Official description7 sourcesMCP servers8d ago

safedep/vet

🎖️ 🏎️ ☁️ 🍎 🪟 🐧 - Locally check npm and PyPI packages, such as those suggested by AI coding tools, for…

View on GitHub ↗Direct link · no redirect page

Official description🎖️ 🏎️ ☁️ 🍎 🪟 🐧 - Locally check npm and PyPI packages, such as those suggested by AI coding tools, for vulnerabilities and malicious code.

Config template (adjust for your client)

claude mcp add vet -- npx -y vet

A pasteable skeleton generated from the repository name. Check the project README for the exact package and arguments.

Star count: 1,113 ★ · safedep/vet · read from the GitHub search API · (checked 2026-10-16 20:00:20)
Source: collected from the punkpeye/awesome-mcp-servers list · type: MCP server
Harvest history: first seen 2026-10-09 · last seen 2026-10-16 · seen 32× · listed by 7 sources
Score: score 703 · 1,113 ★ · 7 sources · mcp

FAQ (answers come from our records)

How do I install it?

We did not find an install command for this repository (our install coverage is only about 4%). Check its README or releases page.

Who is it for?

We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.

Who maintains it?

repository safedep/vet；first catalogued 2026-10-09；last seen 2026-10-16。There is no official certification or quality rating here — we record sources and dates only.

Third-party quality signals

Find malicious packages, vulnerabilities and risky CI workflows before they reac

以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →

Install • Docs • Commands • Policy • Discord
> [!NOTE]
> This branch is vet v2, in alpha. vet v1 is on main
> and stays the latest release. The v2.0.0 release notes map each
> v1 command and flag to v2.
Why vet
Your dependencies, your GitHub Actions workflows and your AI agent configs run code that you did
not write. vet finds the risk in them.
- **Malicious packages.** vet checks each package against SafeDep Threat Intel. Threat Intel
analyzes new package versions when the registries publish them.
- **Known vulnerabilities**, with the fixed version to upgrade to.
- **Risky workflows.** Dangerous triggers, template injection, exposed secrets and actions with no
pinned commit SHA.
- **Lockfile tampering and fresh versions.** Entries from an untrusted registry, and versions
inside the cooldown window.
- **Policy as code.** Rules in CEL decide when a scan fails. You can test a rule on a saved scan.
- **AI and crypto inventory.** vet lists the AI libraries and the crypto algorithms that your code
calls, and writes a CycloneDX xBOM and CBOM.
vet needs no account and sends no source code.
Quick start
Install
| Channel | Command |
| --- | --- |
| Homebrew | brew install --cask safedep/tap/vet@edge |
| mise | mise use -g 'github:safedep/vet[prerelease=true]@2' |
| Go | go install github.com/safedep/vet/v2/cmd/vet@latest |
| Container | docker run --rm -v "$PWD:/src" -w /src ghcr.io/safedep/vet:v2-latest scan |
mise installs a release one day after its publication. install.md has the
command for the newest build, the release binaries and the build attestations.
What vet scans
| Target | Example |
| --- | --- |
| A directory (the default) | vet scan, vet scan ./service |
| A git repository | vet scan https://github.com/safedep/vet |
| A container image | vet scan oci://alpine:3.20, vet scan image.tar |
| An SBOM (CycloneDX or SPDX) | vet scan sbom.cdx.json |
| One package | vet scan pkg:npm/express@4.19.2 |
| The tools on this machine | vet endpoint audit |
vet reads the lockfiles and manifests of npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet,
Packagist, Pub and more. It also reads the GitHub Actions workflows and the AI agent configs of the
target. It does not install or run any of them. Controls turn this data into findings. See
controls.md.
Policy
A policy decides when a scan fails. Save this file as vet-policy.yml:
`yaml
version: 2
rules:
- id: no-malware
description: A malicious or suspicious package fails the build.