mopanc-depguard
Pre-install guardian for npm packages with static code analysis, supply-chain attack detection, vulnerability audit (npm + GitHub Advisory Database), AI hallucination guard, and CycloneDX 1.6 SBOM generation with VEX. 12 MCP tools. Zero runtime dependencies — the SBOM serializer is implemented natively against the public CycloneDX schema.
- Score
- 66.5282 signals
- Evidence
- 15 stars · 1 fork
- Last commit
- as last read from GitHub; most reads are from 2 Sep 2026 or later
- Listed
Install
No one-command install. Set it up from its source.
Alternatives · MCPs
- szowesgad-semgrep28 stars · 10 forks82.035
- trustify4 stars · 7 forks68.547
- math280h-safe-pkgs7 stars · 1 fork57.245
What it is
Pre-install guardian for npm packages with static code analysis, supply-chain attack detection, vulnerability audit (npm + GitHub Advisory Database), AI hallucination guard, and CycloneDX 1.6 SBOM generation with VEX. 12 MCP tools. Zero runtime dependencies — the SBOM serializer is implemented natively against the public CycloneDX schema.
When to use it
When an agent needs the "Security" capability this MCP server exposes.
Source
Migrated from the awesome-mcp-servers navigation directory (category: Security). See https://github.com/mopanc/depguard.