SafeDep Vet MCP

io.github.safedepPublished by GitHub account safedepv1.20.0Updated Oct 24, 2026

Protect your AI agents and IDEs from malicious open-source packages.

VerifiedSTDIODesktop onlyCloud & Infrastructure Developer Tools Security & Monitoring

Server details

Identifier: io.github.safedep/vet-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account safedep for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.safedep%2Fvet-mcp.svg)](https://sourceweft.com/mcp/io.github.safedep%2Fvet-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

SafeDep Vet MCP exposes the vet scanner so an assistant can check dependencies, CI workflows and agent configs for malicious packages and vulnerabilities.

What you can do: Scan a directory, git repository, container image, SBOM or single package for malicious packages, known vulnerabilities and risky GitHub Actions workflows
Check lockfiles and manifests across npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet, Packagist and Pub, plus AI agent configs, without installing or running them
Apply policy-as-code rules in CEL to decide when a scan fails, and test a rule against a saved scan
Produce reports such as SARIF, and CycloneDX xBOM and CBOM inventories of AI libraries and crypto usage
Audit a developer machine for AI tools, MCP servers, editor extensions and global npm packages
When to use it: Useful when you want an assistant to vet a project's dependencies, pull request changes or CI workflows before they reach production, or to gate builds on malware and vulnerability findings. Also suited to inventorying AI and crypto usage or auditing the tools installed on a machine.
Requirements: Runs as a local stdio process, distributed as a container image (ghcr.io/safedep/vet) run with Docker; the README also lists Homebrew, mise and Go install channels. No account, API key or environment variable is declared. Network access is needed to query SafeDep threat data.

Before you install

Package identities (ecosystem, name and version) are sent to SafeDep to retrieve data; source code and file content are not sent. Scans read project files and, for endpoint audit, enumerate tools installed on the machine. Policy rules can fail builds, so review them before use.

Installation

In SourceWeft

Open SafeDep Vet MCP in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[SafeDep vet]

Find malicious packages, vulnerabilities and risky CI workflows before they reach production.

[Release] [Build] [OpenSSF Scorecard] [License] [Discord]

Install • Docs • Commands • Policy • Discord

[!NOTE] This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2.

Why vet

Your dependencies, your GitHub Actions workflows and your AI agent configs run code that you did not write. vet finds the risk in them.

Malicious packages. vet checks each package against SafeDep Threat Intel. Threat Intel analyzes new package versions when the registries publish them.
Known vulnerabilities, with the fixed version to upgrade to.
Risky workflows. Dangerous triggers, template injection, exposed secrets and actions with no pinned commit SHA.
Lockfile tampering and fresh versions. Entries from an untrusted registry, and versions inside the cooldown window.
Policy as code. Rules in CEL decide when a scan fails. You can test a rule on a saved scan.
AI and crypto inventory. vet lists the AI libraries and the crypto algorithms that your code calls, and writes a CycloneDX xBOM and CBOM.

vet needs no account and sends no source code.

Quick start

[vet scan finds a malicious package, vulnerabilities and workflow injection]

bash

vet scan --fail-on high                         # exit 1 on a high or critical findingvet scan --base-ref origin/main --fail-on high  # report only what a pull request changesvet report show --report sarif=vet.sarif        # write SARIF from the saved scan, with no new scan

vet scan --fail-on high                         # exit 1 on a high or critical findingvet scan --base-ref origin/main --fail-on high  # report only what a pull request changesvet report show --report sarif=vet.sarif        # write SARIF from the saved scan, with no new scan

Install

Channel	Command
Homebrew	`brew install --cask safedep/tap/vet@edge`
mise	`mise use -g 'github:safedep/vet[prerelease=true]@2'`
Go	`go install github.com/safedep/vet/v2/cmd/vet@latest`
Container	`docker run --rm -v "$PWD:/src" -w /src ghcr.io/safedep/vet:v2-latest scan`

mise installs a release one day after its publication. install.md has the command for the newest build, the release binaries and the build attestations.

