Skip to content
MCPpedia
Submit
Agent loop · Security

Dependency Audit Until Clean

Run a vulnerability audit on your dependencies, fix high and critical findings with the smallest safe upgrades, and repeat until the audit is clean.

Up to 8 iterationsStop rules and safety limits
All loops
The prompt

Copy the Dependency Audit Until Clean loop

Stops when the audit reports no high or critical vulnerabilities, or each remaining one is documented as not fixable, or after 8 iterations. Edit the settings block, then paste the whole prompt into your agent.

dependency-audit-until-clean.prompt.md
You are running the "Dependency Audit Until Clean" loop.

Settings (edit before running):
- Audit command: npm audit --json
- Check command: npm run build && npm test
- Severity threshold: high
- Max iterations: 8

Goal: no findings at or above the severity threshold.

Each iteration:
1. Run the audit command. List findings at or above the threshold: package, installed version, advisory ID, fixed version, and dependency path.
2. Take the most severe finding. If the package is a direct dependency, upgrade it to the lowest fixed version. If it is transitive, upgrade the parent that pulls it in. Use the package manager's override or resolution feature only as a last resort, and say so.
3. Run the check command. If it fails, try one fix, otherwise revert and mark the finding as blocked.
4. Re-run the audit. Log: advisory, package, change made, result.

Stop when:
- No findings remain at or above the threshold. Success.
- Every remaining finding is blocked or has no fixed version. Document each with its risk.
- You reach the max iteration count.

Rules:
- Never run a "force" fix that applies breaking upgrades in bulk.
- Do not remove a dependency to clear an advisory unless nothing uses it.
- Do not add packages to an audit ignore list. Recommend it in the report if you think it is justified.
- Keep the lockfile and manifest in sync after each change.

Final report: advisories fixed, advisories blocked with reasons, and any overrides you added.
When to use it

When this loop fits

  • A security scan or audit command is blocking your release with high or critical findings.
  • You received a vulnerability alert and want to know every place the package is pulled in.
  • You want a dated record of which advisories were fixed and which were accepted with reasons.
How it works

What happens on each pass

The agent repeats these steps until the stop condition holds or it runs out of iterations.

  1. Audit. Run the audit command and list findings by severity, package, and advisory.
  2. Trace the path. Find whether each vulnerable package is direct or pulled in through another dependency.
  3. Upgrade minimally. Move to the lowest version that fixes the advisory, upgrading the parent package if needed.
  4. Verify. Run the build and tests, then re-run the audit.
Recommended servers

MCP servers for this loop

The 6 strongest of 1531 matching servers, ranked by how closely they fit and then by trust score.

More in Security
  • EchelonGraph CVE & Exposure logo
    Trust score 73 of 100, Good

    CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.

    RegistryRemote
    LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 6 days ago.
    8 stars1.4K/wk weekly downloads— tools
  • Trust score 71 of 100, Good

    Query OSV.dev for package vulnerabilities and batch-audit dependency lists via MCP.

    RegistryRemote
    LicenseQualityMaintenanceLicense: A. Apache-2.0 is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 8 days ago.
    2 stars366/wk weekly downloads— tools
  • Trust score 55 of 100, Fair

    Search CVE vulnerability records from the NIST NVD database. No key required.

    Registry
    LicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.
    — stars—/wk weekly downloads— tools
  • Trust score 55 of 100, Fair

    Use this MCP server to OSV open source vulnerability data and package security checks. Tools...

    Registry
    LicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.
    — stars—/wk weekly downloads— tools
  • Trust score 55 of 100, Fair

    Triggers GuardBee scans, queries findings, AI-assisted remediation guidance

    Registry
    LicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.
    — stars—/wk weekly downloads— tools
  • ADF: EU Tenders, EU Funding, CVE KEV EPSS, Amsterdam Events logo
    Trust score 52 of 100, Fair

    33 official datasets: tenders, sanctions, recalls, CVE, law, tariffs, rates, yields, energy prices

    RegistryRemote
    LicenseQualityMaintenanceLicense: Not graded. No license is recorded for this server.Quality: Not graded. No README or tool list has been captured yet.Maintenance: Not graded. No commit or release date has been recorded.
    — stars—/wk weekly downloads— tools
Run it

How to run this loop

  1. Connect the tools. Install a server the loop can use, for example EchelonGraph CVE & Exposure, or rely on your agent's built-in terminal and file access.
  2. Edit the settings block. Replace the example commands, targets, and limits with your project's own. Keep the iteration cap low on the first run.
  3. Paste it into an agent session. Start a fresh session in Claude Code, Cursor, or VS Code agent mode, in the repository root, and paste the prompt.
  4. Review before you merge. Read the final report and the diff. The loop leaves its work for you to review rather than shipping it.
FAQ

Dependency Audit Until Clean questions

When does the Dependency Audit Until Clean loop stop?

It stops as soon as the audit reports no high or critical vulnerabilities, or each remaining one is documented as not fixable. It also stops after 8 iterations by default, or earlier when the prompt's own stop rules say it is stuck, and then reports what changed and what is left. Change the cap in the settings block at the top of the prompt.

How does the loop handle vulnerabilities in transitive dependencies?

It upgrades the direct dependency that pulls the vulnerable package in, which is the cleanest fix. Only when no parent release fixes it does the agent use an override or resolution, and the final report lists every one so you can remove them later.

Can I use a different scanner than npm audit?

Yes. pip-audit, cargo audit, osv-scanner, Trivy, and Snyk all report the advisory, installed version, and fixed version the loop needs. Security MCP servers can also run scans and fetch advisory details for the agent.

Keep exploring
All loops