• CRITICAL
  • LOW
  • TARGETS
  • HUMAN

How to audit dependency vulnerabilities with your AI

Connect DeepSource to your agent to find security holes in your dependencies. Your AI handles the heavy lifting of scanning and reachability analysis.

Ask AI about this page

Short answer

Can my AI find and check dependency vulnerabilities?

Yes. Your AI uses DeepSource to list vulnerabilities and check if they are reachable in your code. You get a clear picture of which risks actually matter.

Where findings land.

Security outcomes.

The AI organizes your security data into these categories.

CRITICAL

Reachable vulnerabilities

The AI identifies flaws that are actually exploitable in your code. These are your top priority for immediate fixes.

LOW

Unreachable risks

The AI flags vulnerabilities that exist in your packages but aren't called by your code. This helps you ignore the noise.

TARGETS

Affected packages

The AI maps out exactly which SCA targets contain the issues. You'll know which libraries need updating.

HUMAN

Manual triage

The AI presents the final list of risks for you to review. You decide which patches to apply to your codebase.

The workflow

What your AI does when the data arrives.

The AI acts as a security analyst by pulling data and filtering for relevance.

  1. Identify targets

    The AI looks at your software composition analysis targets to see what is being tracked.

    list_sca_targets

  2. Scan for flaws

    The AI pulls a full list of known security vulnerabilities from your project.

    list_vulnerabilities

  3. Inspect specific risks

    The AI pulls deep details on a specific vulnerability to understand its impact.

    get_vulnerability

  4. Verify reachability

    The AI compares the vulnerability data against your code to see if the vulnerable function is actually used.

    get_vulnerability

Try it

Copy these to start.

Use these prompts to kick off your security audit.

Starting points

Swap out the repository names or package names to match your actual project.

DeepSource Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_gRojrYBqBJYk2MB0kmqFd1Bq7M9JWeWmipQYTeBA/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — DeepSource capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "deepsource-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_gRojrYBqBJYk2MB0kmqFd1Bq7M9JWeWmipQYTeBA/mcp"
    }
  }
}
Copy into chat04

  • List all the vulnerabilities found in my 'auth-service' repository.

  • Which of the vulnerabilities in my 'web-app' project are actually reachable in my code?

  • Show me the details for the most critical vulnerability in my 'payment-gateway' package.

  • Check the SCA targets for my 'data-processor' repo and tell me which packages are vulnerable.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect DeepSource once, then ask.

Just link your DeepSource account to Vinkius. Your credentials stay encrypted, and you can start asking questions immediately.

Connect DeepSource to your AI

FAQ

How this task behaves.

  • 01

    Can the AI fix the code for me?

    No. The AI identifies the vulnerabilities and checks reachability, but you must manually apply the code changes or updates.

  • 02

    Does the AI delete any of my DeepSource data?

    No. The AI only reads data from DeepSource to answer your questions. It cannot modify or delete your existing security records.

  • 03

    How does the AI know if a vulnerability is reachable?

    The AI uses the vulnerability data provided by DeepSource to determine if the vulnerable code paths are actually executed in your project.

  • 04

    Can I use this with Cursor or Claude?

    Yes. Once connected via Vinkius, you can use these tools in any MCP-compatible client like Claude, Cursor, or Windsurf.

  • 05

    Can the AI create new DeepSource scan jobs?

    No. The current tools only allow the AI to list and retrieve existing vulnerability and target data.

  • More questions about DeepSource? The Connector page answers them. See everything the DeepSource Connector can do

Connect DeepSource to Claude, Cursor, ChatGPT & more