English Français العربية

io.github.tiluckdave/hound

Official registry Developer tools

The dependency bloodhound for AI coding agents. Zero API keys, zero config.

Source code Documentation

What can you do with io.github.tiluckdave/hound?

  • Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
  • Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
  • Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
  • License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
  • CI security gate — ask your AI agent to run a security audit as part of every release check

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package hound-mcp
Claude Code 
claude mcp add hound -- npx -y hound-mcp@0.2.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "hound": {
            "command": "npx",
            "args": [
                "-y",
                "hound-mcp@0.2.1"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Hound MCP
  2. Why Hound?
  3. Quickstart
  4. Tools
  5. Built-in Prompts
  6. Use Cases
  7. Local Development
  8. Roadmap
  9. Contributing
  10. Community
  11. License

Hound MCP

The dependency bloodhound for AI coding agents.

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

Quickstart

Claude Code
claude mcp add hound -- npx -y hound-mcp
Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": ["-y", "hound-mcp"]
    }
  }
}
VS Code (Copilot)
{
  "mcp": {
    "servers": {
      "hound": {
        "type": "stdio",
        "command": "npx",
        "args": ["-y", "hound-mcp"]
      }
    }
  }
}
Config file locations
ClientConfig path
Claude Desktop (macOS)~/Library/Application Support/Claude/claude_desktop_config.json
Cursor~/.cursor/mcp.json
Windsurf~/.codeium/windsurf/mcp_config.json

Tools

12 tools → Full reference with example outputs

ToolWhat it does
hound_audit ⭐Scan an entire lockfile for vulnerabilities across all dependencies
hound_score0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
hound_compareSide-by-side comparison of two packages with a recommendation
hound_preinstallGO / CAUTION / NO-GO verdict before installing a package
hound_upgradeFind the minimum safe version upgrade that resolves all known vulns
hound_license_checkScan a lockfile for license compliance against a policy
hound_vulnsAll known vulnerabilities for a package version, grouped by severity
hound_inspectFull package profile — license, vulns, scorecard, stars, dep count
hound_treeFull resolved dependency tree with transitive deps
hound_typosquatDetect typosquatting variants of a package name
hound_advisoriesFull advisory details by GHSA, CVE, or OSV ID
hound_popularScan popular packages for known vulnerabilities

Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

PromptWhat it does
security_auditFull project security audit — vulns, licenses, typosquats
package_evaluationGo/no-go recommendation before adding a new dependency
pre_release_checkPre-ship dependency scan that flags release blockers

Use Cases

→ See full examples with real lockfiles and expected output

  • Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
  • Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
  • Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
  • License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
  • CI security gate — ask your AI agent to run a security audit as part of every release check

Local Development

git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test         # run tests
pnpm check        # typecheck + lint + test

Roadmap

  • [ ] Docker support — run Hound as a container for CI/CD pipelines
  • [ ] bun.lockb parser — Bun lockfile support
  • [ ] gradle.lockfile parser — Gradle (Java/Android) ecosystem support
  • [ ] hound_diff tool — compare two lockfile snapshots to surface newly introduced risks
  • [ ] GitHub Action — run hound_audit as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

Community

💬 Questions or ideas? Open a Discussion

License

MIT © 2026 Tilak Dave

Frequently asked questions

What is io.github.tiluckdave/hound?

The dependency bloodhound for AI coding agents. Zero API keys, zero config.

How do I install io.github.tiluckdave/hound?

It runs on your machine. In Claude Code: claude mcp add hound -- npx -y hound-mcp@0.2.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.tiluckdave/hound need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.tiluckdave/hound open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.tiluckdave/hound?

It is published by tiluckdave. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.