ai.kaiv/dependency-trust

Est-ce que ai.kaiv/dependency-trust est sûr ?

Au dernier audit MCP Hub, le serveur MCP « ai.kaiv/dependency-trust » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 5 outils

• get_advisory≈ 242 tokens

  Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth.

  Paramètres, retour & exemple (1)

  Paramètres

  • advisoryKey · string · requis
    Advisory id, e.g. 'GHSA-29mw-wpgm-hmr9' (taken from a version's advisoryKeys).

  Exemple d'appel

  {"name": "get_advisory", "arguments": {"advisoryKey": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_dependencies≈ 279 tokens

  Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain.

  Paramètres, retour & exemple (3)

  Paramètres

  • system · string · requis · npm | pypi | go | maven | cargo | nuget | rubygems
    Package ecosystem.
  • package · string · requis
    Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'.
  • version · string · requis
    Exact version string, e.g. '18.2.0'.

  Exemple d'appel

  {"name": "get_dependencies", "arguments": {"system": "npm", "package": "texte", "version": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_package≈ 254 tokens

  List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version.

  Paramètres, retour & exemple (2)

  Paramètres

  • system · string · requis · npm | pypi | go | maven | cargo | nuget | rubygems
    Package ecosystem.
  • package · string · requis
    Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'.

  Exemple d'appel

  {"name": "get_package", "arguments": {"system": "npm", "package": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_package_version≈ 298 tokens

  Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details.

  Paramètres, retour & exemple (3)

  Paramètres

  • system · string · requis · npm | pypi | go | maven | cargo | nuget | rubygems
    Package ecosystem.
  • package · string · requis
    Package name, raw and unencoded (the gateway URL-encodes it). Use scoped or namespaced names as-is, e.g. npm '@angular/core', Maven 'group:artifact'.
  • version · string · requis
    Exact version string, e.g. '18.2.0'.

  Exemple d'appel

  {"name": "get_package_version", "arguments": {"system": "npm", "package": "texte", "version": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_project_health≈ 332 tokens

  Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOURCE_REPO link (call get_package_version first), e.g. 'github.com/facebook/react'.

  Paramètres, retour & exemple (1)

  Paramètres

  • projectKey · string · requis
    Source repository, raw and unencoded (the gateway URL-encodes it). Pass it as-is, e.g. 'github.com/facebook/react'. Supported hosts: github.com, gitlab.com, bitbucket.org. Take it from a version's SOURCE_REPO link (get_package_version).

  Exemple d'appel

  {"name": "get_project_health", "arguments": {"projectKey": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d