🛡️ Introducing DepCheck — Our First MCP Server
Today we're releasing our first public MCP server: DepCheck — a dependency-vulnerability checker that plugs straight into your AI coding agent, so it can catch known-vulnerable packages before they ever enter your codebase.
Why an MCP, not just another scanner
Traditional dependency scanners run after the fact — in CI, on a schedule, or when someone remembers. By then the vulnerable package is already committed, and someone has to loop back to fix it.
DepCheck moves the check to the moment of decision. MCP servers let an AI coding agent call security tooling directly, as part of its own reasoning loop — no browser, no dashboard, no copy-paste. When your agent is about to add or upgrade a package, it asks DepCheck "is this version safe, and if not, what is?" — and picks a clean version the first time. The vulnerability never enters the tree.
DepCheck at a glance
| Server | DepCheck (vuln-mcp v0.2.0) |
| Public endpoint | https://mcp.cert-ix.com/depcheck |
| Transport | Streamable HTTP (MCP) — works with Claude, Cursor, VS Code, and any MCP client |
| Auth | API key, sent as Authorization: Bearer <key> |
| Tools | check_package, scan_dependencies, suggest_safe_version, get_advisory, get_cve_intel |
| Data | OSV (GHSA, Go vulndb, RustSec, PyPA, npm…) + deps.dev, served from the Cert-IX sovereign advisory mirror, enriched with CISA KEV / EPSS exploitation intel |
What it's good at
- Point checks — "Is
[email protected]on npm vulnerable?" → the advisories that affect exactly that version, plus the minimum safe upgrade. - Whole-manifest scans — hand it a lockfile or manifest and get back only the vulnerable packages, each with an upgrade target.
- Picking a safe version — the newest release of a package with zero known advisories.
- Prioritisation — advisories that are exploited in the wild (on the CISA KEV list, or with a high EPSS probability) are flagged and sorted first, so an actively-attacked Medium jumps ahead of a theoretical Critical.
- Advisory detail on demand — full CVSS vector, affected ranges, and references for any advisory ID.
It supports npm, Go, PyPI, crates.io (Rust), Maven, RubyGems, Packagist (PHP), NuGet, Hex (Elixir), and Pub (Dart).
Honest about its edges
DepCheck is deliberately scoped:
- It checks declared dependencies against published advisory data. It does not execute your code, run SAST/DAST, or analyse your application logic.
- Version ranges (
^,~,>=) are evaluated at their lower bound — to check what's actually installed, scan the lockfile, not just the manifest. - A "0 vulnerabilities" result means "nothing known as of this lookup", not a guarantee of safety.
- It's a decision aid, not a policy gate — enforcement stays in your pipeline.
This is how we build Cert-IX
DepCheck isn't a side project — it's the same rule every coding agent in the Cert-IX monorepo already follows: consult DepCheck before adding or pinning any dependency. We're now making that capability available to your agents too.
Get started
- MCPs overview — what DepCheck is and how it fits.
- Getting started — connect your MCP client to the hosted endpoint in a couple of minutes.
- Tools reference — every tool, its parameters, and example responses.
- Security & data handling — auth, rate limits, data residency, and what does (and does not) leave the Cert-IX perimeter.
DepCheck is the first of several agent-native security tools on our roadmap. Watch this space.