广告合作
MCP.so
登录
H

Hound MCP Server

@tiluckdave

代码仓库

基本信息

分类

其他

传输方式

stdio

作者

tiluckdave

提交者

Tilak Dave

关于 Hound MCP Server

The dependency bloodhound for AI coding agents.

Hound MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": [
        "-y",
        "hound-mcp"
      ]
    }
  }
}

Hound MCP Server 工具

12

List all known vulnerabilities for a specific package version, grouped by severity with fix versions and advisory links.

Get a comprehensive profile of a package version: licenses, vulnerabilities, OpenSSF scorecard, GitHub stats, and dependency count — all in one call.

Show the full resolved dependency tree for a package version, including all transitive dependencies with their depth and relation type.

Check if a package name looks like a typosquat of a popular package. Generates likely typo variants and checks which ones exist in the registry.

Get full details for a security advisory by ID (GHSA, CVE, or OSV ID). Returns title, severity, affected versions, fix versions, and references.

Scan a list of popular (or user-specified) packages for known vulnerabilities. Quickly surface which widely-used packages in an ecosystem have open security issues.

Scan a project's lockfile for dependency risks. Parses package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock, or Pipfile.lock and batch-queries OSV for vulnerabilities across all dependencies.

Side-by-side comparison of two packages: vulnerabilities, OpenSSF Scorecard, GitHub stars, release recency, and license. Returns a recommendation.

Scan a lockfile for license compliance. Resolves licenses for every dependency and flags packages that violate the chosen policy (permissive, copyleft, or none).

Safety check before installing a package. Checks known vulnerabilities, typosquatting risk, abandonment, and license concerns. Returns a go/no-go verdict.

Compute a 0-100 Hound Score for a package version combining vulnerability severity, OpenSSF Scorecard, release recency, and license risk. Returns a letter grade (A-F) with a breakdown.

Find the minimum version upgrade that resolves all known vulnerabilities for a package. Checks every published version and returns the nearest safe one.

概览

What is Hound MCP?

Hound MCP is a dependency security scanner built specifically for AI coding agents. It checks for vulnerabilities, licenses, typosquatting, and audits dependency trees across seven ecosystems (npm, PyPI, Go, Cargo, Maven, NuGet, RubyGems) using free, unauthenticated public APIs (deps.dev and OSV). It requires zero configuration, zero API keys, and zero cost.

How to use Hound MCP?

Install and configure Hound MCP as a stdio MCP server. For Claude Code, run claude mcp add hound -- npx -y hound-mcp. For Claude Desktop, Cursor, Windsurf, or VS Code (Copilot), add a JSON entry to the respective MCP config file pointing to npx -y hound-mcp. After setup, invoke its 12 tools (e.g., hound_audit, hound_preinstall) or its 3 built-in prompts (security_audit, package_evaluation, pre_release_check) directly from your AI client.

Key features of Hound MCP

  • Scans lockfiles for vulnerabilities across all dependencies
  • Provides 0–100 Hound Score with letter grade
  • Side-by-side comparison of two packages with recommendation
  • Pre-installation verdict: GO, CAUTION, or NO-GO
  • Finds minimum safe version upgrade that resolves known vulns
  • Detects typosquatting variants of a package name
  • Supports npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems

Use cases of Hound MCP

  • Scanning a lockfile diff before merging a PR to catch new vulnerabilities
  • Auditing an inherited codebase with hound_audit for a full report
  • Checking a package before adding it using hound_preinstall for a verdict
  • Running hound_license_check to ensure no GPL/AGPL packages in a commercial project
  • Using a security audit as part of every release check in CI

常见问题

1

How does Hound MCP work without API keys or accounts?

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

2

What ecosystems does Hound MCP support?

npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems.

3

How do I install and configure Hound MCP?

Use `npx -y hound-mcp` as the command in your MCP config file, or for Claude Code run `claude mcp add hound -- npx -y hound-mcp`. Config file locations are provided for Claude Desktop, Cursor, and Windsurf.

4

Does Hound MCP require any dependencies or runtime?

It requires Node.js and runs via npx. No other dependencies, API keys, or accounts are needed.

5

What tools does Hound MCP offer?

12 tools including `hound_audit`, `hound_score`, `hound_compare`, `hound_preinstall`, `hound_upgrade`, `hound_license_check`, `hound_vulns`, `hound_inspect`, `hound_tree`, `hound_typosquat`, `hound_advisories`, and `hound_popular`.

评论

其他 分类下的更多 MCP 服务器

Volley.sh

Volley

A good sequence diagram can solve almost any communication problem in engineering. Volley lets your agent write them as plain text, with the real request and response payloads on every arrow. It checks its own syntax wi

Codelf

unbug

A search tool helps dev to solve the naming things problem.

14.2K

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

Figs, Relationship Expert

Figs O'Sullivan, LMFT

Couples therapist Figs O'Sullivan (LMFT, 17 years, endorsed by Sue Johnson, creator of EFT) inside your AI. Ask relationship questions answered from his clinical writing, name the pattern in a fight, get a three-step rep

广告合作