• RISK
  • TREE
  • FIX
  • HUMAN

How to audit transitive dependencies with your AI

Connect Google Deps.dev Security Hacker to your AI client to uncover the hidden risks lurking in your dependency tree.

Ask AI about this page

Short answer

How can I find vulnerabilities in my indirect dependencies?

Your AI uses the Google Deps.dev Security Hacker MCP to pull the full dependency tree for any package. It then scans the entire chain to find security flaws in libraries you didn't even know you were using. You get a clear map of where the risk lives.

Audit outcomes

Where your findings land.

The AI processes the dependency data and organizes the results into these categories.

RISK

Vulnerability maps

The AI identifies specific indirect libraries with known security issues. You get a list of exactly which top-level package brought the threat into your project.

TREE

Dependency paths

The AI traces the lineage of every package. You see the direct path from your manifest to the vulnerable sub-dependency.

FIX

Remediation steps

The AI suggests which parent packages to update to resolve the underlying issue. This helps you clear the vulnerability without manual hunting.

HUMAN

Manual review

The AI flags complex or ambiguous dependency conflicts. You decide if a specific version override is safe for your build.

The workflow

What your AI does when the request arrives.

The AI handles the heavy lifting of traversing deep dependency trees so you don't have to.

  1. Map the tree

    The AI pulls the full list of every package and sub-package tied to your project.

    get_transitive_dependencies

  2. Identify risks

    The AI looks through the retrieved list to find any packages with reported security flaws.

    get_transitive_dependencies

  3. Trace origins

    The AI links the vulnerable library back to the primary dependency that introduced it.

    get_transitive_dependencies

  4. Summarize findings

    The AI presents a clean report of the vulnerabilities and the paths used to reach them.

    get_transitive_dependencies

Try it

Copy these to start.

Use these prompts to kick off an audit immediately.

Starting points

Swap out the package names or repository identifiers for your own specific targets.

Google Deps.dev Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_8l27TKQqvxDGA8IDc4bvKGYYUzioU5v5qb8XJydr/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Google Deps.dev capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "google-depsdev-security-hacker-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_8l27TKQqvxDGA8IDc4bvKGYYUzioU5v5qb8XJydr/mcp"
    }
  }
}
Copy into chat04

  • Run a transitive dependency audit for the 'react-scripts' package.

  • Find all hidden vulnerabilities in the dependency tree for my 'express' project.

  • Map out the full dependency path for 'lodash' to see if any sub-packages are insecure.

  • Check the 'next' package for any indirect dependencies with known security issues.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Google Deps.dev Security Hacker once, then ask.

Just click the link to connect the MCP to your AI client. Your credentials stay encrypted, and you can start auditing immediately.

Connect Google Deps.dev Security Hacker to your AI

FAQ

How this task behaves.

  • 01

    Can the AI automatically fix my package.json file?

    No. The AI identifies the vulnerabilities and suggests updates, but you must manually apply changes to your files.

  • 02

    Does the AI scan my local files directly?

    No. The AI uses the tool to fetch dependency data from the registry to build the tree.

  • 03

    Can it find vulnerabilities in my private, unlisted packages?

    No. The tool relies on data available through the Google Deps.dev service, which focuses on public dependency information.

  • 04

    Will the AI delete any of my dependencies?

    No. The AI only reads dependency data and provides analysis. It has no capability to modify your files or remove packages.

  • 05

    How deep does the dependency scan go?

    The AI uses the get_transitive_dependencies tool to map the entire tree, including all indirect sub-dependencies.

  • More questions about Google Deps.dev Security Hacker? The Connector page answers them. See everything the Google Deps.dev Security Hacker Connector can do

Connect Google Deps.dev to Claude, Cursor, ChatGPT & more