Categories › Security › Code & dependency scanning
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Remote server: your requests and data go to api.kaiv.ai. Claude Code: claude mcp add --transport http dependency-trust https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
get_advisory — Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisorget_dependencies — Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Eget_package — List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-vget_package_version — Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, sget_project_health — Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a packagNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.