Vet

What safedep/vet MCP server does

The safedep/vet MCP server gives AI-assisted development workflows a way to vet open source packages before they are adopted. Its documented package coverage includes npm and PyPI. Checks focus on two concerns: known vulnerabilities and malicious code associated with a package.

This is useful when an AI coding tool recommends a dependency, generates a package manifest, or proposes adding a library to an existing project. The server can provide a local security checkpoint before the dependency is installed or merged. The available material describes the server at a capability level but does not list the names, parameters, or return formats of individual MCP tools.

How it works

The safedep/vet MCP server runs locally rather than requiring a hosted MCP endpoint. The repository describes local execution through Docker or a standalone binary. Its underlying vet project queries SafeDep threat intelligence for package security information. Malware-query checks are described as looking up packages in SafeDep’s known malicious-package database; the README states that this lookup does not require an API key.

The broader vet project also supports vulnerability analysis and security policy evaluation through its command-line workflow. However, the supplied MCP documentation excerpt does not establish which of those CLI features are exposed through MCP, so they should not be assumed to be available as server tools.

Setup and configuration

The source material identifies two local deployment options: run the server in Docker or use a standalone binary. The repository also provides installation methods for the broader vet CLI, including Homebrew, npm, Go installation, direct binaries, and a container image. Those commands are not sufficient evidence of the exact MCP server launch command, so an MCP client configuration should use the project’s dedicated MCP documentation rather than copying a generic vet CLI command.

No required environment variables, API keys, or client-specific settings are identified in the provided material. The README specifically says that querying known malicious packages with vet scan --malware-query needs no API key, but this does not document every possible configuration for the MCP server.

Tools and capabilities

Based on the supplied description, the safedep/vet MCP server supports:

• Checking npm packages for vulnerabilities.
• Checking PyPI packages for vulnerabilities.
• Detecting packages listed as malicious.
• Running locally with Docker or a standalone binary.
• Supporting automated package vetting from AI coding workflows.

The main vet project additionally lists Maven, Go, Ruby, Rust, and PHP packages, Docker and OCI images, SBOMs, and source repositories as supported inputs. The supplied MCP-specific material only confirms npm and PyPI, so the broader input list should not be treated as MCP coverage.

Limitations and notes

Some security features in the wider vet product depend on SafeDep Cloud. In particular, the README says zero-day malware detection through active static and dynamic behavioral analysis requires SafeDep Cloud access. The README also says active on-demand malware scanning has been retired in favor of querying the threat intelligence database. For the MCP server, the material confirms package vetting but does not clarify whether cloud-backed enrichment, policy filters, reporting formats, or CI integrations are exposed.

The provided information does not name compatible MCP clients, specify an MCP transport, or give an exact server startup command. Verify those details in the repository’s MCP documentation before configuring an agent.