directory" alt="Hound on AllMCPs" /></a>