官方说明7 个来源MCP 服务8 天前
safedep/vet
🎖️ 🏎️ ☁️ 🍎 🪟 🐧 - Locally check npm and PyPI packages, such as those suggested by AI coding tools, for…
在 GitHub 查看 ↗直链 · 无中转页
官方说明🎖️ 🏎️ ☁️ 🍎 🪟 🐧 - Locally check npm and PyPI packages, such as those suggested by AI coding tools, for vulnerabilities and malicious code.
配置模板（请按你的客户端调整）
claude mcp add vet -- npx -y vet
这是根据仓库名生成的可粘贴骨架，命令行参数与包名请以该项目 README 为准。
- ★ 数取值
- 1,113 ★ · safedep/vet · 取自 GitHub 搜索 API · （2026-10-16 20:00:20 核对）
- 来源明细
- 收录自 punkpeye/awesome-mcp-servers 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-10-09 · 最近见到 2026-10-16 · 共见到 32 次 · 被 7 个来源列出
- 评分构成
- 综合分 703 · 1,113 ★ · 7 个来源 · mcp
常见问题（答案都来自我们的记录）
怎么安装？
我们【没有】从该仓库取到安装命令（我们的 install 覆盖率只有约 4%）。请看它的 README 或 releases 页。
它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
仓库
safedep/vet；我们收录于 2026-10-09；最近见到 2026-10-16。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。第三方质量标记
Find malicious packages, vulnerabilities and risky CI workflows before they reac
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Install • Docs • Commands • Policy • Discord
> [!NOTE]
> This branch is vet v2, in alpha. vet v1 is on main
> and stays the latest release. The v2.0.0 release notes map each
> v1 command and flag to v2.
Why vet
Your dependencies, your GitHub Actions workflows and your AI agent configs run code that you did
not write. vet finds the risk in them.
- **Malicious packages.** vet checks each package against SafeDep Threat Intel. Threat Intel
analyzes new package versions when the registries publish them.
- **Known vulnerabilities**, with the fixed version to upgrade to.
- **Risky workflows.** Dangerous triggers, template injection, exposed secrets and actions with no
pinned commit SHA.
- **Lockfile tampering and fresh versions.** Entries from an untrusted registry, and versions
inside the cooldown window.
- **Policy as code.** Rules in CEL decide when a scan fails. You can test a rule on a saved scan.
- **AI and crypto inventory.** vet lists the AI libraries and the crypto algorithms that your code
calls, and writes a CycloneDX xBOM and CBOM.
vet needs no account and sends no source code.
Quick start
Install
| Channel | Command |
| --- | --- |
| Homebrew | brew install --cask safedep/tap/vet@edge |
| mise | mise use -g 'github:safedep/vet[prerelease=true]@2' |
| Go | go install github.com/safedep/vet/v2/cmd/vet@latest |
| Container | docker run --rm -v "$PWD:/src" -w /src ghcr.io/safedep/vet:v2-latest scan |
mise installs a release one day after its publication. install.md has the
command for the newest build, the release binaries and the build attestations.
What vet scans
| Target | Example |
| --- | --- |
| A directory (the default) | vet scan, vet scan ./service |
| A git repository | vet scan https://github.com/safedep/vet |
| A container image | vet scan oci://alpine:3.20, vet scan image.tar |
| An SBOM (CycloneDX or SPDX) | vet scan sbom.cdx.json |
| One package | vet scan pkg:npm/express@4.19.2 |
| The tools on this machine | vet endpoint audit |
vet reads the lockfiles and manifests of npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet,
Packagist, Pub and more. It also reads the GitHub Actions workflows and the AI agent configs of the
target. It does not install or run any of them. Controls turn this data into findings. See
controls.md.
Policy
A policy decides when a scan fails. Save this file as vet-policy.yml:
`yaml
version: 2
rules:
- id: no-malware
description: A malicious or suspicious package fails the build.
> [!NOTE]
> This branch is vet v2, in alpha. vet v1 is on main
> and stays the latest release. The v2.0.0 release notes map each
> v1 command and flag to v2.
Why vet
Your dependencies, your GitHub Actions workflows and your AI agent configs run code that you did
not write. vet finds the risk in them.
- **Malicious packages.** vet checks each package against SafeDep Threat Intel. Threat Intel
analyzes new package versions when the registries publish them.
- **Known vulnerabilities**, with the fixed version to upgrade to.
- **Risky workflows.** Dangerous triggers, template injection, exposed secrets and actions with no
pinned commit SHA.
- **Lockfile tampering and fresh versions.** Entries from an untrusted registry, and versions
inside the cooldown window.
- **Policy as code.** Rules in CEL decide when a scan fails. You can test a rule on a saved scan.
- **AI and crypto inventory.** vet lists the AI libraries and the crypto algorithms that your code
calls, and writes a CycloneDX xBOM and CBOM.
vet needs no account and sends no source code.
Quick start
Install
| Channel | Command |
| --- | --- |
| Homebrew | brew install --cask safedep/tap/vet@edge |
| mise | mise use -g 'github:safedep/vet[prerelease=true]@2' |
| Go | go install github.com/safedep/vet/v2/cmd/vet@latest |
| Container | docker run --rm -v "$PWD:/src" -w /src ghcr.io/safedep/vet:v2-latest scan |
mise installs a release one day after its publication. install.md has the
command for the newest build, the release binaries and the build attestations.
What vet scans
| Target | Example |
| --- | --- |
| A directory (the default) | vet scan, vet scan ./service |
| A git repository | vet scan https://github.com/safedep/vet |
| A container image | vet scan oci://alpine:3.20, vet scan image.tar |
| An SBOM (CycloneDX or SPDX) | vet scan sbom.cdx.json |
| One package | vet scan pkg:npm/express@4.19.2 |
| The tools on this machine | vet endpoint audit |
vet reads the lockfiles and manifests of npm, PyPI, Go, Maven, Gradle, Cargo, RubyGems, NuGet,
Packagist, Pub and more. It also reads the GitHub Actions workflows and the AI agent configs of the
target. It does not install or run any of them. Controls turn this data into findings. See
controls.md.
Policy
A policy decides when a scan fails. Save this file as vet-policy.yml:
`yaml
version: 2
rules:
- id: no-malware
description: A malicious or suspicious package fails the build.
- 来源
- awesome · https://github.com/safedep/vet/blob/main/docs/mcp.md
- 按领域浏览
- MCP 服务
- Traction
- 1,113 ★
- 收录于
- 昨天
更多MCP 服务
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。