MCP Servers

safedep/vet

Name: safedep/vet
Author: Various

Protect against malicious open source packages 🤖

Visit site ↗

Our verdict

Not reviewed yet

We have not reviewed safedep/vet yet

No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.

How we review records

From the listing

About safedep/vet

Vet is an open source tool that scans open source dependencies for malicious packages. It uses static analysis and community threat intelligence to detect known malware, typosquatting, and suspicious behavior in Go modules and other ecosystems.

Best for

Teams that want a lightweight, targeted check for malicious open source packages in their Go projects or CI pipelines.

Use cases

Audit third-party dependencies for known malicious packages before adding them to a project
Integrate into CI/CD pipelines to block builds that include flagged dependencies
Scan existing lockfiles or manifests to identify compromised or suspicious packages

Notes

1,059 stars on GitHub. Last updated 2026-06-01. Licensed Apache-2.0.

Pros

Focused specifically on malicious package detection, not general vulnerability scanning
Written in Go, making it fast and easy to run in CI or locally
Leverages community threat feeds for up-to-date detection

Cons

Limited to ecosystems supported by its analysis engine (primarily Go, with partial support for others)
Relies on external threat feeds, which may have gaps or delays for novel attacks
No built-in remediation or dependency update suggestions

Key facts

What we have checked

Days since the last commit: 0; Checked 6 Nov 2026GitHub
GitHub forks: 115; Checked 6 Nov 2026GitHub
GitHub stars: 1,125; Checked 6 Nov 2026GitHub
Days to a first reply on issues: 65.8; Checked 6 Nov 2026GitHub
Open issues: 81; Checked 6 Nov 2026GitHub
Releases in the last 90 days: 9; Checked 6 Nov 2026GitHub

Each value shows when we last confirmed it and where it came from. Values we have not confirmed are left out, never guessed.

How to use

How to set it up

As the listing publishes it. We have not run this install.

Install

npm install -g @safedep/vet

Clients the listing names (not checked here)

Claude Code

Install

Add safedep/vet to your client

Not verified yet

Our lab has not run this server yet. "Config checked" on a client means the recipe matches that client's documented config format; it does not mean we ran it.

Claude Code

Config checked

Run in your terminal (runs on your computer)

claude mcp add --transport stdio safedep-vet -- docker run -i --rm ghcr.io/safedep/vet:v1.20.0 -s -l /tmp/vet-mcp.log server mcp

Version 1.20.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Claude Code's config docs

Claude Desktop

Config checked

Add to claude_desktop_config.json (runs on your computer)

{
  "mcpServers": {
    "safedep-vet": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/safedep/vet:v1.20.0",
        "-s",
        "-l",
        "/tmp/vet-mcp.log",
        "server",
        "mcp"
      ]
    }
  }
}

Version 1.20.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Claude Desktop's config docs

Cursor

Config checked

Add to .cursor/mcp.json (runs on your computer)

{
  "mcpServers": {
    "safedep-vet": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/safedep/vet:v1.20.0",
        "-s",
        "-l",
        "/tmp/vet-mcp.log",
        "server",
        "mcp"
      ]
    }
  }
}

Version 1.20.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Cursor's config docs

VS Code

Config checked

Add to .vscode/mcp.json (runs on your computer)

{
  "servers": {
    "safedep-vet": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/safedep/vet:v1.20.0",
        "-s",
        "-l",
        "/tmp/vet-mcp.log",
        "server",
        "mcp"
      ]
    }
  }
}

Version 1.20.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against VS Code's config docs

Codex

Config checked

Add to ~/.codex/config.toml (runs on your computer)

[mcp_servers.safedep-vet]
command = "docker"
args = ["run", "-i", "--rm", "ghcr.io/safedep/vet:v1.20.0", "-s", "-l", "/tmp/vet-mcp.log", "server", "mcp"]

Version 1.20.0 · From the Official MCP registry, read 24 Oct 2026 · Format checked against Codex's config docs

ChatGPT: ChatGPT connects only to remote servers that need no API key.