What vet scans

Target	Example
A directory (the default)	`vet scan`, `vet scan ./service`
A git repository	`vet scan https://github.com/safedep/vet`
A container image	`vet scan oci://alpine:3.20`, `vet scan image.tar`
An SBOM (CycloneDX or SPDX)	`vet scan sbom.cdx.json`
One package	`vet scan pkg:npm/[email protected]`
The tools on this machine	`vet endpoint audit`

vet reads the lockfiles and manifests of npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet, Packagist, Pub and more. It also reads the GitHub Actions workflows and the AI agent configs of the target. It does not install or run any of them. Controls turn this data into findings. See controls.md.

Policy

A policy decides when a scan fails. Save this file as vet-policy.yml:

yaml

version: 2rules:  - id: no-malware    description: A malicious or suspicious package fails the build.    when: finding.family == "malware"    action: fail  - id: no-workflow-injection    when: finding.control_id in ["dangerous-trigger", "template-injection"]    action: fail  - id: no-critical-vulnerability    when: finding.control_id == "vulnerability" && finding.severity == "critical"    action: fail  - id: new-dependency-age    description: A pull request cannot add a version that is less than 14 days old.    when: package.change == "ADDED" && has(package.days_since_publish) && package.days_since_publish < 14    action: failsuppressions:  - purl: pkg:npm/[email protected]    reason: The upgrade to 4.18.1 is in pull request 42.    expires: 2026-12-31

version: 2rules:  - id: no-malware    description: A malicious or suspicious package fails the build.    when: finding.family == "malware"    action: fail  - id: no-workflow-injection    when: finding.control_id in ["dangerous-trigger", "template-injection"]    action: fail  - id: no-critical-vulnerability    when: finding.control_id == "vulnerability" && finding.severity == "critical"    action: fail  - id: new-dependency-age    description: A pull request cannot add a version that is less than 14 days old.    when: package.change == "ADDED" && has(package.days_since_publish) && package.days_since_publish < 14    action: failsuppressions:  - purl: pkg:npm/[email protected]    reason: The upgrade to 4.18.1 is in pull request 42.    expires: 2026-12-31

Test it on the last scan, with no new scan. Then apply it to a pull request:

bash

vet report show last --policy vet-policy.ymlvet scan --base-ref origin/main --policy vet-policy.yml

vet report show last --policy vet-policy.ymlvet scan --base-ref origin/main --policy vet-policy.yml

After its expiry date, the suppression no longer hides the finding. Read policy.md for the rule fields, more rules and the Agent Skill that writes a policy for you.

Use cases

Pull request check. The vet GitHub Action comments on a pull request that adds a package, a workflow or a finding, and fails the check on an attack. vet ci init adds it to a repository.
CI gate. Exit codes, SARIF for GitHub code scanning, GitLab and Bitbucket reports. See ci.md.
Pull request review. --base-ref reports only the packages and workflows that a change adds.
xBOM and CBOM. A CycloneDX 1.7 inventory of the AI libraries and the crypto that your code uses. See inventory.md.
AI agents. vet finds Claude Code and other agents, and then writes JSON and never prompts.
Endpoint audit. vet endpoint audit lists the AI tools, MCP servers, editor extensions and global npm packages on a developer machine, and checks them for malware.

Documentation

Page	Read it for
Install	All channels and how to verify a release
Commands	Every command, its flags and its exit codes
Controls	The controls and their options
Policy	Rules, suppressions and the gate
Output	Report formats, saved scans and configuration
CI and AI agents	GitHub Actions, GitLab, Bitbucket and agent mode
Inventory	Code usage, AI and crypto, xBOM and CBOM

Privacy

vet sends the identity of each package (its ecosystem, name and version) to SafeDep to get the data about it. vet sends no source code and no file content.

Community

Ask questions and share ideas on Discord or in GitHub Discussions.
Report a bug in the issue tracker.
Read the contributing guide before you open a pull request.

vet also runs in the cloud. SafeDep Cloud runs vet on your repositories, with no infrastructure to manage.

[Contributors to vet]

Source: README.md at commit b62453f

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.20.0LatestOct 7, 2026
v1.19.1Sep 16, 2026
v1.19.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts