Hound MCP

The dependency bloodhound for AI coding agents.

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: **deps.dev (Google Open Source Insights) and OSV** (Google Open Source Vulnerabilities).

Quickstart

Claude Code

claude mcp add hound -- npx -y hound-mcp

Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": ["-y", "hound-mcp"]
    }
  }
}

VS Code (Copilot)

{
  "mcp": {
    "servers": {
      "hound": {
        "type": "stdio",
        "command": "npx",
        "args": ["-y", "hound-mcp"]
      }
    }
  }
}

Config file locations

Tools

12 tools → Full reference with example outputs

Supported ecosystems: `npm` · `pypi` · `go` · `maven` · `cargo` · `nuget` · `rubygems`

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

Use Cases

→ See full examples with real lockfiles and expected output

• Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
• Auditing an inherited codebase — run `hound_audit` on an existing lockfile to get a full report in seconds
• Checking a package before adding it — use `hound_preinstall` to get a GO / CAUTION / NO-GO verdict
• License compliance — run `hound_license_check` to ensure no GPL or AGPL packages sneak into a commercial project
• CI security gate — ask your AI agent to run a security audit as part of every release check

Local Development

git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test         # run tests
pnpm check        # typecheck + lint + test

Roadmap

• [ ] Docker support — run Hound as a container for CI/CD pipelines
• [ ] `bun.lockb` parser — Bun lockfile support
• [ ] `gradle.lockfile` parser — Gradle (Java/Android) ecosystem support
• [ ] `hound_diff` tool — compare two lockfile snapshots to surface newly introduced risks
• [ ] GitHub Action — run `hound_audit` as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

Community

💬 Questions or ideas? Open a Discussion

License

MIT © 2026 Tilak Dave