# Kaiv Dependency Trust MCP server

Source: https://glimind.com/server/mcp-registry%2Fai.kaiv%2Fdependency-trust
Registry id: `mcp-registry/ai.kaiv/dependency-trust`
Status: live (checked 2026-10-27T15:05:08.213Z)

## Verdict

Kaiv Dependency Trust MCP server answered 99.98% of Glimind's liveness checks over 30 days, better than 41% of MCP servers, with 458 ms median handshake and 7 outages in 90 days. Its agent-readiness grade is A (100/100) across 5 tools, costing an agent about 1,188 tokens to load. Checked every few minutes; no tool is ever called.

## Measurements (30 days)

| Metric | Value | Better than |
|---|---|---|
| Uptime, 30 days | 99.98% | 41% of MCP servers |
| Median handshake latency | 458 ms | 48% of MCP servers |
| p95 handshake latency | 2623 ms | — |
| Checks in 30 days | 5,046 | — |
| Outages, 90 days | 7 | — |
| Median recovery | 6 min | — |
| Agent-readiness score | 100/100 (A) | 93% of MCP servers |
| Tools | 5 | — |
| Tool-list size for an agent | ~1,188 tokens | 69% of MCP servers |
| Days observed | 29 | — |

## Install

```json
{
  "mcpServers": {
    "kaiv-dependency-trust-mcp-server": {
      "type": "http",
      "url": "https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d"
    }
  }
}
```

Claude Code:

```sh
claude mcp add --transport http kaiv-dependency-trust-mcp-server https://api.kaiv.ai/api/bridge/mcp/dependency-trust-f1aaf06d
```

## Tools (5)

- `get_advisory`: Get a security advisory (vulnerability) by its key. Returns a security advisory by key, for example a GHSA id taken from a version's advisoryKeys, including the
- `get_dependencies`: Get the resolved dependency graph for one package version. Returns the full resolved dependency graph (direct and indirect) for a version. Each node has the dep
- `get_package`: List every version of a package and whether each is deprecated. Returns all published versions of a package with publish date, the default-version flag, and dep
- `get_package_version`: Get license, security advisories, and source links for one package version. Returns detailed metadata for a single version: SPDX licenses, security advisoryKeys
- `get_project_health`: Get a project's OpenSSF Scorecard security posture and maintenance signals. THE trust check. Returns supply-chain trust signals for a package's source repositor

Measured by Glimind (https://glimind.com): MCP handshake + tool list only, no tool is ever called. CC BY 4.0.