Dependency Trust
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Connect it
Settings → Connectors → Add custom connector
URL: https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06dSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d{
"mcpServers": {
"dependency-trust": {
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
}
}claude mcp add --transport http dependency-trust https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d{
"servers": {
"dependency-trust": {
"type": "http",
"url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
}
}
}5 tools, verified live
get_advisoryread-onlyGet a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has
get_dependenciesread-onlyGet the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
get_packageread-onlyList every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
get_package_versionread-onlyGet license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
get_project_healthread-onlyGet a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus star
Alternatives in AI & Agents
Compare →SASigRank — AI Operator BenchmarkingA
SigRank benchmark MCP: cascade metrics, leaderboard, operator profiles, simulation, diagnostics.
LSLumify Sports IntelligenceA
Schedules, scores, odds, splits & explainable AI bet confidence — 8+ sports, free instant key.
QTQase Test ManagementB
Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.
Startup Valuation MCP ServerB
Startup valuation for AI agents: 14 tools, 80+ pre-revenue formulas.
SMSmartBear MCPB
MCP server for AI access to SmartBear tools, including BugSnag, Reflect, Swagger, PactFlow, QTM4J.
AGAgentDataB
Free company data for AI agents: profiles, tech stacks, contact details and people. No sign-in.