Hound Mcp

by tiluckdave

401 downloads

Not rated

GitHub

About

Hound is a free, open-source MCP server that gives AI coding agents a nose for supply chain security. It scans packages for vulnerabilities, checks licenses, inspects dependency trees, and detects typosquatting — with zero API keys, zero config, and zero cost.

Details

Author: tiluckdave
Downloads: 401
Categories: Developer Tools, Security, Other

- Scans lockfiles for vulnerabilities across all dependencies
- Provides 0–100 Hound Score with letter grade
- Side-by-side comparison of two packages with recommendation
- Pre-installation verdict: GO, CAUTION, or NO-GO
- Finds minimum safe version upgrade that resolves known vulns
- Detects typosquatting variants of a package name
- Supports npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Hound Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

From the repository

Install and configure Hound MCP as a stdio MCP server. For Claude Code, run claude mcp add hound -- npx -y hound-mcp. For Claude Desktop, Cursor, Windsurf, or VS Code (Copilot), add a JSON entry to the respective MCP config file pointing to npx -y hound-mcp. After setup, invoke its 12 tools (e.g., hound_audit, hound_preinstall) or its 3 built-in prompts (security_audit, package_evaluation, pre_release_check) directly from your AI client.

`hound_vulns`

List all known vulnerabilities for a specific package version, grouped by severity with fix versions and advisory links.

`hound_inspect`

Get a comprehensive profile of a package version: licenses, vulnerabilities, OpenSSF scorecard, GitHub stats, and dependency count — all in one call.

`hound_tree`

Show the full resolved dependency tree for a package version, including all transitive dependencies with their depth and relation type.

`hound_typosquat`

Check if a package name looks like a typosquat of a popular package. Generates likely typo variants and checks which ones exist in the registry.

`hound_advisories`

Get full details for a security advisory by ID (GHSA, CVE, or OSV ID). Returns title, severity, affected versions, fix versions, and references.

`hound_popular`

Scan a list of popular (or user-specified) packages for known vulnerabilities. Quickly surface which widely-used packages in an ecosystem have open security issues.

`hound_audit`

Scan a project's lockfile for dependency risks. Parses package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.sum, Gemfile.lock, pubspec.lock, or Pipfile.lock and batch-queries OSV for vulnerabilities across all dependencies.

`hound_compare`

Side-by-side comparison of two packages: vulnerabilities, OpenSSF Scorecard, GitHub stars, release recency, and license. Returns a recommendation.

`hound_license_check`

Scan a lockfile for license compliance. Resolves licenses for every dependency and flags packages that violate the chosen policy (permissive, copyleft, or none).

`hound_preinstall`

Safety check before installing a package. Checks known vulnerabilities, typosquatting risk, abandonment, and license concerns. Returns a go/no-go verdict.

`hound_score`

Compute a 0-100 Hound Score for a package version combining vulnerability severity, OpenSSF Scorecard, release recency, and license risk. Returns a letter grade (A-F) with a breakdown.

`hound_upgrade`

Find the minimum version upgrade that resolves all known vulnerabilities for a package. Checks every published version and returns the nearest safe one.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "hound mcp": {
            "hound": {
                "command": "npx",
                "args": [
                    "-y",
                    "hound-mcp"
                ]
            }
        }
    }
}

McpServers

{
    "hound": {
        "command": "npx",
        "args": [
            "-y",
            "hound-mcp"
        ]
    }
}

Hound MCP

The dependency bloodhound for AI coding agents.

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

---

Quickstart

Claude Code

claude mcp add hound -- npx -y hound-mcp

Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": ["-y", "hound-mcp"]
    }
  }
}

VS Code (Copilot)

{
  "mcp": {
    "servers": {
      "hound": {
        "type": "stdio",
        "command": "npx",
        "args": ["-y", "hound-mcp"]
      }
    }
  }
}

Config file locations

| Client | Config path |
| ------ | ----------- |
| Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Cursor | ~/.cursor/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |

---

Tools

12 tools → Full reference with example outputs

| Tool | What it does |
| ---- | ------------ |
| hound_audit ⭐ | Scan an entire lockfile for vulnerabilities across all dependencies |
| hound_score | 0–100 Hound Score (vulns + scorecard + recency + license) with letter grade |
| hound_compare | Side-by-side comparison of two packages with a recommendation |
| hound_preinstall | GO / CAUTION / NO-GO verdict before installing a package |
| hound_upgrade | Find the minimum safe version upgrade that resolves all known vulns |
| hound_license_check | Scan a lockfile for license compliance against a policy |
| hound_vulns | All known vulnerabilities for a package version, grouped by severity |
| hound_inspect | Full package profile — license, vulns, scorecard, stars, dep count |
| hound_tree | Full resolved dependency tree with transitive deps |
| hound_typosquat | Detect typosquatting variants of a package name |
| hound_advisories | Full advisory details by GHSA, CVE, or OSV ID |
| hound_popular | Scan popular packages for known vulnerabilities |

Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

| Prompt | What it does |
| ------ | ------------ |
| security_audit | Full project security audit — vulns, licenses, typosquats |
| package_evaluation | Go/no-go recommendation before adding a new dependency |
| pre_release_check | Pre-ship dependency scan that flags release blockers |

Use Cases

→ See full examples with real lockfiles and expected output

- Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
- Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
- Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
- License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
- CI security gate — ask your AI agent to run a security audit as part of every release check

---

Local Development

git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test         # run tests
pnpm check        # typecheck + lint + test

Roadmap

- [ ] Docker support — run Hound as a container for CI/CD pipelines
- [ ] bun.lockb parser — Bun lockfile support
- [ ] gradle.lockfile parser — Gradle (Java/Android) ecosystem support
- [ ] hound_diff tool — compare two lockfile snapshots to surface newly introduced risks
- [ ] GitHub Action — run hound_audit as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

---

Community

💬 Questions or ideas? Open a Discussion

License

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

hound_vulns

hound_inspect

hound_tree

hound_typosquat

hound_advisories

hound_popular

hound_audit

hound_compare

hound_license_check

hound_preinstall

hound_score

hound_upgrade

Claude Desktop / Cursor

McpServers

Hound MCP

Why Hound?

Quickstart

Claude Code

Claude Desktop / Cursor / Windsurf

VS Code (Copilot)

Config file locations

Tools

Built-in Prompts

Use Cases

Local Development

Roadmap

Contributing

Community

License

Install

More like this

Sequential Thinking

Sentry

Github

Filesystem

EverArt

Google Drive

`hound_vulns`

`hound_inspect`

`hound_tree`

`hound_typosquat`

`hound_advisories`

`hound_popular`

`hound_audit`

`hound_compare`

`hound_license_check`

`hound_preinstall`

`hound_score`

`hound_upgrade`