Dependency gate for AI coding agents
Check it before
it's in your code
Your agent picks packages faster than advisories get written. VDB is the check it runs first.
POST /v1/ai/check-packages
REFUSE openai-python-sdk
no such name on the registry — squatters take these
REFUSE requests 2.19.0
GHSA-x84v-xcm2-53pg (high) · fixed in 2.33.0
PROCEED httpx 0.28.1
Your agent gets the verdict, not a report to interpret.
claude mcp add --transport http vdb https://vdb.ai.kr/mcpNothing to install · free API key, one emailOther tools →
No MCP support? Paste a prompt instead
$
[VDB POLICY]- ChosenThe name your agent invented doesn't exist — and someone registered it
- MergedThe risky package is a transitive one nobody chose. The whole resolved lockfile gets scanned
- ShippedAttacker data reaches a dangerous call through your dependencies — with no CVE publishedsee a real run →
286,786 advisories13 ecosystems967 MCP serversSynced Sep 8