Depcheck

dev.kanekyPublished by kaneky.devOfficial publisherv0.2.0Updated Oct 24, 2026

Known vulnerabilities for exact package versions from OSV, with fixes. Paid per call, x402.

The publisher's own server: Canonsheet

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that looks up known vulnerabilities for exact package versions in the public OSV database, with fixes, paid per call.

What you can do
Check exact package versions against the public OSV database across npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub and Hex, 1 to 50 packages per call. For each package, return every OSV advisory for that version with its id, CVE/GHSA aliases, summary, severity and fix information.
When to use it
Useful when auditing dependencies or checking whether a specific pinned version of a package has known advisories before upgrading or shipping.
Requirements
A remote endpoint at depcheck.kaneky.dev over streamable HTTP; no account, API key or environment variables are declared. Calls are paid per use via x402, so a payment-capable client is needed.
Before you install
Each call is billed through x402, so usage costs money. Package names and versions you submit are sent to a third-party service and the public OSV database.

Installation

In SourceWeft

  1. Open Depcheck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.kaneky%2Fdepcheck/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "depcheck": {
      "type": "http",
      "url": "https://depcheck.kaneky.dev/mcp"
    }
  }
}

Tools

1

check_packages

Look up the known vulnerabilities affecting exact package versions in the public OSV database (npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist, Pub, Hex), 1 to 50 packages per call. Per package: every OSV advisory for that version with its id, CVE/GHSA aliases, summary, severity (database label, CVSS vectors, v3 base scores), the versions that fix it or "no fix published", published/modified dates and a link. Plus a summary: packages checked, packages vulnerable, total advisories and the highest severity. Evidence, not advice: absence from OSV does not prove safety.

Parameterspackagesrequired

Version history

2
  1. v0.2.0LatestOct 18, 2026
  2. v0.1.0Sep 25, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Kaneky integrations

Canonsheet

dev.kanekyOfficial publisher

Canonsheet builds a consistent prompt set for one human character — canonical image prompt, negative prompts, video prompt and optional contact sheet — for use.

Streamable HTTPWeb executable
Media & Design1 toolOct 24, 2026

Speak

dev.kanekyOfficial publisher

Remote MCP server that turns text into natural-sounding MP3 speech with 38 voices across 7 languages, paid per call.

Streamable HTTPWeb executable
Media & Design1 toolOct 26, 2026

Pagemd

dev.kanekyOfficial publisher

Pagmd is a remote MCP server that fetches a public web page and returns its main content as clean Markdown with metadata, billed per call.

Streamable HTTPWeb executable
Web Search & Scraping1 toolOct 27, 2026

Imagemeta

dev.kanekyOfficial publisher

Lets an assistant write SEO metadata such as title, alt text, keywords and copyright into JPEG, PNG or WebP images and get the modified image back.

Streamable HTTPWeb executable
Developer Tools1 toolOct 24, 2026