ai.kaiv/dependency-trust
ai.kaiv/dependency-trust · 1.0.1
Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.
Nobody here has read this server's code, because it publishes none. The description above is the maker's own, from the registry. A connection test shows whether it answers and what tools it says it has; it never calls a tool, so it cannot show what one does with your data.
Where it sits in the directory's order
What can be seen from outside, weighed as the directory publishes.
Observable signals: 35 of 100 points (at most 60 here)
| Input | Points | What was seen |
|---|---|---|
| Source published | held at 0 | No entry here publishes source: that is what puts it in this directory. |
| Licence stated | held at 0 | With no files, there is nothing for a licence to be stated in or held against. |
| Advisory state | held at 0 | Advisory databases index packages, and these entries publish none, so there is nothing to look up. |
| Auth declared | 0 of 15 | The registry entry declares no key. That is what it declares, not a finding that it has no protection. |
| Latest connection test reached it | 20 of 20 |
Where it answers
https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06dstreamable-http
Connection test
The MCP handshake, then a request for the tool list, with no key and no data of yours. Run nightly, and by anyone, at most once every ten minutes per server.
It completed the handshake and listed 5 tools.
- Protocol
- 2025-06-18
- Calls itself
- dependency-trust 1.0.0
- Handshake time
- 158 ms
- HTTP status
- 200
The tools it lists (5, as of 9 days ago)
The tool-description rules found nothing in these descriptions. They look for instructions aimed at a model and for hidden characters; they cannot see what a tool does when it runs.
get_advisoryGet a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.
get_dependenciesGet the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.
get_packageList every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.
get_package_versionGet license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.
get_project_healthGet a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOU
How this entry becomes a listing
For the maker. The catalogue lists what it can read, and this server publishes nothing to read yet. There are two routes, and only the first is open today.
Publish the source Open today
- Put the server's source in a public repository on github.com, with a licence.
- Keep a server.json in that repository naming this server,
ai.kaiv/dependency-trust, and declare the repository in it:"repository": { "url": "https://github.com/owner/repo", "source": "github" }, adding"subfolder"when the server lives in a folder. - Publish that version to the official MCP registry.
- The nightly registry sweep records the declaration. This page stays, dated, and says the source is declared but not yet read.
- The catalogue reads declared repositories at a pinned commit, in batches run by hand, and lists the servers that meet the batch's rules (among them a server.json at that commit naming the server, an https endpoint and a licence). When it lists this server, this page links to the listing. There is no schedule, so no date can be promised.
List it through the maker studio Not open yet
From the official MCP registry, last updated there 53 days ago. The registry entry