How do I install Hound?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Hound need an API key?

No required environment variable is listed on this record.

When was Hound last checked?

Last checked 2026-11-05. The dependency bloodhound for AI coding agents. Free, no API keys.

Server MCP Hound

Power your agent

Tambahkan server ini

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Jalankan di PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add tiluckdave-hound-mcp -- npx -y hound-mcp@0.2.1

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "tiluckdave-hound-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Jalankan di PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Buka

Server facts

Local

Transport: stdio
License: MIT
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

Hound MCP

The dependency bloodhound for AI coding agents.

Hound MCP Deployment Diagram

Why Hound?

AI coding agents recommend and install packages without knowing if they're safe — and most security tools require accounts, API keys, or paid plans to tell you. Hound fixes that: it scans for vulnerabilities, checks licenses, audits dependency trees, and detects typosquatting across 7 ecosystems — zero config, zero API keys, zero cost.

Hound is the only security tool built specifically for AI coding agents — works across npm, PyPI, Go, Cargo, Maven, NuGet, and RubyGems, and plugs into Claude Code, Cursor, VS Code, and any MCP client out of the box.

It uses two fully free, unauthenticated public APIs: deps.dev (Google Open Source Insights) and OSV (Google Open Source Vulnerabilities).

Quickstart

Claude Code

claude mcp add hound -- npx -y hound-mcp

Claude Desktop / Cursor / Windsurf

Add to your MCP config file:

{
  "mcpServers": {
    "hound": {
      "command": "npx",
      "args": ["-y", "hound-mcp"]
    }
  }
}

VS Code (Copilot)

{
  "mcp": {
    "servers": {
      "hound": {
        "type": "stdio",
        "command": "npx",
        "args": ["-y", "hound-mcp"]
      }
    }
  }
}

Config file locations

Client	Config path
Claude Desktop (macOS)	`~/Library/Application Support/Claude/claude_desktop_config.json`
Cursor	`~/.cursor/mcp.json`
Windsurf	`~/.codeium/windsurf/mcp_config.json`

Tools

12 tools → Full reference with example outputs

Tool	What it does
`hound_audit` ⭐	Scan an entire lockfile for vulnerabilities across all dependencies
`hound_score`	0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
`hound_compare`	Side-by-side comparison of two packages with a recommendation
`hound_preinstall`	GO / CAUTION / NO-GO verdict before installing a package
`hound_upgrade`	Find the minimum safe version upgrade that resolves all known vulns
`hound_license_check`	Scan a lockfile for license compliance against a policy
`hound_vulns`	All known vulnerabilities for a package version, grouped by severity
`hound_inspect`	Full package profile — license, vulns, scorecard, stars, dep count
`hound_tree`	Full resolved dependency tree with transitive deps
`hound_typosquat`	Detect typosquatting variants of a package name
`hound_advisories`	Full advisory details by GHSA, CVE, or OSV ID
`hound_popular`	Scan popular packages for known vulnerabilities

Supported ecosystems: npm · pypi · go · maven · cargo · nuget · rubygems

Built-in Prompts

3 prompts you can invoke directly from your AI client. → Full prompt reference

Prompt	What it does
`security_audit`	Full project security audit — vulns, licenses, typosquats
`package_evaluation`	Go/no-go recommendation before adding a new dependency
`pre_release_check`	Pre-ship dependency scan that flags release blockers

Use Cases

→ See full examples with real lockfiles and expected output

Before merging a PR — scan the lockfile diff to catch newly introduced vulnerabilities before they land in main
Auditing an inherited codebase — run hound_audit on an existing lockfile to get a full report in seconds
Checking a package before adding it — use hound_preinstall to get a GO / CAUTION / NO-GO verdict
License compliance — run hound_license_check to ensure no GPL or AGPL packages sneak into a commercial project
CI security gate — ask your AI agent to run a security audit as part of every release check

Local Development

git clone https://github.com/tiluckdave/hound-mcp.git
cd hound-mcp
pnpm install
pnpm build
pnpm test         # run tests
pnpm check        # typecheck + lint + test

Roadmap

Docker support — run Hound as a container for CI/CD pipelines
bun.lockb parser — Bun lockfile support
gradle.lockfile parser — Gradle (Java/Android) ecosystem support
hound_diff tool — compare two lockfile snapshots to surface newly introduced risks
GitHub Action — run hound_audit as a PR check without an AI agent

Contributing

Contributions are welcome. Read CONTRIBUTING.md to get started.

The one rule: Hound must stay zero-config and free forever. Don't add features that require API keys or accounts.

Good first issues are labeled and ready.

Community

💬 Questions or ideas? Open a Discussion

Hound

Tambahkan server ini

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Hound?

Does Hound need an API key?

What transport does Hound use?

When was Hound last checked?

Documentation

Hound MCP

Why Hound?

Quickstart

Claude Code

Claude Desktop / Cursor / Windsurf

VS Code (Copilot)

Config file locations

Tools

Built-in Prompts

Use Cases

Local Development

Roadmap

Contributing

Community

License