@guardbee/mcp-dependency-auditor

@guardbee/mcp-dependency-auditor

🇬🇧 English | 🇹🇷 Türkçe

An MCP server that audits npm and pip manifests against the OSV database for known CVEs. A single-package lookup also covers PyPI, crates.io, Maven, Go, and RubyGems.

This package sends usage telemetry by default (tool name + short parameters — see @guardbee/mcp-telemetry). Disable with GUARDBEE_TELEMETRY=0.

Features

• OSV API Integration — Google's open-source vulnerability database (free, no authentication required)
• npm Support — reads package.json and package-lock.json (v1/v2/v3); locked versions preferred
• pip Support — requirements.txt, requirements/base.txt, requirements/prod.txt, and pyproject.toml
• Severity Scoring — Critical / High / Medium / Low based on CVSS score or a text heuristic
• Fix Version — an upgrade to X@Y.Z.Z recommendation when available
• CVE Links — direct links to NVD or osv.dev
• 24 Unit Tests — 100% passing test suite

Quick Start

npm install -g @guardbee/mcp-dependency-auditor

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "guardbee-dependency-auditor": {
      "command": "npx",
      "args": ["-y", "@guardbee/mcp-dependency-auditor"]
    }
  }
}

MCP Tools

Tool	Description
audit_npm	Audits npm dependencies in package.json / package-lock.json
audit_pip	Audits Python dependencies in requirements.txt / pyproject.toml
audit_package	Audits a single package by name, version, and ecosystem
audit_directory	Auto-detects and audits all supported manifest files

Example Usage

You can ask Claude:

"Audit my project's npm dependencies: /Users/me/my-app"

"Is there a CVE for lodash 4.17.20?"

"Scan my Python project: /Users/me/django-app"

Example Output

⚠️  Found 3 vulnerabilities in 2/142 npm packages (1243ms)
   Critical: 1  High: 1  Medium: 1  Low: 0  Unknown: 0

[CRITICAL] lodash@4.17.20
  ID      : GHSA-35jh-r3h4-6jhm (CVE-2021-23337)
  Summary : Command injection via template
  Fix     : upgrade to lodash@4.17.21
  Details : https://nvd.nist.gov/vuln/detail/CVE-2021-23337

Supported Ecosystems

The audit_package tool can query these ecosystems directly:

Ecosystem	Parameter
npm	npm
Python	PyPI
Rust	crates.io
Java	Maven
Go	Go
Ruby	RubyGems

CLI — CI/CD Integration

In addition to MCP server mode, this can also be used directly as a CLI:

# Audit all dependencies in a directory (npm + pip auto-detected)
npx @guardbee/mcp-dependency-auditor audit ./my-project

# npm only
npx @guardbee/mcp-dependency-auditor audit-npm . --fail-on=critical

# pip only
npx @guardbee/mcp-dependency-auditor audit-pip . --fail-on=high

# Single package
npx @guardbee/mcp-dependency-auditor audit-pkg lodash 4.17.20 npm

# JSON output
npx @guardbee/mcp-dependency-auditor audit . --format=json

Exit codes: 0 = clean · 1 = findings above threshold · 2 = error

GitHub Actions

name: Dependency Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci
      - name: Audit dependencies
        run: npx @guardbee/mcp-dependency-auditor audit . --fail-on=high

GitLab CI

dependency-audit:
  image: node:20
  script:
    - npx @guardbee/mcp-dependency-auditor audit . --fail-on=high
  only:
    - merge_requests
    - main

Pre-commit Hook

# .git/hooks/pre-push
npx @guardbee/mcp-dependency-auditor audit . --fail-on=critical || exit 1

Development

npm install
npm test          # 20 unit tests
npm run build     # TypeScript compile

License

MIT — GuardBee