---
title: "Introducing SafeDep Model Context Protocol (MCP) Server to Secure AI Generated Code"
description: "Introducing SafeDep Model Context Protocol (MCP) Server, a new feature in SafeDep vet to secure AI generated code and protect against slopsquatting attacks, vulnerable and malicious packages."
url: "https://safedep.io/blog/introducing-vet-mcp-server"
author: "SafeDep Team"
published: "2025-06-06"
---

# Introducing SafeDep Model Context Protocol (MCP) Server to Secure AI Generated Code

## Why build this?

SafeDep [vet](https://github.com/safedep/vet) now exposes a Model Context Protocol (MCP) Server to secure AI generated code and protect against slopsquatting attacks, vulnerable and malicious packages. This feature is available to all the users of SafeDep vet, enabling IDE native software composition analysis (SCA) for AI generated code. To use this feature:

1. Configure MCP clients (eg. Cursor, Claude Code) to use SafeDep `vet` MCP server
2. Instruct the MCP Clients to use the MCP server before installation of any package
3. Once setup, it will automatically vet all packages before installation by the editor

Adoption of AI Code Generation and Agentic Software Engineering opens up new attack vectors such as [slopsquatting](https://en.wikipedia.org/wiki/Slopsquatting).
It is imperative to have appropriate guardrails against attacks exploiting LLM hallucinations and prompt injection attacks against agentic coding tools
to deploy vulnerable and malicious packages.

## How to use SafeDep MCP Server

You will need an MCP client such as [Cursor](https://www.cursor.com/), [Claude Code](https://www.anthropic.com/claude-code) etc. used for AI code generation. Add the following to the MCP client configuration to use SafeDep `vet` MCP Server. For Cursor, it will be `~/.cursor/mcp.json` file but will be different for other MCP clients.

```json
{
  "mcpServers": {
    "vet-mcp": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "ghcr.io/safedep/vet:latest", "server", "mcp"]
    }
  }
}
```

Create a prompt or a rule instructing your AI Code Editor to use the MCP Server to vet all packages before installation. For Cursor, create a rule file in your project directory at `.cursor/rules/vet-mcp.mdc` with the following content:

```markdown
---
description: vet Open Source Packages using vet MCP server
alwaysApply: true
---

Always use vet-mcp to vet any open source library package suggested by AI generated code before installation.
Follow the rules below to use vet-mcp:

- Try to find the latest version. If not found, it is likely a slopsquatting vulnerability
- Always check for critical vulnerabilities and malware
```

### Usage

Once setup, it will automatically vet all packages before installation suggested by AI generated code.

![vet MCP Server with Cursor](https://safedep.io/_next/static/immutable/media/vet-mcp-cursor.1_84zbhbe2-ei.png)

### AI Native Software Composition Analysis (SCA)

AI IDE chat interfaces can be used to ask questions about various packages and their vulnerabilities to make sure the code is secure.
For example, you can ask: `Is npm package launch-darkly-provider` safe to use before installation.

**Note:** [launch-darkly-provider](https://www.npmjs.com/package/launch-darkly-provider) is a known malicious package that our
systems [discovered recently](https://platform.safedep.io/community/malysis/01JX45GQWA3BP3E5Y902519WDQ) and is not safe to use. For
near-real time protection against malicious packages, setup [SafeDep vet](https://github.com/safedep/vet) in your CI/CD pipeline in
addition to development environment.

![vet MCP Server with Cursor](https://safedep.io/_next/static/immutable/media/vet-mcp-launch-darkly-provider.333ee9ep814lz.png)

## How it works?

The MCP server is built using [SafeDep vet](https://github.com/safedep/vet) as the foundational SCA engine.
It is supported by SafeDep Cloud APIs to query for malicious packages that are being continuously updated using [SafeDep Malicious Package Scanning](https://docs.safedep.io/cloud/malware-analysis) service.
For community contributions and support, open an issue on [SafeDep GitHub](https://github.com/safedep/vet/issues) or start a [GitHub Discussion](https://github.com/safedep/vet/discussions).