Hound
Scans dependencies for vulnerabilities, license issues, and typosquatting across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems without requiring API keys or accounts. Exposes 12 tools including hound_audit for scanning entire lockfiles, hound_preinstall for go/no-go verdicts before adding packages, hound_compare for side-by-side package evaluation, and hound_license_check for compliance scanning. Pulls data from Google's deps.dev and OSV APIs. Built specifically for AI coding agents that recommend packages without knowing if they're safe. Useful when auditing inherited codebases, running pre-merge security checks on lockfile diffs, or gating releases on dependency safety in CI pipelines.
- GitHub stars
- 5
- tools
- 12
- transport
- STDIO
- last updated
- Mar 11, 2026
Tools
12 toolsPublic tool metadata for what this MCP can expose to an agent.
hound_auditScan an entire lockfile for vulnerabilities across all dependencies
Scan an entire lockfile for vulnerabilities across all dependencies
No parameter schema in public metadata yet.
hound_score0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
No parameter schema in public metadata yet.
hound_compareSide-by-side comparison of two packages with a recommendation
Side-by-side comparison of two packages with a recommendation
No parameter schema in public metadata yet.
hound_preinstallGO / CAUTION / NO-GO verdict before installing a package
GO / CAUTION / NO-GO verdict before installing a package
No parameter schema in public metadata yet.
hound_upgradeFind the minimum safe version upgrade that resolves all known vulns
Find the minimum safe version upgrade that resolves all known vulns
No parameter schema in public metadata yet.
hound_license_checkScan a lockfile for license compliance against a policy
Scan a lockfile for license compliance against a policy
No parameter schema in public metadata yet.
hound_vulnsAll known vulnerabilities for a package version, grouped by severity
All known vulnerabilities for a package version, grouped by severity
No parameter schema in public metadata yet.
hound_inspectFull package profile — license, vulns, scorecard, stars, dep count
Full package profile — license, vulns, scorecard, stars, dep count
No parameter schema in public metadata yet.
hound_treeFull resolved dependency tree with transitive deps
Full resolved dependency tree with transitive deps
No parameter schema in public metadata yet.
hound_typosquatDetect typosquatting variants of a package name
Detect typosquatting variants of a package name
No parameter schema in public metadata yet.
hound_advisoriesFull advisory details by GHSA, CVE, or OSV ID
Full advisory details by GHSA, CVE, or OSV ID
No parameter schema in public metadata yet.
hound_popularScan popular packages for known vulnerabilities
Scan popular packages for known vulnerabilities
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Hound MCP
The dependency bloodhound for AI coding agents.
Why Hound?
AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.
Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.
Details
- Repository
- github.com/tiluckdave/hound-mcp
- Package
hound-mcp- Transport
- STDIO
- Registry
- MCP registry, active