Score the security risk of software dependencies before using them. Checks each package against OSV.dev (Google's vulnerability database) and deps.dev for metadata. Returns per-package CVE counts, max severity, abandonment signals, and a hallucination check — HALLUCINATED means the package was not found and may be an AI-invented name or typosquat. Supports npm, pypi, go, maven, cargo, and nuget. Accepts up to 20 packages per call.
| Name | Type | Required | Description |
|---|---|---|---|
| packages | string | required | JSON array of packages to scan. Each entry: {"name": "lodash", "ecosystem": "npm", "version": "4.17.19"} — version is optional. Ecosystems: npm, pypi, go, maven, cargo, nuget. Example: [{"name":"lodash","ecosystem":"npm"},{"name":"requests","ecosystem":"pypi"}] |
// MCP tool call
{
"name": "dependency_risk_score",
"arguments": {
"packages": ""
}
}
// Add to your MCP config — this tool is immediately available
{
"mcpServers": {
"toolbooth": { "url": "https://toolbooth.io/mcp" }
}
}