# security_fetch_dependency_graph

Fetch the full dependency tree for a package version including transitive dependencies. Read-only. No side effects. Idempotent. Hard 8-second timeout — large dependency trees may return partial results. package: Package name. Required. version: Exact version string e.g. 1.2.3. Required. ecosystem: One of PyPI, npm, Maven, Go, Cargo, NuGet, RubyGems. Required. Returns all direct and transitive dependencies with version constraints. Use this to understand full supply chain exposure. Use security_fetch_package_vulnerabilities instead when you only need CVEs for a single package. Verified source: deps.dev (Google). 1-hour cache. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_dependency_graph", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Agent View of the PolicyLayer registry record for `security_fetch_dependency_graph`. HTML page: https://policylayer.com/tools/dev-7bd0-mcp-server/security-fetch-dependency-graph

## Facts

- Tool: `security_fetch_dependency_graph`
- Server: DataNexus MCP (`dev-7bd0/mcp-server`) — https://policylayer.com/tools/dev-7bd0-mcp-server.md
- Homepage: https://github.com/dev-7bd0/mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 3
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `package` | string | no | Package name e.g. requests. Required. |
| `version` | string | no | Package version e.g. 2.28.0. Required. |
| `ecosystem` | string | no | Package ecosystem: npm, pypi, cargo, go, maven, nuget. Required. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "security_fetch_dependency_graph",
    "arguments": {}
  }
}
```

## Why security_fetch_dependency_graph is rated Low

This tool retrieves and queries dependency graph data from a package ecosystem without any ability to modify, execute, or delete resources. The explicit statement of read-only semantics, idempotency, and no side effects clearly places it in the Read category. Low severity reflects that misuse would only expose information about supply chain dependencies, not enable destructive or financial actions.

From the tool's own definition: "Tool is described as 'Read-only. No side effects. Idempotent.' It 'Fetch[es] the full dependency tree' and 'Returns all direct and transitive dependencies' — pure data retrieval operations with no modification, deletion, or execution capabilities."

## Use case

AI agents call security_fetch_dependency_graph to retrieve information from DataNexus MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches DataNexus MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "security_fetch_dependency_graph": {}
  }
}
```

## Other tools on DataNexus MCP (54)

- `apikeys_revoke_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-revoke-api-key.md
- `apikeys_rotate_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-rotate-api-key.md
- `compliance_check_sam_exclusion` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-check-sam-exclusion.md
- `compliance_fetch_finra_broker` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-finra-broker.md
- `compliance_fetch_npi_provider` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-npi-provider.md
- `compliance_search_npi_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-search-npi-by-name.md
- `domain_check_email_security` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-check-email-security.md
- `domain_fetch_dns_records` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-dns-records.md
- `domain_fetch_domain_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-history.md
- `domain_fetch_domain_rdap` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-rdap.md
- `domain_fetch_reverse_ip` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-reverse-ip.md
- `domain_fetch_ssl_certificate_chain` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-ssl-certificate-chain.md
- `domain_fetch_subdomains` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-subdomains.md
- `frontend_security_audit_ci_pipeline` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-ci-pipeline.md
- `frontend_security_audit_manifest` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-manifest.md
- `frontend_security_detect_typosquatting` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-detect-typosquatting.md
- `frontend_security_fetch_package_risk_brief` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-fetch-package-risk-brief.md
- `govcon_fetch_open_solicitations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-open-solicitations.md
- `govcon_fetch_vendor_contract_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-vendor-contract-history.md
- `govcon_search_contract_awards` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-search-contract-awards.md
- `legal_fetch_inventor_portfolio` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-inventor-portfolio.md
- `legal_fetch_patent_by_number` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-by-number.md
- `legal_fetch_patent_citations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-citations.md
- `legal_search_patents_by_keyword` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-search-patents-by-keyword.md
- `nonprofit_fetch_charity_uk` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-charity-uk.md
- `nonprofit_fetch_nonprofit_by_ein` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-by-ein.md
- `nonprofit_fetch_nonprofit_financial_trends` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-financial-trends.md
- `nonprofit_fetch_nonprofit_full_profile` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-full-profile.md
- `nonprofit_search_nonprofits_by_category` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-category.md
- `nonprofit_search_nonprofits_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-name.md
- …and 24 more: https://policylayer.com/tools/dev-7bd0-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-7bd0-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-7bd0-mcp-server