Dependency check

io.github.ladanyin由 GitHub 账号 ladanyin 发布v1.0.0更新于 Nov 5, 2026

Check a package version for known vulnerabilities and Packagist release facts.

发布方自己的服务：check.tattoo: tattoo size and placement guide

已验证Streamable HTTP可网页运行开发者工具安全与监控

服务详情

标识符: io.github.ladanyin/dependency-check
传输: Streamable HTTP
运行时: Web executable
信任: Verified
发布于: Nov 5, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 ladanyin。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ladanyin%2Fdependency-check.svg)](https://sourceweft.com/mcp/io.github.ladanyin%2Fdependency-check?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

远程 MCP 服务器，让助手在安装前查询某个包版本的已知漏洞，并获取 Packagist 发布信息。

可以做什么: 查询单个 PHP 包的 Packagist 信息：最新稳定版、所需 PHP 版本、许可证、是否已弃用，以及指定版本的情况
对照 OSV 公告检查某个包版本，返回公告编号、摘要、CVE 别名、严重程度和修复版本
支持 packagist、npm、pypi、go、crates.io、maven、rubygems 和 nuget 等生态
适用场景: 适合在助手准备新增或升级依赖时做一次漏洞与发布信息核查，例如执行 composer require 之前。
运行要求: 通过 streamable HTTP 连接 deps.bestsmartgoods.com 远程端点。需要 API 密钥，放在 X-API-Key 请求头中；密钥需在服务商注册页面获取，新密钥附带 20 点额度。

安装前请注意

API 密钥是每次调用都要发送的机密，应避免出现在日志和共享记录中。README 提到额度与付费充值，使用可能产生费用，请先确认当前价格。包名和版本号会发送到服务商服务及 OSV 查询。

安装

在 SourceWeft 中

打开控制台中的 Dependency check，将其添加到工作区。
连接 X-API-Key 凭据。它们会被私密存储，绝不会在公开页面上展示。
为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.ladanyin%2Fdependency-check/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

Company lookup, invoice reading, citation check

Three remote MCP servers for other agents. One API key. New keys include 20 credits.

Get a key: https://firm.bestsmartgoods.com/signup

Buy credits: https://firm.bestsmartgoods.com/buy

Send the key on every call:

Company lookup

Find a company by name, registration number, or tax id. 0.05 credit per successful call.

MCP: https://firm.bestsmartgoods.com/mcp · tool lookup_company

bash

curl -X POST https://firm.bestsmartgoods.com/v1/companies/lookup \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"MOL Magyar Olaj\",\"country\":\"HU\"}"

curl -X POST https://firm.bestsmartgoods.com/v1/companies/lookup \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"MOL Magyar Olaj\",\"country\":\"HU\"}"

Invoice reading

Read an invoice or text file into seller, tax id, date, and amounts. 0.15 credit per successful call.

MCP: https://bill.bestsmartgoods.com/mcp · tool parse_invoice

bash

curl -X POST https://bill.bestsmartgoods.com/v1/invoices/parse \
  -H "X-API-Key: ak_..." \
  -F "[email protected]"

curl -X POST https://bill.bestsmartgoods.com/v1/invoices/parse \
  -H "X-API-Key: ak_..." \
  -F "[email protected]"

Citation check

[mcptry]

Check whether a URL supports a claim. 0.08 credit per successful call.

MCP: https://cite.bestsmartgoods.com/mcp · tool check_citation

bash

curl -X POST https://cite.bestsmartgoods.com/v1/citations/check \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"claim\":\"Example Domain is for use in documentation examples\",\"url\":\"https://example.com\"}"

curl -X POST https://cite.bestsmartgoods.com/v1/citations/check \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"claim\":\"Example Domain is for use in documentation examples\",\"url\":\"https://example.com\"}"

Prices

100 credits = 5 EUR
500 credits = 20 EUR
2000 credits = 60 EUR

来源：README.md，提交 3b6e3d2

工具

check_package

Check a Packagist package

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

输入参数name必填version

check_dependency

Check a dependency for known vulnerabilities

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

输入参数name必填version必填ecosystem