Skip to content
Publisher listing

SafeDep Vet MCP

io.github.safedep/vet-mcp

Publisher-submitted data · not independently verified

Listed as active Local package v1.20.0
NEXIP / MCP RADAR · EVIDENCE Publisher Registry claim

Independent technical evidence

Local package · remote check not applicable

Evidence applies only to the current published endpoint. HTTP response does not prove MCP compatibility. A successful MCP discovery result does not prove tools, security, uptime or future availability. No third-party checks run when you open this page.

Not an uptime or safety score.
Verification history and method 0

No allowed third-party observations yet. Unchecked does not mean offline.

Owner-allowlisted server/discover requests only. No credentials, tool execution, arbitrary URL scans, or security certification. Only results for the current published Registry URL are shown.

Profile facts from the publisher

  • Registry identity: io.github.safedep/vet-mcp
  • Published format: local package
  • Publisher-declared transport: stdio
  • Package identifier: ghcr.io/safedep/vet:v1.20.0
  • Listed version: 1.20.0

These facts are from the Registry; they do not constitute independent validation of any MCP tools.

About this server

Protect your AI agents and IDEs from malicious open-source packages.

A local MCP package is not a public HTTP server. Do not interpret the absence of an endpoint as downtime.

Independent technical monitoring is under development.

Authorization: not independently verified
Available tools: not independently verified

Publisher connection options

These endpoints and packages are publisher declarations, not validated integration instructions.

Copy only a published identifier or HTTPS endpoint; follow the client and publisher documentation before connecting. Credentials and approval steps can differ.

Package
ghcr.io/safedep/vet:v1.20.0
stdio oci

Package identifiers are not install commands. Review the package and publisher before running any code.

Connection readiness / publisher metadata

Before you connect

Publisher guidance needed

A prepared example is not a successful MCP connection. The Registry listing alone does not confirm tool compatibility, uptime, authentication or safety.

0Remote endpoints with supported transport
0Remote endpoints requiring review
1Local packages
Authentication Unknown — may require OAuth, an API key or another sign-in method

Publisher-supplied requirements may be shown below when available. Missing declarations are not evidence of anonymous access. OAuth is not verified.

Recommended steps

  1. Check the publisher website and repository before connecting or installing anything.
  2. Confirm the transport, HTTPS URL and client version. Template URLs with {variables} need publisher-specific values.
  3. Configure authentication in your trusted MCP client using the publisher instructions. Never paste secrets into NexIP.
  4. Test within the client with the minimum necessary permissions. Review all tool access requests.

If connection fails

HTTP 401 / 403 — authentication or access may be required

Check the client OAuth flow, account access and publisher-provided header requirements. A 401 alone does not prove OAuth is configured correctly.

HTTP 404 — check the published URL and endpoint path

Check whether the publisher changed the MCP path or requires a tenant-specific URL. Do not guess private API endpoints.

HTTP 405 — GET may not be supported

A valid MCP HTTP endpoint need not accept a browser GET. Use a compatible MCP client and the declared transport.

Timeout or TLS issue

Check client/network conditions and the publisher service status; do not disable TLS validation to make an untrusted server connect.

NexIP Radar / R4

Independent HTTP observations

Publisher listing ≠ Independent HTTP observations

A local package cannot be checked as a public HTTP endpoint.

HTTP results do not verify MCP protocol compatibility, security or available tools. Synthetic tests are never displayed.

Published versions

Cached history from the official Registry; coverage may be incomplete until a separate import runs.

Version history not loaded yet.