MCP Server

Active

MIT

io.github.tiluckdave/hound MCP Server

io.github.tiluckdave/hound

Dependency security scanner for AI coding agents—vulnerabilities, licenses, typosquatting across 7 ecosystems, zero API keys.

Repository Registry

What is the io.github.tiluckdave/hound MCP server?

Hound MCP is a dependency security scanner built for AI coding agents. It scans lockfiles and packages for vulnerabilities, license compliance issues, and typosquatting across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems—using only free public APIs (deps.dev and OSV) with zero configuration or authentication required.

Hound helps AI agents safely recommend and install packages by auditing dependencies for security risks before they're added to your project. It provides vulnerability scanning, license compliance checking, dependency tree analysis, and typosquatting detection across seven major package ecosystems. Works with Claude Code, Cursor, Windsurf, VS Code, and any MCP client.

How to install io.github.tiluckdave/hound

Copy-paste configuration for popular MCP clients.

transport: stdio

Config generated by PluginBench — verify against the source before use.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": [
        "-y",
        "hound-mcp"
      ]
    }
  }
}

Tools & capabilities

Tools this server exposes to the agent.

hound_audit — Scan an entire lockfile for vulnerabilities across all dependencies
hound_score — 0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
hound_compare — Side-by-side comparison of two packages with a recommendation
hound_preinstall — GO / CAUTION / NO-GO verdict before installing a package
hound_upgrade — Find the minimum safe version upgrade that resolves all known vulns
hound_license_check — Scan a lockfile for license compliance against a policy
hound_vulns — All known vulnerabilities for a package version, grouped by severity
hound_inspect — Full package profile — license, vulns, scorecard, stars, dep count
hound_tree — Full resolved dependency tree with transitive deps
hound_typosquat — Detect typosquatting variants of a package name
hound_advisories — Full advisory details by GHSA, CVE, or OSV ID
hound_popular — Scan popular packages for known vulnerabilities

Use cases

Scan lockfile diffs before merging PRs to catch newly introduced vulnerabilities
Audit inherited codebases to get a full security report in seconds
Check packages before adding them with GO/CAUTION/NO-GO verdicts
Ensure license compliance and prevent GPL/AGPL packages in commercial projects
Run security audits as part of CI/CD release checks

io.github.tiluckdave/hound MCP server FAQ

What is Hound MCP?

Hound is a dependency security scanner designed for AI coding agents. It scans packages and lockfiles for vulnerabilities, license issues, and typosquatting across 7 ecosystems (npm, PyPI, Go, Cargo, Maven, NuGet, RubyGems) using free public APIs.

Is Hound free?

Yes, Hound is completely free and open-source (MIT license). It uses only free, unauthenticated public APIs from Google (deps.dev and OSV).

Do I need API keys or authentication?

No. Hound requires zero API keys, zero configuration, and zero authentication. It works out of the box.

How do I install Hound in Cursor or Claude?

For Claude Code: run `claude mcp add hound -- npx -y hound-mcp`. For Cursor/Windsurf/Claude Desktop, add the server to your MCP config file with command `npx` and args `["-y", "hound-mcp"]`.

What ecosystems does Hound support?

Hound supports npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems. It can parse lockfiles from all these ecosystems.

Can I use Hound in CI/CD pipelines?

Yes. You can invoke `hound_audit` and other tools from your AI agent as part of CI/CD workflows. Docker support is on the roadmap.

README (reference)

Source of truth, from the repository.

Hound MCP

The dependency bloodhound for AI coding agents.

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

Quickstart

Claude Code

claude mcp add hound -- npx -y hound-mcp

Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": ["-y", "hound-mcp"]
    }
  }
}

VS Code (Copilot)

{
  "mcp": {
    "servers": {
      "hound": {
        "type": "stdio",
        "command": "npx",
        "args": ["-y", "hound-mcp"]
      }
    }
  }
}

Config file locations

Client	Config path
Claude Desktop (macOS)	`~/Library/Application Support/Claude/claude_desktop_config.json`
Cursor	`~/.cursor/mcp.json`
Windsurf	`~/.codeium/windsurf/mcp_config.json`

Tools

12 tools → Full reference with example outputs

Tool	What it does
`hound_audit` ⭐	Scan an entire lockfile for vulnerabilities across all dependencies
`hound_score`	0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
`hound_compare`	Side-by-side comparison of two packages with a recommendation
`hound_preinstall`	GO / CAUTION / NO-GO verdict before installing a package
`hound_upgrade`	Find the minimum safe version upgrade that resolves all known vulns
`hound_license_check`	Scan a lockfile for license compliance against a policy
`hound_vulns`	All known vulnerabilities for a package version, grouped by severity
`hound_inspect`	Full package profile — license, vulns, scorecard, stars, dep count
`hound_tree`	Full resolved dependency tree with transitive deps
`hound_typosquat`	Detect typosquatting variants of a package name
`hound_advisories`	Full advisory details by GHSA, CVE, or OSV ID
`hound_popular`	Scan popular packages for known vulnerabilities

Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

Prompt	What it does
`security_audit`	Full project security audit — vulns, licenses, typosquats
`package_evaluation`	Go/no-go recommendation before adding a new dependency
`pre_release_check`	Pre-ship dependency scan that flags release blockers

Use Cases

→ See full examples with real lockfiles and expected output

Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
CI security gate — ask your AI agent to run a security audit as part of every release check

Local Development

git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test         # run tests
pnpm check        # typecheck + lint + test

Roadmap

Docker support — run Hound as a container for CI/CD pipelines
bun.lockb parser — Bun lockfile support
gradle.lockfile parser — Gradle (Java/Android) ecosystem support
hound_diff tool — compare two lockfile snapshots to surface newly introduced risks
GitHub Action — run hound_audit as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

Community

💬 Questions or ideas? Open a Discussion

License

Related MCP servers

io.github.tim0-12432/HotkeylessAHK-mcp-skill

Active

MCP server for Hotkeyless AHK HTTP API.

TypeScript

MIT

View repository →

Agent Tavern

Public board where AI agents ask, answer and post findings across runtimes.

io.github.timbassler88/snapstate

Maintained

Persistent state for AI agent workflows. Save, resume, and replay multi-step workflows.

JavaScript

View repository →

io.github.timescale/pg-aiguide

Maintained

AI-optimized PostgreSQL expertise for coding assistants with semantic search and best-practice skills.

1.8k

Python

Apache-2.0

View repository →

Tiger MCP

Active

Manage Tiger Cloud databases and services directly from Claude, Cursor, and other AI assistants.

116

Apache-2.0

View repository →

io.github.timescale/tiger-skills

Maintained

Provider agnostic skills implementation, with skills sourced from local paths or GitHub repositories

TypeScript

Apache-2.0

View repository →