Hound

io.github.tiluckdavePublished by GitHub account tiluckdavev0.2.1Updated Oct 24, 2026

The dependency bloodhound for AI coding agents. Zero API keys, zero config.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Hound is a local MCP server that lets an AI coding assistant check package dependencies for vulnerabilities, licenses, typosquatting and upgrade paths across 7.

What you can do
Audit a lockfile for vulnerabilities and license compliance against a policy, and scan popular packages for known issues. Get a package profile, a 0-100 score with letter grade, and a GO/CAUTION/NO-GO pre-install verdict. Compare two packages side by side and find the minimum safe upgrade version that resolves known vulnerabilities. Inspect the full resolved dependency tree with transitive dependencies and detect typosquatting variants of a package name. Look up full advisory details by GHSA, CVE or OSV ID. Run built-in prompts for a full security audit, package evaluation and pre-release check.
When to use it
Useful when an assistant recommends or installs packages and you want safety checks before adding a dependency, before merging a lockfile change, when auditing an inherited codebase, or when enforcing license compliance in a commercial project.
Requirements
Runs locally over stdio, typically launched with npx from the npm package hound-mcp, so Node.js and network access are needed. No API keys, accounts or configuration are declared; it queries the free public deps.dev and OSV APIs.
Before you install
Package names and lockfile contents are sent to the third-party deps.dev and OSV services. Results are advisory only, so treat verdicts and scores as guidance rather than a guarantee. It reads lockfiles and reports findings; the README does not describe write, install or delete actions.

Installation

In SourceWeft

  1. Open Hound in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Hound MCP

The dependency bloodhound for AI coding agents.

[npm version] [npm downloads] [CI] [License: MIT]

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

Quickstart

Claude Code

bash
claude mcp add hound -- npx -y hound-mcp

Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

json
{  "mcpServers": {    "hound": {      "command": "npx",      "args": ["-y", "hound-mcp"]    }  }}

VS Code (Copilot)

json
{  "mcp": {    "servers": {      "hound": {        "type": "stdio",        "command": "npx",        "args": ["-y", "hound-mcp"]      }    }  }}
Config file locations
ClientConfig path
Claude Desktop (macOS)~/Library/Application Support/Claude/claude_desktop_config.json
Cursor~/.cursor/mcp.json
Windsurf~/.codeium/windsurf/mcp_config.json

Tools

12 tools → Full reference with example outputs

ToolWhat it does
hound_audit ⭐Scan an entire lockfile for vulnerabilities across all dependencies
hound_score0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
hound_compareSide-by-side comparison of two packages with a recommendation
hound_preinstallGO / CAUTION / NO-GO verdict before installing a package
hound_upgradeFind the minimum safe version upgrade that resolves all known vulns
hound_license_checkScan a lockfile for license compliance against a policy
hound_vulnsAll known vulnerabilities for a package version, grouped by severity
hound_inspectFull package profile — license, vulns, scorecard, stars, dep count
hound_treeFull resolved dependency tree with transitive deps
hound_typosquatDetect typosquatting variants of a package name
hound_advisoriesFull advisory details by GHSA, CVE, or OSV ID
hound_popularScan popular packages for known vulnerabilities

Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

PromptWhat it does
security_auditFull project security audit — vulns, licenses, typosquats
package_evaluationGo/no-go recommendation before adding a new dependency
pre_release_checkPre-ship dependency scan that flags release blockers

Use Cases

→ See full examples with real lockfiles and expected output

  • Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
  • Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
  • Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
  • License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
  • CI security gate — ask your AI agent to run a security audit as part of every release check

Local Development

bash
git clone https://github.com/tiluckdave/hound-mcp.gitcd hound-mcppnpm installpnpm buildpnpm test         # run testspnpm check        # typecheck + lint + test

Roadmap

  • Docker support — run Hound as a container for CI/CD pipelines
  • bun.lockb parser — Bun lockfile support
  • gradle.lockfile parser — Gradle (Java/Android) ecosystem support
  • hound_diff tool — compare two lockfile snapshots to surface newly introduced risks
  • GitHub Action — run hound_audit as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

Community

💬 Questions or ideas? Open a Discussion

[Glama MCP server]

License

MIT © 2026 Tilak Dave

Source: README.md at commit 82fd52a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts