Dependency check

io.github.ladanyin由 GitHub 帳號 ladanyin 發布v1.0.0更新於 Nov 5, 2026

Check a package version for known vulnerabilities and Packagist release facts.

發布方自己的服務：check.tattoo: tattoo size and placement guide

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

服務詳細資訊

識別碼: io.github.ladanyin/dependency-check
傳輸: Streamable HTTP
執行環境: Web executable
信任: Verified
發布於: Nov 5, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此條目所屬的 GitHub 帳號 ladanyin。這並不表明該帳號就是產品方。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ladanyin%2Fdependency-check.svg)](https://sourceweft.com/mcp/io.github.ladanyin%2Fdependency-check?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

遠端 MCP 伺服器，讓助理在安裝前查詢某個套件版本的已知漏洞，並取得 Packagist 發行資訊。

可以做什麼: 查詢單一 PHP 套件的 Packagist 資訊：最新穩定版、所需 PHP 版本、授權條款、是否已棄用，以及指定版本的狀況
比對 OSV 公告檢查某個套件版本，回傳公告編號、摘要、CVE 別名、嚴重程度與修正版本
支援 packagist、npm、pypi、go、crates.io、maven、rubygems 與 nuget 等生態系
適用情境: 適合在助理準備新增或升級相依套件時做一次漏洞與發行資訊核查，例如執行 composer require 之前。
執行需求: 透過 streamable HTTP 連線到 deps.bestsmartgoods.com 遠端端點。需要 API 金鑰，放在 X-API-Key 標頭中；金鑰須在服務商註冊頁面取得，新金鑰附帶 20 點額度。

安裝前請注意

API 金鑰是每次呼叫都要送出的機密，應避免出現在日誌與共享紀錄中。README 提到額度與付費儲值，使用可能產生費用，請先確認目前價格。套件名稱與版本號會傳送到服務商服務及 OSV 查詢。

安裝

在 SourceWeft 中

開啟儀表板中的 Dependency check，將其新增到工作區。
連接 X-API-Key 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.ladanyin%2Fdependency-check/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "dependency-check": {
      "type": "http",
      "url": "https://deps.bestsmartgoods.com/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

Company lookup, invoice reading, citation check

Three remote MCP servers for other agents. One API key. New keys include 20 credits.

Get a key: https://firm.bestsmartgoods.com/signup

Buy credits: https://firm.bestsmartgoods.com/buy

Send the key on every call:

Company lookup

Find a company by name, registration number, or tax id. 0.05 credit per successful call.

MCP: https://firm.bestsmartgoods.com/mcp · tool lookup_company

bash

curl -X POST https://firm.bestsmartgoods.com/v1/companies/lookup \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"MOL Magyar Olaj\",\"country\":\"HU\"}"

curl -X POST https://firm.bestsmartgoods.com/v1/companies/lookup \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"MOL Magyar Olaj\",\"country\":\"HU\"}"

Invoice reading

Read an invoice or text file into seller, tax id, date, and amounts. 0.15 credit per successful call.

MCP: https://bill.bestsmartgoods.com/mcp · tool parse_invoice

bash

curl -X POST https://bill.bestsmartgoods.com/v1/invoices/parse \
  -H "X-API-Key: ak_..." \
  -F "[email protected]"

curl -X POST https://bill.bestsmartgoods.com/v1/invoices/parse \
  -H "X-API-Key: ak_..." \
  -F "[email protected]"

Citation check

[mcptry]

Check whether a URL supports a claim. 0.08 credit per successful call.

MCP: https://cite.bestsmartgoods.com/mcp · tool check_citation

bash

curl -X POST https://cite.bestsmartgoods.com/v1/citations/check \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"claim\":\"Example Domain is for use in documentation examples\",\"url\":\"https://example.com\"}"

curl -X POST https://cite.bestsmartgoods.com/v1/citations/check \
  -H "X-API-Key: ak_..." \
  -H "Content-Type: application/json" \
  -d "{\"claim\":\"Example Domain is for use in documentation examples\",\"url\":\"https://example.com\"}"

Prices

100 credits = 5 EUR
500 credits = 20 EUR
2000 credits = 60 EUR

來源：README.md，提交 3b6e3d2

工具

check_package

Check a Packagist package

Read the current Packagist facts for one PHP package: latest stable version, required PHP, license, and whether it is abandoned. Use it before composer require. Send vendor/package. Set version to ask about one release; version_found is false when that release is absent, and the latest stable is still returned. This does not list vulnerabilities. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

輸入參數name必填version

check_dependency

Check a dependency for known vulnerabilities

Look up known vulnerabilities for one package version from OSV. Returns advisory id, summary, CVE aliases, severity string, and fixed versions when the advisory lists them. Ecosystems: packagist, npm, pypi, go, crates.io, maven, rubygems, nuget. Omit ecosystem and a vendor/package name uses Packagist, otherwise npm. An empty list means OSV returned none, and that successful lookup is charged. This is not a full audit. The first 5 successful calls each UTC day from one network address are free and need no key. not_found and fetch_failed are not charged and do not use a free call. After the 5, send X-API-Key. A key call costs 0.04 credit on success. Key: https://firm.bestsmartgoods.com/signup

輸入參數name必填version必填ecosystem