Google deps.dev OpenSSF Security Scorecard & Dependency Audit

io.ceadigitalPublished by ceadigital.ioOfficial publisherv1.0.0Updated Nov 6, 2026

Google Open Source Insights (deps.dev) OpenSSF Security Scorecard & dependency tree audit.

The publisher's own server: CEA Digital B2A Fulfillment Factory

VerifiedStreamable HTTPWeb executableFinanceDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that lets an assistant audit open-source dependencies with Google deps.dev and OpenSSF Scorecards, plus many public-data lookups.

What you can do
  • Check packages and repositories: deps.dev/OpenSSF scorecards, NPM and PyPI health, OSV vulnerability audits, CISA KEV and EPSS exploit scores, crt.sh certificate recon
  • Look up companies and finance: GLEIF LEI, SEC EDGAR filings, CFPB complaints, USASpending awards, FDIC bank metrics, NY Fed SOFR rates
  • Search reference data: Google Cloud and Vertex AI catalog, a transcript and knowledge-graph vault, OpenAlex citations, USGS seismic data, NPI medical registry, DexScreener token data
  • Build composite dossiers: counterparty verification and cyber supply-chain security scores joining several sources
  • Record agent audit trails with a hash-chained compliance notary, and request feedback or a rate…
When to use it
Useful when an assistant needs to vet third-party packages or repositories before adoption, check whether a CVE is actively exploited, or assemble quick due-diligence on a company, vendor or counterparty from public sources.
Requirements
Remote streamable HTTP endpoint; no packages, environment variables or headers declared. Some tools are described as paid per call in USDC on Base, and one tool mints a free starter bearer token.
Before you install
Several tools are described as charging per call in USDC on Base, so an assistant could spend funds; the token, transaction-simulation and web-grounding tools touch crypto wallets and external web content. The notary tool writes tamper-evident audit records. Queries go to many third-party public data services, and the feedback tool is interactive.

Installation

In SourceWeft

  1. Open Google deps.dev OpenSSF Security Scorecard & Dependency Audit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.ceadigital%2Fdepsdev-openssf-scorecard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "google-deps-dev-openssf-security-scoreca": {
      "type": "http",
      "url": "https://ceadigital.io/mcp/depsdev"
    }
  }
}

Tools

27

sec_edgar_cik_lookup

SEC EDGAR company submission facts, quarterly filings, and CIK lookup under Lowe v. SEC Publisher's Exclusion.

Parameterscikticker

github_repo_pulse

Extract repository activity pulse (stars, forks, open issues, license, last push) with ETag caching.

Parametersreporequiredownerrequired

security_cve_audit

Audit package vulnerabilities and CVE advisories via OSV.dev database.

Parameterspackagerequiredversionecosystem

package_health_pulse

Parallel health pulse inspection across NPM and PyPI ecosystems.

Parameterspackage_namerequired

fdic_bank_health

Factual public supervisory bank health and branch metrics compiled from FDIC under 12 CFR Part 328.

Parameterscertnamelimit

openalex_citation_graph

Academic citation graph metadata and scholarly network metrics from OpenAlex (CC0).

Parametersdoilimitquerywork_id

usgs_seismic_hazard

Seismic activity and earthquake risk profiles from USGS GeoJSON services.

Parameterslimitendtimelatitudelongitudestarttimemaxradiuskmminmagnitude

dexscreener_token_audit

Real-time DEX liquidity, price, pair volume, and market cap analytics via DexScreener.

Parametersquerychain_idtoken_address

npi_medical_registry

CMS NPPES NPI Registry lookup for healthcare organizations and facilities (NPI-2 only, HIPAA safe harbor).

Parameterscitylimitstatenumberpostal_codeorganization_name

crtsh_cert_recon

Query Sectigo Certificate Transparency logs (crt.sh) for issued SSL/TLS certificates and subdomains.

Parametersdomainrequired

epss_exploit_score

Query FIRST.org Exploit Prediction Scoring System (EPSS) for 30-day real-world exploit probability.

Parameterscverequired

gleif_lei_kyb

Query Global Legal Entity Identifier Foundation (GLEIF) registry for corporate KYB and LEI records.

Parametersnamerequired

cfpb_complaints

Query US Consumer Financial Protection Bureau (CFPB) complaint database (17 U.S.C. § 105 public domain).

Parameterscompanyrequired

usaspending_awards

Query USASpending.gov Federal Awards and Contractor Intelligence (17 U.S.C. § 105 public domain).

Parametersrecipientrequired

depsdev_openssf_scorecard

Query Google Open Source Insights (deps.dev) and Linux Foundation OpenSSF Security Scorecard (0-10) for any GitHub repository or package (#1 in MCP Registry).

