# dependency_vulnerability_scan

SCA (Software Composition Analysis) — scans a project dependency manifest and returns known vulnerabilities for each dependency. Supports: package.json (npm), requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), composer.json (PHP), Gemfile.lock (Ruby), CycloneDX SBOM JSON. PRIMARY source: OSV.dev (keyless, free, covers npm/PyPI/Go/crates.io/Packagist/RubyGems + GHSA advisories federated). CVSS enrichment: NVD NIST (when OSV lacks score). Exploitation flag: CISA KEV (known-exploited-vulnerabilities catalog). Returns per-vuln CVE/GHSA IDs, severity, CVSS score, fixed version, and actionable upgrade recommendations. Relevant for EU NIS2 supply chain risk obligations, DORA, SOC 2 vendor assessments. Cache TTL 6h. Parallel OSV queries (concurrency=10). SLA <=30s p95.

Agent View of the PolicyLayer registry record for `dependency_vulnerability_scan`. HTML page: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/dependency-vulnerability-scan

## Facts

- Tool: `dependency_vulnerability_scan`
- Server: Mcp Knowledge (`https://mcp.gapup.io`) — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md
- Homepage: https://github.com/getgapup/gapup-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 5 (2 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `mode` | string | yes | Manifest type: "package_json"=npm, "requirements_txt"=pip, "go_mod"=Go modules, "cargo_toml"=Rust, "composer_json"=PHP, "gem_lock"=Ruby, "sbom_cyclonedx"=Cyclon |
| `async` | boolean | no | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client ti |
| `severity_min` | string | no | Minimum severity to include in results (default: "medium"). |
| `manifest_content` | string | yes | Raw text content of the manifest file to scan (e.g. full contents of package.json, requirements.txt, etc.). |
| `include_transitive` | boolean | no | Include transitive/indirect dependencies in results (default: true). |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "dependency_vulnerability_scan",
    "arguments": {
      "mode": "<mode>",
      "manifest_content": "<manifest_content>"
    }
  }
}
```

## Why dependency_vulnerability_scan is rated Low

This is a scanning and analysis tool that fetches vulnerability information from public databases (OSV.dev, NVD, CISA KEV) and reports findings. It has no side effects on the scanned project, does not execute code, does not modify dependencies, and does not delete anything.

From the tool's own definition: "Tool 'dependency_vulnerability_scan' scans project dependency manifests and returns known vulnerabilities—it retrieves and queries vulnerability data from OSV.dev and NVD without modifying, executing, or deleting anything."

## Use case

AI agents call dependency_vulnerability_scan to retrieve information from Mcp Knowledge without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Knowledge:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "dependency_vulnerability_scan": {}
  }
}
```

## Other tools on Mcp Knowledge (270)

- `adversarial_input_stress_tester` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/adversarial-input-stress-tester.md
- `competitor_pricing_scrape` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/competitor-pricing-scrape.md
- `dora_operational_resilience_stress_tes` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/dora-operational-resilience-stress-tes.md
- `financial_model_3statement` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/financial-model-3statement.md
- `gl_reconciler` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/gl-reconciler.md
- `lgpd_data_subject_rights_automator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/lgpd-data-subject-rights-automator.md
- `monte_carlo_portfolio` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/monte-carlo-portfolio.md
- `workflow_orchestrator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/workflow-orchestrator.md
- `ma_arbitrage_hunter` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ma-arbitrage-hunter.md
- `repo_rate_arbitrage_scanner` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/repo-rate-arbitrage-scanner.md
- `tax_optimization` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/tax-optimization.md
- `treasury_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/treasury-optimizer.md
- `usdc_x402_payments_intel` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/usdc-x402-payments-intel.md
- `working_capital_fx_hedge_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/working-capital-fx-hedge-optimizer.md
- `pricing_in_deal` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/pricing-in-deal.md
- `term_sheet_negotiation` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/term-sheet-negotiation.md
- `abm_architect` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-architect.md
- `abm_lookalike_account_finder` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-lookalike-account-finder.md
- `account_expansion_mapper` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/account-expansion-mapper.md
- `affiliate_fraud_clickstream_detector` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/affiliate-fraud-clickstream-detector.md
- `africa_trade_barrier_breaker` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-barrier-breaker.md
- `africa_trade_finance_esg_rater` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-finance-esg-rater.md
- `africa_trade_preference_arbitrage` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-arbitrage.md
- `africa_trade_preference_optimizer` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-optimizer.md
- `agoa_eba_intelligence` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/agoa-eba-intelligence.md
- `ai_act_sandbox_regulatory_sandbox` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-sandbox-regulatory-sandbox.md
- `ai_act_training_data_audit` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-training-data-audit.md
- `ai_governance_full_report_async` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-async.md
- `ai_governance_full_report_result` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-result.md
- `ai_governance_pilot` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-pilot.md
- …and 240 more: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-getgapup-mcp-knowledge · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-getgapup-mcp-knowledge