Dependency gate for AI coding agents
Check it before
it's in your code
Your agent picks packages faster than advisories get written. VDB is the check it runs first.
POST /v1/ai/check-packages
REFUSE openai-python-sdk
no such name on the registry — squatters take these
REFUSE requests 2.19.0
GHSA-x84v-xcm2-53pg (high) · fixed in 2.33.0
PROCEED httpx 0.28.1
Your agent gets the verdict, not a report to interpret.
Bare names are taken as PyPI; npm: / pkg:npm/ for npm, name==1.2.3 or name@1.2.3 for a version. Names only — no source is sent.
claude mcp add --transport http vdb https://vdb.ai.kr/mcp --header "Authorization: Bearer $VDB_API_KEY"Nothing to install · works without a key · a free key (one email) raises the limitsOther tools →
Runs where your code is: an agent on your machine with the project folder (Claude Code, Cursor, Cline, Codex CLI). A chat-only web AI cannot use it — its sandbox has no outbound network, and it cannot see your files.
No MCP support? Paste a prompt instead
Which file it goes in, a README badge, and how many repositories carry it →
$
[VDB POLICY]- ChosenThe name your agent invented doesn't exist — and someone registered it
- MergedThe risky package is a transitive one nobody chose. The whole resolved lockfile gets scanned
- ShippedAttacker data reaches a dangerous call through your dependencies — with no CVE publishedsee a real run →
293,654 advisories13 ecosystems1,122 MCP serversSynced Nov 10
