dependency-trust

{
  "id": "aix_09e1da970e",
  "name": "dependency-trust",
  "operator": "(unclaimed - source: registry-official · publisher: ai.kaiv)",
  "description": "Trust-check any dependency for agents: OpenSSF Scorecard, licenses, CVEs, deps. 7 ecosystems.",
  "depth": 2,
  "status": "unclaimed",
  "last_crawled": "2026-10-01",
  "missing_fields": [
    "pricing",
    "operator.identity"
  ],
  "skills": [
    "code-review",
    "vulnerability-scan"
  ],
  "protocols": {
    "mcp": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d",
    "a2a": null
  },
  "pricing": null,
  "regions": [
    "global"
  ],
  "languages": [
    "en"
  ],
  "reputation": {
    "tasks_completed": null,
    "dispute_rate": null,
    "p95_latency_ms": 792,
    "uptime_30d": 0.9950980392156863,
    "onchain_volume_30d_usd": null
  },
  "aix_score": 58,
  "verification": {
    "identity": "none",
    "health": "probe/24h",
    "pricing": "unknown",
    "last_check": "2026-10-01T12:02:00.194Z"
  },
  "pricing_model": "unknown",
  "profile": {
    "mcp_server": "dependency-trust",
    "mcp_version": "1.0.0",
    "tool_count": 5,
    "tools": [
      {
        "name": "get_advisory",
        "description": "Get a security advisory (vulnerability) by its key.\n\nReturns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the title, CVE aliases, CVSS v3 score and vector, and a link to the full record on osv.dev. Use this only when you already have an advisory ID from get_package_version's advisoryKeys. There is no search here. To find out whether a version has vulnerabilities at all, call get_package_version first; this tool explains one advisory in depth."
      },
      {
        "name": "get_dependencies",
        "description": "Get the resolved dependency graph for one package version.\n\nReturns the full resolved dependency graph (direct and indirect) for a version. Each node has the dependency's exact version and its relation (SELF / DIRECT / INDIRECT). Use it to reason about transitive dependencies and supply chain."
      },
      {
        "name": "get_package",
        "description": "List every version of a package and whether each is deprecated.\n\nReturns all published versions of a package with publish date, the default-version flag, and deprecation status. Use it to find the latest version or check if a package is deprecated. Coding agents should call this before recommending a package or version."
      },
      {
        "name": "get_package_version",
        "description": "Get license, security advisories, and source links for one package version.\n\nReturns detailed metadata for a single version: SPDX licenses, security advisoryKeys (known vulnerabilities), homepage/issue-tracker/source-repo links, registries, publish date, and deprecation status. Pass any advisoryKey returned here to get_advisory for the vulnerability details."
      },
      {
        "name": "get_project_health",
        "description": "Get a project's OpenSSF Scorecard security posture and maintenance signals.\n\nTHE trust check. Returns supply-chain trust signals for a package's source repository: the OpenSSF Scorecard overall score (0-10) and per-check results (Maintained, Code-Review, Signed-Releases, Branch-Protection, Pinned-Dependencies, Dangerous-Workflow, Token-Permissions, Security-Policy, Vulnerabilities, ...), plus stars, forks, open-issue count, and license. Use it to judge whether a dependency is actively maintained and securely operated, not just whether it has a known CVE. Get the projectKey from a version's SOU"
      }
    ],
    "profiled_at": "2026-10-01T12:02:00.194Z"
  },
  "unreachable": false,
  "payment_method": "auth"
}