Vet

What safedep/vet does

safedep/vet is intended for evaluating open-source packages before they are accepted into a project or recommended by an AI coding tool. Its focus is package safety: identifying vulnerabilities and detecting malicious code in packages from npm and PyPI.

The server fits workflows where an agent proposes a dependency and needs a security-oriented check before that dependency is used. It can also support automated vetting as part of local development workflows, provided the package comes from one of its supported ecosystems.

How it works

Package checks are exposed through MCP so an AI coding workflow can request vetting as part of its interaction with dependencies. The checks cover two areas: vulnerabilities in open-source packages and indicators of malicious code. npm and PyPI are the supported package ecosystems.

The server is designed to run locally. Local execution keeps the vetting component alongside the developer or automation environment rather than requiring a hosted service in the workflow. The available runtime options are Docker and a standalone binary.

Setup and configuration

Run safedep/vet locally using either Docker or its standalone binary. Choose Docker when the surrounding workflow already uses containers; use the binary when a direct local executable is more convenient.

The server’s user documentation is published through SafeDep’s documentation site, and the project also maintains development documentation for its storage component. Consult those resources for the concrete installation command and runtime configuration applicable to the selected distribution method.

After starting the local process, connect it to an MCP-compatible AI coding workflow and use it to assess npm or PyPI packages. Keep the server available wherever package suggestions or dependency changes need to be checked.

Tools and capabilities

• Vet npm packages for vulnerabilities.
• Vet PyPI packages for vulnerabilities.
• Check supported packages for malicious code.
• Evaluate packages suggested by AI coding tools.
• Run package vetting locally through Docker.
• Run package vetting from a standalone binary.

Limitations and notes

Coverage is described for npm and PyPI packages. Package ecosystems outside those two registries are not part of the stated scope. The server is positioned for local execution, with Docker and standalone-binary deployment options.

safedep/vet is most relevant when an AI agent or developer needs a package safety check during dependency selection. It is a package-vetting component rather than a general-purpose code analysis service.