Happy slice of mcp pizzaMCP.pizza
vet

vet

MCP.Pizza Chef: safedep

This tool checks the open-source code libraries your project relies on and flags any that are known to be malicious, carry security holes, or come with problematic licenses — before those problems reach your work. It works inside developer tools such as VS Code and covers popular ecosystems like npm, PyPI, Maven, Go, Ruby, Rust, and PHP, plus Docker images. Basic malware lookups need no account, but the deeper vulnerability and behavior checks require a free key.

Coding
Data

Use This MCP server To

Check if a package I'm about to install is malicious Scan my project's dependencies for known security risks Spot open-source libraries with restrictive or risky licenses Get warned about newly discovered malicious code in a library Review the trustworthiness score of an open-source project Set automatic rules that block risky packages before they're used

README

SafeDep VET - Real-time malicious package detection & software supply chain security

Go Report Card License Release OpenSSF Scorecard SLSA 3 CodeQL

Ask DeepWiki MCP Toplist

Note

vet supports special mode for Agent Skills. Run vet scan --agent-skill <owner/repo> to scan an Agent Skill hosted in a GitHub repository.

Why vet?

70-90% of modern software is open source code — how do you know it's safe?

Traditional SCA tools drown you in CVE noise. vet takes a different approach:

  • Shadow AI discovery — Discover AI tool usage signals across various tools and configurations
  • Catch malware before it ships — Zero-day detection through static and dynamic behavioral analysis (requires SafeDep Cloud access)
  • Cut through vulnerability noise — Analyzes actual code usage to surface only the risks that matter
  • Enforce policy as code — Express security, license, and quality requirements as CEL expressions
  • CI/CD integration — Zero-config security guardrails in CI/CD

Free for open source. Hosted SaaS available at SafeDep.

Quick Start

Install in seconds:

vet FAQ

Can I use this to check whether a package is safe before I install it?
Yes — it looks the package up against a security database and tells you whether it is known to be malicious or risky.
Can I use this to catch a vulnerable library before it ships in my project?
Yes — it checks how your code actually uses each library and surfaces the security issues that matter, instead of burying you in every possible warning.
Which apps does this work in?
It is built to work inside VS Code, and it can be added to other coding assistants that support this kind of developer tool.
Do I need an account or key to use it?
Basic malware checks work without one, but you will need a free account and key to unlock the full vulnerability and license-checking features.
Is this hard to set up?
Yes, setup takes some technical comfort — you install it with Docker or a small program and connect it to your coding assistant, so it is best handled by someone used to developer tools.
Does this work with assistants built on Claude, ChatGPT, or Gemini?
It is designed for coding assistants and works regardless of which underlying model — Claude, GPT, or Gemini — powers the assistant you use.
What kinds of packages and files does it check?
It covers common package systems including npm, PyPI, Maven, Go, Ruby, Rust, and PHP, along with Docker container images and software bill-of-materials files.
Will using this cost me anything?
It is free for open-source projects, with an optional paid hosted version available if you want extra features or support.