SafeDep Vet MCP

What SafeDep Vet MCP MCP server does

SafeDep Vet MCP MCP server exposes the security analysis capabilities of SafeDep vet for use alongside AI agents and development tools. The underlying vet project examines open-source dependencies and can identify known malicious packages, prioritize vulnerabilities according to actual code usage, evaluate licenses, and apply policy rules.

The scanner supports package ecosystems including npm, PyPI, Maven, Go, Ruby, Rust, and PHP. It can also inspect Docker and OCI images, CycloneDX and SPDX SBOMs, and repositories hosted on GitHub or GitLab. These inputs make it suitable for checking project dependencies as well as artifacts that are not represented by a local package directory.

How it works

SafeDep vet follows a pipeline. Readers collect package information from directories, repositories, container images, or SBOMs. Enrichers obtain vulnerability, malware, and scorecard information from SafeDep Cloud. A CEL policy engine evaluates the resulting data, and reporters produce formats such as SARIF, JSON, and Markdown.

Malware checks query SafeDep’s known malicious-package database. The database is continuously populated through static and dynamic behavioral analysis in SafeDep Cloud, with human review for high-impact findings.

For vulnerability review, vet considers how dependencies are used in the analyzed code rather than reporting every possible issue without context. Policies can block critical vulnerabilities, disallowed licenses, or packages below a required OpenSSF Scorecard threshold.

Setup and configuration

Example commands include scanning the current directory with vet scan -D . --malware-query and running the scanner in Docker with a mounted workspace.

Tools and capabilities

SafeDep Vet MCP MCP server is documented at the repository level through these vet capabilities:

• Query known malicious packages with --malware-query.
• Scan dependencies for vulnerability findings and usage evidence.
• Evaluate CEL policies for vulnerabilities, licenses, and scorecard values.
• Inspect VS Code extensions, GitHub Actions directories, and container images.
• Read package data from multiple ecosystems, repositories, and SBOM formats.
• Produce SARIF, JSON, CSV, or Markdown reports through vet’s reporting pipeline.

Limitations and notes

The --malware option is deprecated but retained as a compatibility alias for --malware-query. The vet inspect malware command is also deprecated.