The dependency bloodhound for AI coding agents. Sniffs out vulnerabilities, license risks, and health issues in your dependencies — free, no API keys.
Most developer tooling work still happens through a UI a human drives. Hound MCP MCP server moves it into the conversation instead. The dependency bloodhound for AI coding agents. Sniffs out vulnerabilities, license risks, and health issues in your dependencies — free, no API keys.
hound-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
The server publishes 11 tools. What each one is for:
hound_score — 0–100 Hound Score (vulns + scorecard + recency + license) with letter gradehound_compare — Side-by-side comparison of two packages with a recommendationhound_preinstall — GO / CAUTION / NO-GO verdict before installing a packagehound_upgrade — Find the minimum safe version upgrade that resolves all known vulnshound_license_check — Scan a lockfile for license compliance against a policyhound_vulns — All known vulnerabilities for a package version, grouped by severityhound_inspect — Full package profile — license, vulns, scorecard, stars, dep counthound_tree — Full resolved dependency tree with transitive depshound_typosquat — Detect typosquatting variants of a package namehound_advisories — Full advisory details by GHSA, CVE, or OSV IDhound_popular — Scan popular packages for known vulnerabilitiesPlenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Hound MCP's toolset — hound_score, hound_compare, hound_preinstall and 8 more — is a fair guide to whether it matches your workflow. It is maintained by tiluckdave; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| hound_score | 0–100 Hound Score (vulns + scorecard + recency + license) with letter grade |
| hound_compare | Side-by-side comparison of two packages with a recommendation |
| hound_preinstall | GO / CAUTION / NO-GO verdict before installing a package |
| hound_upgrade | Find the minimum safe version upgrade that resolves all known vulns |
| hound_license_check | Scan a lockfile for license compliance against a policy |
| hound_vulns | All known vulnerabilities for a package version, grouped by severity |
| hound_inspect | Full package profile — license, vulns, scorecard, stars, dep count |
| hound_tree | Full resolved dependency tree with transitive deps |
| hound_typosquat | Detect typosquatting variants of a package name |
| hound_advisories | Full advisory details by GHSA, CVE, or OSV ID |
| hound_popular | Scan popular packages for known vulnerabilities |
{
"mcpServers": {
"hound": {
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.