vet-mcp

[!NOTE]
vet supports special mode for Agent Skills.
Run vet scan --agent-skill <owner/repo> to scan an Agent Skill hosted in a GitHub repository.

馃幆 Why vet?

70-90% of modern software constitute code from open sources 鈥� How do we know if it's safe?

vet is an open source software supply chain security tool built for developers and security engineers who need:

鉁� Real-time malicious package detection 鈥� Active scanning and analysis of unknown packages
鉁� Modern SCA with actual usage analysis 鈥� Prioritize real risks over vulnerability noise
鉁� Policy as Code 鈥� Express security requirements using CEL expressions

Hosted SaaS version available at SafeDep Cloud.
Get started with GitHub App and other integrations.

鈿� Quick Start

Install in seconds:

# macOS & Linux
brew install safedep/tap/vet

or download a pre-built binary

Get started immediately:

# Scan for malware in your dependencies
vet scan -D . --malware-query

# Fail CI on critical vulnerabilities
vet scan -D . --filter 'vulns.critical.exists(p, true)' --filter-fail

# Get API key for advanced malware detection
vet cloud quickstart

馃摝 Architecture

graph TB
    subgraph "OSS Ecosystem"
        R1[npm Registry]
        R2[PyPI Registry]
        R3[Maven Central]
        R4[Other Registries]
    end
    
    subgraph "SafeDep Cloud"
        M[Continuous Monitoring]
        A[Real-time Code Analysis<br/>Malware Detection]
        T[Threat Intelligence DB<br/>Vulnerabilities 鈥� Malware 鈥� Scorecard]
    end
    
    subgraph "vet CLI"
        S[Source Repository<br/>Scanner]
        P[CEL Policy Engine]
        O[Reports & Actions<br/>SARIF/JSON/CSV]
    end
    
    R1 -->|New Packages| M
    R2 -->|New Packages| M
    R3 -->|New Packages| M
    R4 -->|New Packages| M
    M -->|Behavioral Analysis| A
    A -->|Malware Signals| T
    
    S -->|Query Package Info| T
    T -->|Security Intelligence| S
    S -->|Analysis Results| P
    P -->|Policy Decisions| O
    
    style M fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a
    style A fill:#E8A87C,stroke:#B88A5A,color:#1a1a1a
    style T fill:#7CB9E8,stroke:#5A8DB8,color:#1a1a1a
    style S fill:#90C695,stroke:#6B9870,color:#1a1a1a
    style P fill:#E8C47C,stroke:#B89B5A,color:#1a1a1a
    style O fill:#B8A3D4,stroke:#9478AA,color:#1a1a1a

馃敀 Key Features

馃洝锔� Malicious Package Detection

Real-time protection against malicious packages powered by SafeDep Cloud.
Free for open source projects. Detects zero-day malware through active code analysis.

馃暤锔� Smart Vulnerability Analysis

Unlike dependency scanners that flood you with noise, vet analyzes your actual code usage to prioritize real risks.
See dependency usage evidence for details.

馃搵 Policy as Code

Define security policies using CEL expressions to enforce context specific requirements:

# Block packages with critical CVEs
vet scan --filter 'vulns.critical.exists(p, true)' --filter-fail

# Enforce license compliance
vet scan --filter 'licenses.contains_license("GPL-3.0")' --filter-fail

# Require minimum OpenSSF Scorecard scores
vet scan --filter 'scorecard.scores.Maintained < 5' --filter-fail

馃幆 Multi-Ecosystem Support

Package managers: npm, PyPI, Maven, Go, Ruby, Rust, PHP
Container images: Docker, OCI
SBOM formats: CycloneDX, SPDX
Source repositories: GitHub, GitLab

馃洝锔� Malicious Package Detection

Real-time protection against malicious packages with active scanning and behavioral analysis.

馃殌 Quick Setup

# One-time setup for advanced scanning
vet cloud quickstart

# Scan for malware with active scanning (requires API key)
vet scan -D . --malware

# Query known malicious packages (no API key needed)
vet scan -D . --malware-query

Example detections:

• MAL-2025-3541: express-cookie-parser
• MAL-2025-4339: eslint-config-airbnb-compat
• MAL-2025-4029: ts-runtime-compat-check

Key security features:

• 鉁� Real-time analysis against known malware databases
• 鉁� Behavioral analysis using static and dynamic analysis
• 鉁� Zero-day protection through active code scanning
• 鉁� Human-in-the-loop triaging for high-impact findings
• 鉁� Public analysis log for transparency

馃幆 Advanced Usage

# Specialized scans
vet scan --vsx --malware                    # VS Code extensions
vet scan -D .github/workflows --malware     # GitHub Actions
vet scan --image nats:2.10 --malware        # Container images

# Analyze specific packages
vet inspect malware --purl pkg:npm/nyc-config@10.0.0

馃殌 Production Ready Integrations

馃摝 GitHub Actions

Zero-config security guardrails in CI/CD:

- uses: safedep/vet-action@v1
  with:
    policy: ".github/vet/policy.yml"

See vet-action documentation.

馃敡 GitLab CI

Enterprise scanning with vet CI Component:

include:
  - component: gitlab.com/safedep/ci-components/vet/scan@main

馃惓 Container Integration

Run vet anywhere using our container image:

docker run --rm -v $(pwd):/app ghcr.io/safedep/vet:latest scan -D /app --malware

馃摝 Installation

馃嵑 Homebrew (Recommended)

brew tap safedep/tap
brew install safedep/tap/vet

馃摜 Direct Download

See releases for pre-built binaries.

馃惞 Go Install

go install github.com/safedep/vet@latest

馃惓 Container Image

# Quick test
docker run --rm ghcr.io/safedep/vet:latest version

# Scan local directory
docker run --rm -v $(pwd):/workspace ghcr.io/safedep/vet:latest scan -D /workspace

鈿欙笍 Verify Installation

vet version
# Should display version and build information

馃摎 Advanced Features

Learn more in our comprehensive documentation:

• MCP Server - Run vet as an MCP server for AI-assisted code analysis
• AI Agent Mode - Run vet as an AI agent
• Reporting - SARIF, JSON, CSV, HTML, Markdown formats
• SBOM Support - CycloneDX, SPDX import/export
• Query Mode - Scan once, analyze multiple times
• GitHub Integration - Repository and organization scanning

馃搳 Privacy

vet collects anonymous usage telemetry to improve the product. Your code and package information is never transmitted.

# Disable telemetry (optional)
export VET_DISABLE_TELEMETRY=true

馃帄 Community & Support

馃専 Join the Community

馃挕 Get Help & Share Ideas

• 馃殌 Interactive Tutorial - Learn vet hands-on
• 馃摎 Complete Documentation - Comprehensive guides
• 馃挰 Discord Community - Real-time support
• 馃悰 Issue Tracker - Bug reports & feature requests
• 馃 Contributing Guide - Join the development

猸� Star History

馃檹 Built With Open Source

vet stands on the shoulders of giants:

OSV 鈥� OpenSSF Scorecard 鈥� SLSA 鈥� OSV-SCALIBR 鈥� Syft

Created with 鉂わ笍 by SafeDep and the open source community