Gate a new dependency

The cheapest security decision you will ever make is the one before npm install. Afterwards it is a migration.

Ask before installing

Before I add express, what is its risk profile and is there a version I should pin to?

vulnetix_package_search:

{
  "packageName": "express",
  "vulnerabilityCount": 40,
  "maxSeverity": "high",
  "exploitationSignals": {
    "crowdSecSightings": 0,
    "exploitCount": 3,
    "inCisaKev": false,
    "inVulnCheckKev": false
  },
  "eolStatus": null,
  "scorecardScore": 7.4,
  "safeHarbour": { "recommendedVersions": ["4.21.2"] }
}

Four fields decide it:

Field	What it tells you
`inCisaKev`	A KEV-listed package with no fix available is a stop, not a warning
`exploitationSignals.exploitCount`	Known vulnerabilities with public exploits are a different proposition from known vulnerabilities
`safeHarbour.recommendedVersions`	Pin to this
`scorecardScore`	Whether the project is maintained well enough to fix the next one

Is it the package you meant

Is expres a typosquat?

vulnetix_package_search on the exact string you are about to install. A name one character from something popular, with a low download count and a recent first-publish date, is the classic shape.

The vulnetix_typosquat_check prompt does this properly, cross-referencing AI-malware family intelligence and maintainer health.

What exactly is wrong with it

What advisories affect express?

vulnetix_package_vulns returns the distinct advisory set:

{
  "package": "express",
  "totalCVEs": 40,
  "cveIds": ["CVE-2024-29041", "CVE-2024-43796", "GHSA-qw6h-vgh9-j6wx", "..."]
}

Then vulnetix_vuln on the ones that matter. Forty advisories against a package is normal for something a decade old and does not by itself mean anything. What matters is which of them affect the version you would install.

Pick the version

Which version of express has no known vulnerabilities?

vulnetix_package_versions lists everything known, with reporting sources. Combined with safeHarbour.recommendedVersions, that is your pin.

For an exact coordinate from a lockfile or SBOM, vulnetix_purl:

pkg:npm/express@4.18.2

As one prompt

/mcp__vulnetix__vulnetix_dep_add_guard express --ecosystem npm

Composes vulnerability history, AI-malware check, license compatibility, EOL status, maintainer health and version lag into a single ALLOW / WARN / BLOCK verdict with the policy thresholds already set.

Making it automatic

Two ways, and they work together.

In the agent. Add to your project instructions:

Before adding any dependency, call vulnetix_package_search for it. Do not add anything with a KEV-listed vulnerability and no fixed version. Pin to safeHarbour.recommendedVersions when one is offered.

In CI, as a hard gate. A model deciding your merge gate can be wrong in both directions. For a deterministic answer use the CLI, which exits non-zero on its own with no model in the path:

vulnetix scan --evaluate-sca --severity high --exploits weaponized

See Agents in CI.

Why this is worth the thirty seconds

An added dependency is a decision about code you did not write, made once and inherited by everyone after you. The information above takes one tool call, and the alternative is finding out during an incident.