SafeDep

SafeDep

Vet open source packages from AI-suggested code via an MCP server.

848
Stars
70
Forks
20
Releases

Overview

vet can be used as an MCP server to vet open source packages proposed by AI-generated code. Start the MCP service with vet server mcp --server-type sse to enable streaming via server-sent events for MCP workflows. The MCP server brings vet's core capabilities into a programmable service, enabling code-aware evaluation of packages suggested by AI rather than relying solely on dependencies. It provides real-time vulnerability and malicious package detection (via SafeDep Cloud, with a fallback to Query Mode if no API key is provided), and supports Policy as Code using CEL expressions to enforce context-specific security requirements. The server accommodates multiple ecosystems and formats, including npm, PyPI, Maven, Go, Docker/OCI, SBOMs (CycloneDX, SPDX), binaries, and direct source code scanning. It integrates with CI/CD pipelines and containerized environments, and supports AI-driven inquiry and analysis through Agents. This makes it suitable for developers and security engineers seeking enterprise-grade software supply chain security workflows that incorporate AI-suggested code vetting.

Details

Owner
safedep
Language
Go
License
Apache License 2.0
Updated
2025-12-07

Features

Next-gen Software Composition Analysis

Vulnerability and malicious package detection, focusing on real code usage rather than noisy dependency lists.

Malicious Package Detection

Real-time protection against malicious packages via SafeDep Cloud, with a fallback to Query Mode when an API key is not provided.

Policy as Code

Define security policies using CEL expressions to enforce context-specific security requirements.

Multi-Format / Multi-Ecosystem Support

Supports npm, PyPI, Maven, Go, Ruby, Rust, PHP, Docker/OCI, SBOMs (CycloneDX, SPDX), binary artifacts, and direct source code scanning.

CI/CD Native

Built for DevSecOps workflows with integrations for GitHub Actions, GitLab CI, and more.

MCP Server

Vet open source packages from AI-suggested code via an MCP server using SSE transport (start with vet server mcp --server-type sse).

Agents

Run AI agents to query and analyze scan results.

Audience

DevelopersVet AI-suggested code packages in MCP workflows to ensure safer software.
Security engineersDefine and enforce security policies against AI-proposed packages within MCP workflows.

Tags

MCP ServervetAI-suggested codeSoftware supply chain securityMalicious package detectionPolicy as CodeCode analysisCI/CDMulti-ecosystem support