MCP.Market

lockvet MCP server

by matteo-sung·io.github.matteo-sung/lockvet·v0.6.20·1 stars
No reviews yet

Explain any lockfile or workflow-pin change: bumps, vulns, ages, deprecations — 61 formats

C68/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C68/100

full report

Adoption
New

1 stars

Reviews

Write one

Nobody has reviewed lockvet yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

lockvet tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-03 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 2 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How lockvet compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
68/100
higher than 30% of 48,255 servers
GitHub stars
1
more than 65% of 28,688 servers

Install lockvet in Claude Code, Cursor or VS Code

claude mcp add lockvet -- docker run -i --rm ghcr.io/matteo-sung/lockvet:0.6.20
Add to Cursor

What the publisher says

From the lockvet repository's README, as published. We do not edit it. Read it on GitHub

lockvet

Explain any lockfile change before you merge it.

▶ Try it in your browser — paste a Dependabot/Renovate PR URL, drop two lockfiles to diff, drop one to audit what it pins right now, or vet a package before you install it — no install needed. Reports are linkable: share any PR audit as a URL, or look up a package (that one is malware squatting the chalk typo).

Real example: a dependabot "patch" bump of jiff in sharkdp/fd quietly added 7 transitive crates — one of them flagged by RUSTSEC.

Would lockvet have caught it? — event-stream, the chalk/debug takeover, the Shai-Hulud worm (and its August 2026 return through keyv/Cacheable — replay it in your browser), the ultralytics miner, the strong_password gem hijack, the 2021 dependency-confusion attack, the tj-actions workflow-pin attack, and the Codecov poisoned-download shape, replayed against real advisories, with reproducible fixtures.

Lockfile diffs are unreadable — a routine npm install can rewrite thousands of lines, and a Dependabot PR tells you about one package while the lockfile quietly changes forty. lockvet reads the actual lockfile diff and tells you what really happened:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

lockvet: common questions

Is lockvet MCP server safe?
With care: it is graded C, so read the findings first (68/100). Read the lockvet safety report
How do I install lockvet?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does lockvet need an API key?
Yes. The registry entry asks for GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN, GITEA_TOKEN and 1 more.
Is lockvet maintained?
The last commit was 34 days ago (2026-10-01). The latest release is v0.6.20.
How does lockvet compare with other MCP servers?
safety score 68/100 (higher than 30% of 48,255 servers); github stars 1 (more than 65% of 28,688 servers). Full comparison.