Dependency check

io.github.ladanyinPublished by GitHub account ladanyinv1.0.0Updated Nov 5, 2026

Check a package version for known vulnerabilities and Packagist release facts.

The publisher's own server: check.tattoo: tattoo size and placement guide

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that lets an assistant check a package version for known vulnerabilities and look up Packagist release facts before installing it.

What you can do
  • Look up Packagist facts for one PHP package: latest stable version, required PHP, license, abandoned status, and details for a specific release
  • Check a package version against OSV advisories, returning advisory id, summary, CVE aliases, severity and fixed versions
  • Query across packagist, npm, pypi, go, crates.io, maven, rubygems and nuget ecosystems
When to use it
Useful when an assistant is about to add or upgrade a dependency and you want a quick vulnerability and release-facts check, for example before running composer require.
Requirements
A remote endpoint at deps.bestsmartgoods.com over streamable HTTP. A required API key sent in the X-API-Key header; keys are obtained from the provider's signup page and new keys include 20 credits.
Before you install
The API key is a secret sent on every call and should be kept out of logs and shared transcripts. The README describes a credit system with paid top-ups, so usage may cost money; check current pricing before relying on it. Package and version names are sent to the provider's service and to OSV lookups.

Installation

In SourceWeft

  1. Open Dependency check in the dashboard and add it to a workspace.
  2. Connect X-API-Key credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ladanyin%2Fdependency-check/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

Company lookup, invoice reading, citation check

Three remote MCP servers for other agents. One API key. New keys include 20 credits.

Get a key: https://firm.bestsmartgoods.com/signup

Buy credits: https://firm.bestsmartgoods.com/buy

Send the key on every call:

X-API-Key: ak_...

Company lookup

Find a company by name, registration number, or tax id. 0.05 credit per successful call.

MCP: https://firm.bestsmartgoods.com/mcp · tool lookup_company

bash
curl -X POST https://firm.bestsmartgoods.com/v1/companies/lookup \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"MOL Magyar Olaj\",\"country\":\"HU\"}"

Invoice reading

Read an invoice or text file into seller, tax id, date, and amounts. 0.15 credit per successful call.

MCP: https://bill.bestsmartgoods.com/mcp · tool parse_invoice

bash
curl -X POST https://bill.bestsmartgoods.com/v1/invoices/parse \
  -H "X-API-Key: ak_..." \
  -F "[email protected]"

Citation check

[mcptry]

Check whether a URL supports a claim. 0.08 credit per successful call.

MCP: https://cite.bestsmartgoods.com/mcp · tool check_citation

bash
curl -X POST https://cite.bestsmartgoods.com/v1/citations/check \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"claim\":\"Example Domain is for use in documentation examples\",\"url\":\"https://example.com\"}"

Prices

  • 100 credits = 5 EUR
  • 500 credits = 20 EUR
  • 2000 credits = 60 EUR

Source: README.md at commit 3b6e3d2

Tools

2

check_package

Check a Packagist package

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

Parametersnamerequiredversion

check_dependency

Check a dependency for known vulnerabilities

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

Parametersnamerequiredversionrequiredecosystem

Version history

1
  1. v1.0.0LatestNov 5, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Check integrations

check.tattoo: tattoo size and placement guide

tattoo.checkOfficial publisher

check.tattoo: tattoo size and placement guide's hosted MCP server, published by check.tattoo; no sign-in required; Streamable HTTP; 5 tools.

Streamable HTTPWeb executable
5 toolsOct 24, 2026

iva.pt — EU VAT check (VIES) and Portuguese VAT law

pt.ivaOfficial publisher

Validates EU VAT numbers against VIES and returns Portuguese VAT Code (CIVA) and RITI articles, in Portuguese or English.

Streamable HTTPWeb executable
Business & Commerce4 toolsOct 30, 2026

Dirtsmith Evidence Quote Check

Published by GitHub account throttler300

A local MCP server that binds an assistant's citations to admitted source text with spans and can reject stale-hash references.

STDIODesktop only
Knowledge & MemoryNot validated yetNov 7, 2026

HTTP Header Policy Check — HSTS, CSP & Frame Declarations

Published by GitHub account kriton-dev

Remote Apify-hosted MCP server that lets an assistant check seven declared HTTP security header families on a site, without returning raw header values.

Streamable HTTPWeb executableAuth
Security & MonitoringCredential requiredNov 7, 2026

VOOPA Render Check

Published by GitHub account Voopa-Corp

Reviews a completed AI-generated video against its brief and recommends whether to edit, retry once, or change approach before paying for another render.

Streamable HTTPWeb executable
AI & ML2 toolsNov 7, 2026