The dependency bloodhound for AI coding agents. Free, no API keys.
概览
AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost. Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box. It uses two fully free, unauthenticated public APIs: (Google Open Source Insights) and (Google Open Source Vulnerabilities). 12 tools → Full reference with example outputs npm · pypi · go · maven · cargo · nuget · rubygems 3 prompts you can invoke directly from your AI client.
README
以下为原文 README 节选，完整内容请查看原文。
Hound MCP
The dependency bloodhound for AI coding agents.
Why Hound?
AI coding agents recommend and install packages without knowing if they’re safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.
Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.
It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).
Quickstart
Claude Code
claude mcp add hound -- npx -y hound-mcp
Claude Desktop / Cursor / Windsurf
Add to your MCP config file:
{
"mcpServers": {
"hound": {
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}
VS Code (Copilot)
{
"mcp": {
"servers": {
"hound": {
"type": "stdio",
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}
}
Config file locations
| Client | Config path |
|---|---|
| Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
Tools
12 tools → Full reference with example outputs
| Tool | What it does |
|---|---|
hound_audit ⭐ |
Scan an entire lockfile for vulnerabilities across all dependencies |
hound_score |
0–100 Hound Score (vulns + scorecard + recency + license) with letter grade |
hound_compare |
Side-by-side comparison of two packages with a recommendation |
安装
npx -y hound-mcp配置
{
"mcpServers": {
"hound": {
"command": "npx",
"args": ["-y", "hound-mcp"]
}
}
}