Parameterspackageecosystemgithub_repo

nyfed_sofr_reference_rates

Query Federal Reserve Bank of New York official Secured Overnight Financing Rate (SOFR) benchmark rates, percentiles, and daily repo volume (#1 in MCP Registry).

Parameterslimit

cisa_kev_exploited_vulns

Query US CISA Known Exploited Vulnerabilities (KEV) Catalog for active in-the-wild exploitation, mandatory federal patch due dates, and ransomware usage.

Parameterscvelimitvendor

corporate_kyb_and_risk_dossier

5-Source Parallel Composite Dossier: Joins GLEIF LEI + SEC EDGAR + CFPB Complaints + USASpending Federal Awards + FDIC in <400ms with a 0-100 Counterparty Verification Score.

Parameterstickercompany_namerequired

cyber_supply_chain_security_dossier

5-Source Parallel Security Dossier: Joins crt.sh SSL Certs + Google deps.dev OpenSSF Scorecard + FIRST.org EPSS + CISA KEV + OSV.dev CVEs in <400ms with a 0-100 Security Posture Score.

Parameterscvedomainpackageecosystemgithub_repo

agent_compliance_notary_attest

Tamper-evident SHA-256 hash-chained Agent Decision & Compliance Notary for EU AI Act, NIST AI RMF, and SOC2 autonomous agent audit trails.

Parameterssummaryrequiredagent_idaction_typepayload_sha256

submit_feedback_or_rate_quote

Free interactive MCP feedback, feature requests, and custom rate quote negotiation (alias: submit_mcp_feedback_or_request).

Parametersratingmessagerequiredcategorymcp_targetsource_surfaceagent_or_contactdesired_rate_usd

agent_token_intel_and_honeypot

High-velocity Agent Operational Primitive ($0.005 USDC on Base): Real-time DEX pool liquidity, 24h volume, buy/sell execution symmetry, Base bytecode check, and deterministic 0-100 Honeypot & Anti-Rug Safety Score.

Parameterschaintoken_addressrequired

agent_clean_web_grounding

High-velocity Agent Operational Primitive ($0.008 USDC on Base): Fast, token-optimized real-time web grounding & clean Markdown synthesis stripped of HTML bloat, ads, and scripts for LLM context windows.

Parameterslimitqueryrequired

agent_base_tx_simulate

High-velocity Agent Operational Primitive ($0.005 USDC on Base): Pre-execution Base L2 (eip155:8453) calldata simulator & wallet drain guard via eth_call + eth_estimateGas + unlimited ERC-20 approve detection.

Parametersdatavalue_weito_addressrequiredfrom_address

provision_free_developer_key

FREE Self-Serve API Key Generator: Instantly mints a 50-call free starter `cea_live_` Bearer token with copy-paste snippets for Claude Desktop, Cursor, Windsurf, ElizaOS, and Coinbase AgentKit.

Parameterscontactframeworkagent_name

Version history

1
  1. v1.0.0LatestNov 6, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Ceadigital integrations

CEA Digital B2A Fulfillment Factory

io.ceadigitalOfficial publisher

CEA Digital B2A Fulfillment Factory's hosted MCP server, published by ceadigital.io; no sign-in required; Streamable HTTP; 4 tools.

Streamable HTTPWeb executable
Cloud & Infrastructure4 toolsNov 5, 2026

NY Fed SOFR, EFFR & OBFR Overnight Benchmark Reference Rates

io.ceadigitalOfficial publisher

Remote MCP server exposing NY Fed SOFR, EFFR and OBFR overnight benchmark rates alongside many public-data lookups and paid agent utilities.

Streamable HTTPWeb executable
Web Search & Scraping27 toolsNov 6, 2026

5-Source Parallel Corporate KYB & Counterparty Risk Dossier

io.ceadigitalOfficial publisher

Remote MCP server that joins public corporate, financial, security and crypto data sources into KYB and risk dossiers for an assistant.

Streamable HTTPWeb executable
Finance27 toolsNov 6, 2026

US CISA Known Exploited Vulnerabilities (KEV) & Ransomware Audit

io.ceadigitalOfficial publisher

Remote MCP server for querying the US CISA Known Exploited Vulnerabilities catalog and ransomware usage, alongside many other public-data lookups.

Streamable HTTPWeb executable
Finance27 toolsNov 6, 2026

Base L2 Transaction Simulator & Wallet Drain Guard

io.ceadigitalOfficial publisher

Remote MCP server that simulates Base L2 transactions before execution and flags wallet-draining ERC-20 approvals, alongside many public-data lookup tools.

Streamable HTTPWeb executable
Finance27 toolsNov 6, 2026