# security_fetch_package_risk_brief

Single SHIP/CAUTION/BLOCK verdict for any package. Combines CVEs, licence, maintainer health, and transitive count in one call. Uses OSV.dev, deps.dev, PyPI, and npm registry — data refreshed on each call. Returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_count, licence_risk, maintainer_health, transitive_count, resolved_version, upstream_status, and reasoning. Rate limit: 30/minute. No auth required. For security engineers performing pre-inclusion package review. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="security_fetch_package_risk_brief", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Agent View of the PolicyLayer registry record for `security_fetch_package_risk_brief`. HTML page: https://policylayer.com/tools/dev-7bd0-mcp-server/security-fetch-package-risk-brief

## Facts

- Tool: `security_fetch_package_risk_brief`
- Server: DataNexus MCP (`dev-7bd0/mcp-server`) — https://policylayer.com/tools/dev-7bd0-mcp-server.md
- Homepage: https://github.com/dev-7bd0/mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 3
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `version` | object | no | Package version e.g. 2.28.0. Required. |
| `ecosystem` | string | no | Package ecosystem: npm, pypi, cargo, go, maven. Required. |
| `package_name` | string | no | Package name e.g. requests. Required. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "security_fetch_package_risk_brief",
    "arguments": {}
  }
}
```

## Why security_fetch_package_risk_brief is rated Low

This tool performs security assessment queries against package registries and vulnerability databases, aggregating pre-computed verdicts and metadata. While it informs high-stakes decisions (package inclusion), the tool itself only reads and returns existing data — no side effects, code execution, or mutations.

From the tool's own definition: "Tool description states it 'returns verdict (SHIP/CAUTION/BLOCK), critical_cve_count, high_cve_count, licence_risk, maintainer_health, transitive_count, resolved_version, upstream_status, and reasoning' — clearly retrieval and aggregation of security metadata…"

## Use case

AI agents call security_fetch_package_risk_brief to retrieve information from DataNexus MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches DataNexus MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "security_fetch_package_risk_brief": {}
  }
}
```

## Other tools on DataNexus MCP (54)

- `apikeys_revoke_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-revoke-api-key.md
- `apikeys_rotate_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-rotate-api-key.md
- `compliance_check_sam_exclusion` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-check-sam-exclusion.md
- `compliance_fetch_finra_broker` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-finra-broker.md
- `compliance_fetch_npi_provider` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-npi-provider.md
- `compliance_search_npi_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-search-npi-by-name.md
- `domain_check_email_security` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-check-email-security.md
- `domain_fetch_dns_records` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-dns-records.md
- `domain_fetch_domain_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-history.md
- `domain_fetch_domain_rdap` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-rdap.md
- `domain_fetch_reverse_ip` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-reverse-ip.md
- `domain_fetch_ssl_certificate_chain` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-ssl-certificate-chain.md
- `domain_fetch_subdomains` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-subdomains.md
- `frontend_security_audit_ci_pipeline` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-ci-pipeline.md
- `frontend_security_audit_manifest` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-manifest.md
- `frontend_security_detect_typosquatting` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-detect-typosquatting.md
- `frontend_security_fetch_package_risk_brief` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-fetch-package-risk-brief.md
- `govcon_fetch_open_solicitations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-open-solicitations.md
- `govcon_fetch_vendor_contract_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-vendor-contract-history.md
- `govcon_search_contract_awards` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-search-contract-awards.md
- `legal_fetch_inventor_portfolio` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-inventor-portfolio.md
- `legal_fetch_patent_by_number` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-by-number.md
- `legal_fetch_patent_citations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-citations.md
- `legal_search_patents_by_keyword` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-search-patents-by-keyword.md
- `nonprofit_fetch_charity_uk` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-charity-uk.md
- `nonprofit_fetch_nonprofit_by_ein` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-by-ein.md
- `nonprofit_fetch_nonprofit_financial_trends` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-financial-trends.md
- `nonprofit_fetch_nonprofit_full_profile` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-full-profile.md
- `nonprofit_search_nonprofits_by_category` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-category.md
- `nonprofit_search_nonprofits_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-name.md
- …and 24 more: https://policylayer.com/tools/dev-7bd0-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-7bd0-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-7bd0-mcp-server