# Google Deps.dev Security Hacker MCP for AI Agents AI Agent Connect > Google Deps.dev Security Hacker turns your AI into a specialized DevSecOps auditor. It audits open-source packages, maps complex dependency trees to find hidden supply-chain threats, and checks GitHub repository governance using Google's deps.dev data. No authentication required. ## Overview - **Category:** industry-titans - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_8l27TKQqvxDGA8IDc4bvKGYYUzioU5v5qb8XJydr/ai-agent-connect - **Tags:** supply-chain-security, dependency-analysis, vulnerability-scanning, open-source-security, devsecops ## Description Google Deps.dev Security Hacker turns your AI into a specialized DevSecOps auditor. Imagine you're trying to ship a new feature, but you're worried about the security of a library you just pulled in. You don't have time to manually dig through five layers of nested dependencies to see if one of them is running some shady code or has a glaring security hole. This is where the tool comes in. It gives your AI agent the eyes it needs to see through the mess of open-source dependencies. Instead of just checking the top-level package, your agent can now map out the entire transitive tree to find those hidden vulnerabilities that standard scanners often miss. It handles the heavy lifting of querying Google's Open Source Insights, so you can just ask your AI to check the security of this package and get a straight answer. Whether you're working with npm, PyPI, Cargo, Go, Maven, or NuGet, it pulls real-time data on CVEs, GitHub Security Advisories, and OSSF Scorecards. It's a great way to harden your supply chain without spending all day in a terminal. You can find this Connector in the Vinkius catalog to get your agent up and running in minutes. It's about moving from I hope this is safe to I know this is safe before you hit deploy. ## Tools ### analyze_dependency The analyze_dependency tool checks an open-source package for security advisories and OSSF scores across major package managers. It gives you a clear picture of a library's health. ### analyze_github_repository The analyze_github_repository tool performs a full security and governance audit on a GitHub repo using OSSF Scorecards. This helps you see if a project follows best practices. ### get_transitive_dependencies The get_transitive_dependencies tool finds hidden security threats by mapping every nested dependency in a package's tree. It reveals what's lurking deep in your stack. ### get_vulnerability_details The get_vulnerability_details tool pulls specific exploit details and affected versions for a given CVE or GHSA ID. You can use this to see exactly what needs patching. ## Prompt Examples **Prompt:** ``` Audit the npm package 'express' version 4.16.0 for any security vulnerabilities. ``` **Response:** ``` I checked `express` v4.16.0 on deps.dev. It has **4 known security advisories**, including GHSA-8X4W-MXXF-XXXX (High Severity - CVSS 7.5). The project has an OSSF Scorecard of 6.8/10. I strongly recommend upgrading. ``` **Prompt:** ``` I found this GHSA-xvch-5gv4-984h advisory. What does it do and what packages are affected? ``` **Response:** ``` That ID corresponds to a **CRITICAL (CVSS: 9.8)** vulnerability: "Prototype Pollution in Lodash". It allows an attacker to inject properties into Object.prototype. It affects the npm package `lodash` on versions `< 4.17.15`. You must upgrade immediately. ``` **Prompt:** ``` Generate a security governance audit for https://github.com/facebook/react ``` **Response:** ``` Here is the OSSF Scorecard audit for `facebook/react`. It scores a **7.2/10** overall. They excel in Code-Review (10/10) and Branch-Protection (10/10), but lost points on Pinned-Dependencies (3/10) and lack of Fuzzing (0/10). ``` ## Capabilities ### Audit a package for known CVEs Your agent checks a library for all known security advisories and OSSF scores. ### Map out transitive dependency trees The tool reveals every nested dependency to find hidden threats deep in the stack. ### Check GitHub repository governance scores Your agent evaluates a repo for code reviews, fuzzing, and signed releases. ### Pull specific exploit details for CVE IDs Get exact details on affected versions and severity for a specific CVE or GHSA. ### Scan multiple package managers The tool works across npm, PyPI, Cargo, Go, Maven, and NuGet. ## Use Cases ### Checking a new Python library for safety A developer wants to use a new library. They ask the agent to check it, and the agent uses `analyze_dependency` to find 3 high-severity CVEs in a sub-dependency. ### Auditing a repo for production readiness A security lead provides a GitHub URL. The agent uses `analyze_github_repository` to check for code reviews and signed releases. ### Investigating a new CVE from a news blast A team finds a CVE ID in the news. They ask the agent what's affected, and it uses `get_vulnerability_details` to list all impacted versions. ### Hunting for hidden threats in a clean package A developer is worried about a package that looks safe. The agent uses `get_transitive_dependencies` to find an unpatched library four levels deep. ## Benefits - Stop guessing about package safety by getting real-time CVE and GHSA data for any library you use. - Identify hidden malware in nested dependencies using `get_transitive_dependencies` to see past the top-level package. - Score the health of open-source projects instantly with OSSF Scorecards via `analyze_github_repository`. - Get immediate exploit details and version requirements for specific CVEs using `get_vulnerability_details`. - Standardize your security checks across npm, PyPI, Cargo, Go, Maven, and NuGet in one single interface. ## How It Works The bottom line is you get instant, deep-dive security insights on any open-source dependency without manually hunting for data. 1. Connect your AI client to the Google Deps.dev Security Hacker MCP via Vinkius. 2. Tell your agent which package or GitHub URL you want to investigate. 3. Get a detailed security audit, including OSSF scores and hidden threats. ## Frequently Asked Questions **Can the Google Deps.dev Security Hacker check my npm packages?** Yes, it can audit npm packages for security advisories and OSSF scores. It helps you identify vulnerabilities before you include them in your project. **Does the Google Deps.dev Security Hacker support Python and Rust?** It supports several package managers including PyPI for Python and Cargo for Rust. You can get security data for a wide variety of open-source languages. **How does the Google Deps.dev Security Hacker find hidden threats?** It maps out the entire transitive dependency tree. This reveals vulnerabilities in nested libraries that you might not see by just looking at the top-level package. **Can I use Google Deps.dev Security Hacker to check a GitHub URL?** Yes, you can provide a GitHub URL and have your agent perform a full governance audit. It checks for things like code reviews and signed releases. **What kind of data does the Google Deps.dev Security Hacker pull?** It pulls real-time data from Google's Open Source Insights, including CVEs, GitHub Security Advisories, and OSSF Scorecards for various packages. **Does the Google Deps.dev Security Hacker require an API key?** No authentication is required to use this Connector. You can start auditing dependencies immediately once it's connected to your AI client. **Do I need an API key for this?** No! The Google deps.dev API is completely free and public. Just connect the Connector and your AI agent can start auditing immediately.