MCP Dependency Auditor: npm and pip CVE checks via OSV

MCP guide · Dependency Auditor

@guardbee/mcp-dependency-auditor checks npm and pip dependencies against Google’s OSV database for known CVEs. Ask Claude if a project has critical issues — free OSV, no Guardbee API key.

What does it do?

Reads package.json/lockfiles or requirements.txt/pyproject.toml and returns severity-scored findings with upgrade hints when available.

Who is it for?

• JS/TS and Python application teams
• Developers running a quick pre-PR CVE pass
• Teams bringing SCA into a chat UI

What it is not

• Replacing a full commercial SCA policy engine
• Deep analysis of private-registry-only packages outside OSV

Features

MCP tools

Install with npm

Global install (handy for Claude Desktop / Cursor):

npm install -g @guardbee/mcp-dependency-auditor

or via npx (recommended with -y in config):

npx -y @guardbee/mcp-dependency-auditor

npm: @guardbee/mcp-dependency-auditor

Needs network access for OSV; manifests are read locally.

Claude Desktop configuration

Config file paths:

• macOS~/Library/Application Support/Claude/claude_desktop_config.json
• Windows%APPDATA%\Claude\claude_desktop_config.json
• Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

{
  "mcpServers": {
    "guardbee-dependency-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-dependency-auditor"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

1. “Audit npm dependencies in /Users/me/my-app”
2. “Are there CVEs in lodash 4.17.20?”
3. “Scan my Python project at /Users/me/django-app”

Related links

• All MCP servers
• Integrations
• Start free Guardbee trial
• @guardbee/mcp-dependency-auditor on npm

Frequently asked questions