Recipes come from the server's entry in the official MCP registry. Check the package name before you run it, and keep keys out of shared files.

Works with

What safedep/vet connects to

5 clients, each with how we know and when we checked.

Works with	Type	How we know	Checked
Claude Code	Client	Install recipe matches the client's documented formatRuns locally, version 1.20.0Config checked	24 Oct 2026Claude Code docs
Claude Desktop	Client	Install recipe matches the client's documented formatRuns locally, version 1.20.0Config checked	24 Oct 2026Claude Desktop docs
Cursor	Client	Install recipe matches the client's documented formatRuns locally, version 1.20.0Config checked	24 Oct 2026Cursor docs
VS Code	Client	Install recipe matches the client's documented formatRuns locally, version 1.20.0Config checked	24 Oct 2026VS Code docs
Codex	Client	Install recipe matches the client's documented formatRuns locally, version 1.20.0Config checked	24 Oct 2026Codex docs

Stars and usage

How safedep/vet is growing

GitHub stars

1,122 to 1,125

stars. 31 Oct 2026 to 6 Nov 2026, 2 readings.

Source: GitHub. Checked 6 Nov 2026.

Health and security

Is safedep/vet looked after, and what do its setup files show

Health score

60 out of 100

Does someone look after this repository? It does not say the code is good or safe. Worked out from GitHub signals checked 6 Nov 2026. How it is worked out

Part	Points	What we saw
Recent activity	30 of 30	Last push 0 days ago
Releases	15 of 15	9 releases in 90 days
Issue replies	0 of 20	First reply in 65.8 days (median)
Maintainer	15 of 15	Owned by an organisation
Official source	0 of 20	Community server

Alternatives

Alternatives to safedep/vet

Record	Type	How we know	Checked
4da-mcp-serverAlternative to this	MCP server	Matched from the listing text	7 Nov 2026
82ch/MCP-DandanAlternative to this	MCP server	Matched from the listing text	7 Nov 2026
Agent Permissions IndexAlternative to this	MCP server	Matched from the listing text	11 Nov 2026
AgentGraph TrustAlternative to this	MCP server	Matched from the listing text	12 Nov 2026

Compare

Compare safedep/vet side by side

Sources

Where this comes from

GitHubRegistry
Checked 6 Nov 2026 · Days since the last commit, GitHub forks, GitHub stars, Days to a first reply on issues, Open issues, Releases in the last 90 days

A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.

Changelog

What changed

No changes recorded yet. Releases, price changes and deprecations appear here, with their dates, once we track them for this record.

Open-source & AI alternatives

Swap-in tools that solve the same job. Weigh the trade-offs before you commit.

Alternatives4 entries

MMCPCatalogue

4da-mcp-server

4da-systems

Upgrade intelligence for AI coding agents: what an upgrade changes and where it touches your code, lockfile vulnerability scans, upgrade plans. Local MCP server, no account.

★ 0

MMCPlowCatalogue

82ch/MCP-Dandan

Various

MCP Security Solution for Agentic AI — real-time proxying, behavior analysis, and malicious tool detection

★ 63

MMCPCatalogue

AgentGraph Trust

agentgraph-co

Security scanning and trust verification for AI agent tools.

MMCPCatalogue

Agent Permissions Index

agent-permissions-index

Free public remote MCP server: grade your agent config, get index stats and the agent safety leaderboard from Claude Code, Cursor or Codex.

Pairs with

Other entries in the index that connect to this one. Click through to see the chain.

Pairs with1 entry

MMCPlowCatalogue

semgrep/semgrep

Various

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

★ 16,778

Pairs with2 entries

MMCPArchivedCatalogue

agent-guard

ipezygj

Safety checks an agent runs before it acts: package malware, destructive command, secret leak.

MMCPCatalogue

agent-sec

kernora-ai

Kernora Agent Security — a zero-install security baseline for AI coding agents (MCP). Free & open.

★ 1

Free 27-page guide

Get the free Developer’s Field Guide

A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.

Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.

← Back to MCP Servers Submit your own entry →