Zovo Dependency Audit

Check a dependency list for known vulnerabilities, licenses and outdated versions.

Paste a package.json, requirements.txt, go.mod, Cargo.toml, pom.xml or a name@version list. Zovo Dependency Audit looks up each package version in the OSV.dev vulnerability database and deps.dev, then reports known vulnerabilities with severity and the version that fixes each one, the license, the latest version and how far behind each package is, as a Markdown report for a pull request, a CSV and a PDF.

What it does

Known vulnerabilities per package with severity, CVSS score, CVE alias and fixed-in version
Licenses (SPDX) and deprecated versions from deps.dev
Latest version, newer releases and libyears for each package
npm, PyPI, Go, crates.io and Maven, up to 300 packages per audit
Markdown report for a pull request, CSV and PDF

Try asking

“Audit this requirements.txt: django==3.2.0, requests==2.19.0”

“Check lodash@4.17.15 on npm for known vulnerabilities”

Limitations

Reads the listed direct dependencies only; it does not resolve the transitive dependency tree or read lockfiles.
Version ranges are checked at their stated minimum version; the version a lockfile installs can differ.
Git, path, workspace, URL and property versions are listed as skipped.
An empty vulnerability list means OSV.dev lists no known vulnerability for that version, not that the package is safe.
License data comes from deps.dev and is not legal advice.
Up to 300 packages and 480 source requests per call; advisory details are loaded for up to 100 advisories per call.
Vulnerability records are cached for up to 24 hours and package release lists for up to 6 hours.

Add it

ChatGPT: once Zovo Dependency Audit is approved, add it from the ChatGPT plugin directory.

Claude: go to Customize > Connectors > Add custom connector and enter https://dependency-audit.zovo.one/mcp. No sign-in is needed. Once Zovo Dependency Audit is listed in the Claude connector directory, you can add it from there too.

Other MCP clients can connect to the same endpoint: https://dependency-audit.zovo.one/mcp