Dependency gate for AI coding agents
Check it before
it's in your code
Your agent picks packages faster than advisories get written. VDB is the check it runs first.
POST /v1/ai/check-packages
REFUSE openai-python-sdk
no such name on the registry — squatters take these
REFUSE requests 2.19.0
GHSA-x84v-xcm2-53pg (high) · fixed in 2.33.0
PROCEED httpx 0.28.1
Your agent gets the verdict, not a report to interpret.
claude mcp add --transport http vdb https://vdb.ai.kr/mcp --header "Authorization: Bearer $VDB_API_KEY"Nothing to install · free API key, one emailOther tools →
Runs where your code is: an agent on your machine with the project folder (Claude Code, Cursor, Cline, Codex CLI). A chat-only web AI cannot use it — its sandbox has no outbound network, and it cannot see your files.
No MCP support? Paste a prompt instead
$
[VDB POLICY]- ChosenThe name your agent invented doesn't exist — and someone registered it
- MergedThe risky package is a transitive one nobody chose. The whole resolved lockfile gets scanned
- ShippedAttacker data reaches a dangerous call through your dependencies — with no CVE publishedsee a real run →
290,435 advisories13 ecosystems1,036 MCP serversSynced Oct 8